International Association
for Cryptologic Research

In this work we propose a novel Boolean lookup-table evaluation methodology over binary CKKS when circuit XORs are kept lazy, i.e., evaluated as additions whose least significant bits remain correct. Our method represents a LUT in the Walsh basis, forms the required parity sums by lazy CKKS additions, and packs them into ciphertext slots. We then use CKKS binary bootstrapping as a refresh step: the StC stage maps the packed lazy parities to MSB-encoded bits, removing the overflow; CtS places the parity values in slots; and $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ cleans the binary noise, leaving clean parities in the slot domain. The LUT is then evaluated by recombining these parities with plaintext Walsh coefficients. This decouples the LUT size from the multiplicative depth of the surrounding circuit: large LUTs can be handled by cleaning selected factored parity signs and spending only a small constant depth in recombination. We apply this framework to AES-CTR transciphering. The AES S-box is evaluated with a nibble-split Walsh decomposition, which supports more AES blocks at the cost of one additional multiplication depth. The AES state remains in full complex CKKS packing so real and imaginary lanes carry independent AES blocks. In CPU experiments, the Walsh S-box AES-CTR algorithm is 3.25x faster than the sparse-bootstrapping XBOOT variant at the same 1024-block batch size.

We study the limits of single-server private information retrieval (PIR) with preprocessing. Prior work has shown that single-server PIR with sublinear communication requires a linear number of (public-key) server operations per query [DMO00, DH24]. Recent breakthrough works, including [CHK22, ZPZS24, LMW23], circumvent these lower bounds by critically leveraging preprocessing to construct single-server PIR with sublinear query computation.

Our work presents computation lower bounds for any single-server PIR with preprocessing that makes blackbox usage of any cryptography (such as random oracles and virtual blackbox obfuscation). For any client preprocessing scheme where the client stores $s$ bits about an $n$-bit database, we prove the online amortized computation must be $\Omega(n/s)$ across $k = \Omega(s)$ queries (even if performed in a single batch query). In more detail, we prove that they must have either $\Omega(n/s)$ amortized online communication or the server must perform $\Omega(n/s)$ cryptographic operations. Our lower bounds are optimal as there exist PIRs with client preprocessing matching exactly one of the above requirements while outperforming the other. Furthermore, our lower bounds also rule out the existence of doubly efficient PIR from blackbox cryptography with sublinear query computation (current constructions use ring LWE). We note our lower bounds are widely applicable to any single-server PIR scheme that makes blackbox usage of cryptography including those with weaker privacy guarantees. In contrast, prior works only proved computation lower bounds for restricted classes of single-server PIR constructions (e.g., non-encoding servers or single-roundtrip queries).

Our proof framework also supports $\Omega(n/s)$ communication lower bounds for the following three classes of single-server PIR: schemes where the server performs $o(n/s)$ cryptographic operations, schemes where the server's cryptographic operations depend only on query communication and schemes with perfect privacy in the idealized model. Our results hold unconditionally whereas prior communication lower bounds required additional complexity assumptions.

We also prove lower bounds for symmetric private information retrieval (SPIR) with client preprocessing in the random oracle model and present a matching SPIR construction with client preprocessing using only OWFs during queries.

In this paper, we investigate the nonexistence of $N$-ary sequences with ideal arithmetic correlation. We prove that there exist no ternary, quaternary, or $6$-ary sequences with ideal arithmetic autocorrelation when the connection integer is an odd prime power $p^{t}$ and $\textup{ord}_{p^{t}}(N)=\phi(p^{t})/4$, where $\phi$ denotes Euler's totient function. Furthermore, when the connection integer is an odd prime $p$ and $\textup{ord}_{p}(N)=\phi(p)/6$, no such ternary, quaternary, or $6$-ary sequences exist for ideal arithmetic correlation. This includes in particular the case $p\equiv7(\textup{mod}12)$, for which $\textup{ord}_{p}(N)=\phi(p)/6$ and we further show that no $N$-ary sequence with ideal arithmetic correlation exists for any prime $N>2$. These results provide further evidence that ideal arithmetic correlation is highly restrictive in the $N$-ary setting.

We present a concrete bit-operation cost model for solving multivariate quadratic systems with XL using Wiedemann linear algebra, and Berlekamp-Massey sequence recovery. Following the CryptAttackTester methodology, we implement XL in a circuit-oriented model and derive closed-form cost formulas for the XL, Wiedemann, and Berlekamp-Massey steps. We instantiate the model for GF(2), GF(31), and GF(256), including baseline, constant-coefficient, and bucketed matrix-evaluation variants. Experiments on small parameter sizes show that the formulas accurately predict the circuit costs, while asymptotic analysis confirms convergence to the expected leading constant factors determined by the underlying field arithmetic. We apply the resulting estimates to Fukuoka MQ Challenge instances and to multivariate candidates from the NIST additional-signature process, providing a unified bit-operation comparison of direct Wiedemann-XL costs across several MQ-based schemes.

Privacy-Preserving Machine Learning (PPML) is a methodology designed to maintain data privacy throughout the machine learning pipeline. Although cryptographically protecting input privacy at the training phase is theoretically feasible, it remains computationally intensive in practice. As such, most recent works in this area focus on the inference phase. In contrast, we consider the training phase. Our goal is to enable machine learning engineers to use customer data earlier in the ML pipeline without compromising customer privacy or violating regulations. In this work, we introduce a framework named PriFT (Private Fine-Tuning), which leverages a transformer as a feature extractor and then performs training of a neural network on privacy-protected features. PriFT supports fully-private training, where the data is encrypted in the entire ML pipeline, as well as semi-private training, which balances privacy and performance by decrypting the true and predicted labels during training. PriFT can perform secure training both by means of Multiparty Computation (MPC) and based on Homomorphic Encryption (HE), which allows for a direct comparison of the two most prevalent cryptographic solutions for secure computation on a real-world use case. The codebase of our experiments is fully open-sourced and based on well-established libraries, namely Crypten and TenSEAL. Our experimental results show that the MPC approach largely outperforms the HE approach, especially in the semi-private setting. Furthermore, the MPC-based solution in the semi-private setting outperforms the fully-private training approximately by 3×, offering an adequate privacy-performance tradeoff. Our results show that both HE and MPC can achieve accuracy close to that of plaintext models.

Blind watermarking enables image ownership verification without requiring the original image. However, existing schemes usually require the owner to reveal the watermark seed and watermark positions during extraction. This creates a strong trust assumption on the verifier. Once such secrets are exposed, a malicious verifier can forge or remove the watermark. In this paper, we present TIM, the first publicly verifiable blind watermarking scheme with sensitive parameters privacy based on zero-knowledge proof. TIM reconstructs the extraction procedure of Integer DCT blind watermarking into an arithmetic-circuit-friendly form. This allows the owner to prove correct extraction without revealing the watermark seed or embedding positions.

TIM addresses three main challenges. The first is the high proving cost for high-resolution images. The second is the conflict between circuit rigidity and watermark robustness. The third is the hashing overhead of iterative state binding. To address them, TIM combines Nova and Spartan to decompose full-image extraction into iterative proofs. It uses a threshold-based voting mechanism for robust detection. It also introduces a hierarchical state update mechanism to reduce circuit and memory costs. Experiments show that TIM preserves good imperceptibility and robustness while achieving practical efficiency. For a 4K image, proof generation takes 5.61 minutes and uses 9.61 GB peak memory. These results show that TIM is the first blind watermarking scheme to achieve seed privacy, public verifiability, and practical performance for high-resolution image ownership proofs.

Attribute-based inner-product functional encryption (AB-IPFE), introduced by Abdalla et al. (Asiacrypt'20), is a cryptosystem that combines the access-control capability of attribute-based encryption (ABE) with the linear-computation capability of inner-product functional encryption. By introducing a hierarchical structure between these two functionalities, we can decompose the key generation algorithm into two steps. While such a structure has been extensively studied in contexts such as hierarchical IBE and delegatable ABE, it has received little attention in AB-IPFE despite its naturalness.

In this paper, we formalize a framework for two-level hierarchies in AB-IPFE and classify existing schemes according to their hierarchizability. In particular, we focus on adaptively secure schemes that support expressive access control, such as arithmetic programs in the public-index setting and attribute-hiding inner-product predicates in the private-index setting. To the best of our knowledge, the only efficient constructions known to meet these requirements are those obtained from the framework of Abdalla et al. in the private-index setting and from the scheme of Datta and Pal (Asiacrypt'21) in the public-index setting. We propose several new pairing-based constructions that achieve adaptive security.

First, we revisit the approach of Abdalla et al. Based on their framework, we propose three types of constructions that trade off hierarchizability, ciphertext size, and secret-key size. These constructions are based on predicate encodings and therefore support arithmetic span programs or attribute-hiding inner-product predicates.

Second, we revisit the approach of Datta and Pal. Their scheme supports attribute-weighted sums, which differ slightly from our target functionality. Although this already yields an AB-IPFE scheme, the resulting scheme is limited to the non-zero-type key-policy setting. We efficiently adapt their scheme to obtain AB-IPFE schemes that also support zero-type predicates, and we propose a ciphertext-policy variant. All of the resulting constructions can be hierarchized, but their intermediate secret keys are large. We also propose variant schemes with shorter intermediate secret keys, at the cost of somewhat larger final secret keys. These schemes support arithmetic branching programs.

Event date: 14 November to 15 November 2026
Submission deadline: 7 August 2026
Notification: 1 October 2026

Event date: 26 October to 29 October 2026
Submission deadline: 14 September 2026
Notification: 5 October 2026

Event date: 5 April to 8 April 2027
Submission deadline: 22 October 2026
Notification: 3 December 2026

Event date: 13 July to 15 July 2026

Event date: 1 May to 3 May 2027
Submission deadline: 15 July 2026
Notification: 1 September 2026

Ensuring robustness and liveness in distributed verifiable random functions (DVRFs) allows the protocol to maintain correct operation and guarantee output generation, even in the presence of malicious actors attempting to disrupt the process, delay cryptographic shares, or remain unresponsive. Because existing DVRF protocols typically rely on synchronous or semi-synchronous network assumptions, simultaneously achieving these properties remains a challenge. To address this limitation, this paper enhances the FROST-based Icy-DVRF protocol to achieve both robustness and liveness. Specifically, we propose (R)Icy-DVRF, a novel protocol that operates over an asynchronous network while maintaining a constant-size proof. This is achieved by integrating the ROAST wrapper framework into the underlying threshold signature mechanism.

We show that the runtime complexity of the attack described in \emph{``Cryptanalysis of HAWK: a Guessing Game''} is much higher than originally claimed by its authors, and the attack is unlikely to pose a threat to HAWK's security in its present form. The attack algorithm had not been implemented before this work; the polynomial-time running-time claim was based on four ``plausible heuristics''. Our experiments and implementation data point to a super-polynomial class-number obstruction, consistent with exponential-scale growth. The experiments also helped to identify faulty ``Heuristic 4'' as the source of the observed computational wall when scaling dimension $n$. The authors of Guessing Game have acknowledged our findings. To make the argument more universal, we also offer a machine-checked conditional reduction from explicit assumptions that shows the complexity to be at least super-polynomial. In terms of methodology, our work demonstrates the role of powerful AI tools in contemporary cryptanalysis -- the sudden feasibility of rapid exploration and trial implementation of advanced attack techniques. A public research artifact contains all source code and datasets to reproduce our results.

Federated Learning (FL) enables collaborative model training without centralizing raw data, but remains vulnerable to gradient inference attacks, malicious aggregation servers, and communication inefficiencies. Existing cryptographic secure aggregation schemes provide confidentiality and verifiability yet lack formal statistical privacy guarantees, while most differential privacy (DP)-based approaches rely on fixed noise injection, resulting in suboptimal privacy--utility tradeoffs.

This paper proposes HEAD-FL, a secure and efficient federated learning framework that integrates adaptive differential privacy with verifiable homomorphic aggregation. The proposed scheme introduces a round-adaptive Gaussian perturbation mechanism analyzed under the Rényi Differential Privacy (RDP) framework, enabling tight cumulative privacy accounting and explicit conversion to $(\varepsilon, \delta)$-DP guarantees. By adopting Federated Averaging (FedAvg) instead of gradient-based aggregation, the framework significantly reduces communication overhead while preserving confidentiality, verifiability, and robustness to client dropouts.

Theoretical analysis and experimental evaluation demonstrate that HEAD-FLachieves improved privacy--utility tradeoffs and enhanced communication efficiency compared with fixed-noise and gradient-based secure aggregation methods, making it suitable for deployment in privacy-sensitive and bandwidth-constrained environments.

Most existing multiparty computation (MPC) protocols assume static and equal participation. All computing parties can dedicate resources and stay online for the entire computation, and they have equal influence on computation correctness and security (i.e., they are equally hard to corrupt). Supporting dynamic participation, so parties can join/leave at will, and associating weights to these parties reflecting their trust level, are essential to enable MPC in contemporary emerging applications. Existing solutions addressed these issues separately at varying security levels, and attempting to combine them while addressing malicious security raises several challenges and open questions.

In this paper, we close this gap and develop maliciously-secure MPC protocols that support weighted participation in both static and dynamic (or fluid) settings. In particular, we extend prior work on weighted ramp secret sharing (WRSS) to support verifiability and proactivity, which could be of independent interest. Then, we show how to perform arithmetic operations over weighted shares in a verifiable way, thus enabling maliciously-secure weighted MPC with guaranteed output delivery under static participation. Utilizing the proactivity feature of our secret sharing scheme, we develop a state handover protocol and employ it to support dynamic participation in committee-based MPC with the same security guarantees. Both protocols are synchronous and assume honest majority. To the best of our knowledge, our work is the first to support both weighted and dynamic participation in MPC.

Secure/Multipurpose Internet Mail Extensions (S/MIME) is a standards-based mechanism for certificate-backed email signing and encryption. Its post-quantum migration is now technically actionable: ML-KEM public keys can be represented in X.509 certificates, and CMS can carry ML-KEM recipient information through \texttt{KEMRecipientInfo}. These standards solve an encoding problem, but they do not by themselves solve an assurance problem. A mailbox may possess a post-quantum-capable certificate while a generated CMS \texttt{EnvelopedData} object still protects the content-encryption key (CEK) through RSA or elliptic-curve key management; a multi-recipient message may mix ML-KEM and classical recipient paths for the same CEK; and archived mail may remain protected only by quantum-vulnerable mechanisms.This paper studies this assurance gap by shifting the unit of analysis from certificates to encrypted messages. We model encrypted S/MIME as a multi-recipient CMS object with certificate-bound paths to a shared CEK and show that post-quantum confidentiality is a universal message-level property: every valid path to the CEK must satisfy the active migration policy. Consequently, the presence of one ML-KEM recipient path is insufficient if another valid classical path can recover the same CEK. We then present \texttt{SMIME-PQCheck}, a standards-driven validation framework that combines X.509 profile checks, CMS recipient-structure analysis, policy-driven hybrid handling, and archive-level risk aggregation. The framework classifies S/MIME objects as \texttt{pqc-protected}, \texttt{hybrid-protected}, \texttt{classical-only}, \texttt{unsafe-mixed-mode}, \texttt{invalid}, or \texttt{unknown}. The result is a practical assurance layer for organizations migrating S/MIME deployments from certificate-level PQC readiness to auditable message-level protection.

Anonymous credentials enable privacy-preserving authentication but existing systems either lack support for predicate proofs or are tied to specific signature schemes without a formal framework. We propose the first constructive framework for anonymous credentials with native predicate proof support. The framework provides definitions of entities, operations, adversary models, and security properties—unforgeability, unlinkability, and minimal disclosure. To demonstrate its feasibility, we instantiate the framework with BBS signatures, Pedersen commitments, and ring signature based proofs. The instantiation yields compact credentials and efficient zero-knowledge predicate proofs. We prove that the instantiation satisfies all security properties under standard assumptions (q-SDH, discrete logarithm, and the zero-knowledge of the ring signature based proof). A performance evaluation confirms that credential issuance, verification, and predicate prove/verify are practical on standard hardware, with compact credentials and proofs whose communication cost grows modestly with the number and encoding length of proved attributes, and favorable runtime and storage relative to a CL-based baseline. Our framework provides a modular foundation for designing and analyzing anonymous credential systems with fine-grained attribute disclosure.

Two-server Private Information Retrieval achieves arbitrarily small polynomial communication, but relies on a strong non-collusion assumption that is difficult to justify in practice.

We introduce a new variant of two-server PIR in which one server acts as a standard \emph{compute} server, while the other is a restricted \emph{retrieval-only} server. The latter stores a public encoding of the database and merely serves requested symbols or blocks of this encoding, without performing any PIR-specific computation. We argue that such a retrieval-only server can be instantiated using existing static-content or repository-hosting services, thereby grounding the non-collusion assumption in realistic architectural and deployment constraints.

Assuming Learning Parity with Noise (LPN) over the ternary field with inverse-polynomial noise rate, we construct RC-PIR with arbitrarily small polynomial communication and polynomial storage. Leveraging this construction, we derive the following unexpected applications for every constant \(k\): \begin{enumerate} \item \(k\)-server PIR with arbitrarily small polynomial communication and privacy against any coalition of \(k-1\) servers.

\item \(k\)-server robust PIR with arbitrarily small polynomial communication that simultaneously achieves correctness and privacy with respect to an arbitrary monotone access structure \(\mathcal{A}\). Namely, correctness is guaranteed whenever the set of online servers \(S\) satisfies \(S \in \mathcal{A}\), while privacy holds against every coalition \(S \notin \mathcal{A}\).

\item A \(k\)-party secure computation protocol for size-\(n\) truth tables also known as lookup tables, with arbitrarily small polynomial communication and passive security against any coalition of \(k-1\) parties. This result extends to active security either in the honest-majority setting, or without an honest majority assuming collision-resistant hash functions. \end{enumerate} None of these results were previously known under the LPN assumption. Along the way, we uncover new relationships between different complexity measures of PIR.

Over the past half-decade, transparent succinct arguments have migrated off the 256-bit scalar fields of pairing-friendly elliptic curves and onto small fields: the 64-bit Goldilocks prime, the 31-bit primes BabyBear and KoalaBear, the Mersenne prime 2³¹−1 reached through the circle construction, and binary tower fields down to F₂. We call this movement the "small-field turn" and systematize it with the finite field, rather than the proof system or the virtual machine, as the unit of analysis. We organize the fields in use by the structural properties that drive their selection: machine-word fit, two-adicity, reduction cost, and the S-box automorphism structure exploited by algebraic hashes; and we show how each is realized in a production prover (Plonky2, Plonky3, Stwo, Binius, and their descendants). We then assemble, across systems that state it only individually, the relationship between base-field width and the extension degree that Fiat–Shamir soundness requires, and we set that relationship against the measured gap between conjectured and provable soundness for non-interactive FRI. Finally, we separate the peer-reviewed results on embedding and arithmetization overhead from the vendor benchmarks that dominate the topic, and identify the controlled cross-field comparison whose absence is the area's sharpest empirical gap. No prior work takes field choice as its organizing object across this design space; the nearest systematization treats it as one dimension among many within a zero-knowledge virtual machine taxonomy. We frame the turn as the exploration of a single trade, cheaper arithmetic against repurchased soundness and simulated non-native operations, and argue from the provenance of the fields where the frontier is likely to move next.