International Association
for Cryptologic Research

This paper presents a native Rust implementation of the Korean post-quantum cryptography algorithms (i.e., NTRU+, SMAUG-T, HAETAE, AIMer). We optimize the implementation in Rust for speed and memory usage, and compare our implementation with the C reference code (KpqClean) and unoptimized Rust implementation (baseline).

For speed, we use AVX2 and PCLMULQDQ to accelerate NTT- and Toom–Cook-based polynomial multiplication, 4-way SHAKE, and carry-less GF(2^λ) multiplication. Compared to the C reference, the speed-optimized version reduces the execution time by 32–76% across all target schemes.

For memory, we reduce large temporary buffers through on-the-fly approach, two-pass sampling, and transcript recomputation. Against the C reference, the memory-optimized implementation reduces the total memory usage by 1–94% across all target schemes.

Overall, these results show a speed–memory trade-off, letting an implementation be chosen according to whichever resource is more constrained.

To initiate migration to post-quantum cryptography (PQC), it is necessary to identify whether deployed software uses quantum-vulnerable (QV) public-key cryptographic schemes such as RSA, ECDSA, and Diffie–Hellman (DH). However, many ELF executables are distributed without source code, making it necessary to directly screen executable binaries for QV candidates. A prior tool, Quantum-vulnerable Executable Detection (QED), provides high precision but incurs substantial analysis cost, whereas its lightweight variant, QED-Lite, is faster but produces more false positives (FPs).

This paper proposes ML-QED-Lite, a machine learning-based approach designed to retain the efficiency of QED-Lite while reducing FPs. Unlike a post-filter that merely reclassifies candidates selected by QED-Lite, ML-QED-Lite directly takes all ELF executables in a target directory as input. For each file, it extracts function symbols, library dependencies, and binary-level attributes, and then uses a trained classification model to determine whether the file is a candidate for PQC migration.

The evaluation results show that ML-QED-Lite detects the same five positive executables as QED-Lite on the network dataset while reducing FPs from two to zero. On the synthetic dataset, ML-QED-Lite retains the same six positive executables while reducing FPs from four to zero. These results indicate that ML-QED-Lite preserves the true positives (TPs) identified by QED-Lite while reducing FPs, thereby improving the practicality of lightweight screening for PQC migration.

Following the standardization of major post-quantum cryptography (PQC) algorithms, C implementations of ML-KEM, ML-DSA, and SLH-DSA have been rapidly deployed. However, known-answer tests (KATs) verify only functional correctness and do not establish the absence of timing leakage caused by secret-dependent branches, memory accesses, or variable-latency instructions. This paper presents CT-KAT, an integrated screening platform for assessing constant-time risks in PQC C implementations. CT-KAT is configured through a single YAML file. Using this configuration, it validates the build and KAT execution. It also automatically generates harnesses for the functions under analysis. It then performs several analyses within a unified pipeline. These include Valgrind/Memcheck-based structural checks, a ct-matrix over compiler and optimization-level combinations, and an assembly-level asm-scan. When configured, the pipeline also runs dudect-based timing tests. CT-KAT aggregates the results of these checks into a single verdict drawn from a nine-class taxonomy. CT-KAT does not treat a PASS result as proof of constant-time behavior. Instead, it applies a default-deny policy when assigning verdicts. It also provides supporting evidence to guide manual triage. When applied to a PQClean-based PQC corpus, CT-KAT produced four main classifications. The baseline ML-KEM target was classified as robust. The KyberSlash reproduction was flagged as a secret-dependent variable-latency risk, labeled varlat-secret-risk. The variable-time behavior of ML-DSA and SLH-DSA/SPHINCS+ was accepted under the label accepted-variable-time. Falcon-512 was retained for further analysis and labeled needs-analysis. These results show that CT-KAT provides a screening framework that integrates signals from multiple analysis layers while making the limitations of each tool explicit.

AIMer is a post-quantum digital signature scheme with a conservative design. Its security relies only on the symmetric-key one-way function AIM2 and an MPC-in-the-Head (MPCitH) zero-knowledge proof. AIMer is a Korean post-quantum cryptography (KpqC) standard. However, the AIMer standard code released in January 2026 is a portable C reference implementation. It does not include processor-specific optimizations. As a result, it does not exploit AVX-512, a 512-bit vector instruction set available on modern processors. This paper presents an AVX-512 optimized implementation for all six AIMer variants. We parallelize binary-field multiplication with VPCLMULQDQ. The implementation processes four MPC parties per 512-bit register. We also handle conditional XOR accumulation in the linear layer with a single VPTERNLOGQ instruction. In addition, we accelerate the Keccak permutation using AVX-512VL. Our implementation is 1.60–1.84× faster than the AVX2 implementation for signing. We further analyze the source of this speedup. Contrary to common intuition, most of the improvement comes from Keccak. In the 128-bit and 192-bit variants, Keccak accounts for about 86% of the total improvement. Only in the 256-bit variants does the field-arithmetic contribution increase to about 42%, due to the wider field size. These results show that vectorizing symmetric primitives is as important as binary-field arithmetic in MPCitH signatures. In some cases, it is even more important.

As TLS 1.3 migrates to post-quantum cryptography (PQC), hybrid X.509 transition strategies—alternative-signature (Catalyst), Composite, Chameleon, and signature combiners—are compared on cost but rarely on whether they actually enforce the classical↔PQC binding they promise. We show they often do not, and that the failure persists even in stacks that do check the binding. The same BouncyCastle library accepts a Catalyst certificate carrying a forged ML-DSA signature on its default path yet rejects it via an opt-in call; and wolfSSL, the only stack that checks a present alternative signature by default, cannot require one, so a stripped certificate is silently accepted (a path whose experimental build also shipped CVE-2026-5393). That no stack can mandate the binding is the surprise; that an ignored non-critical extension is skipped by nine verifiers is the expected X.509 baseline, which we reproduce with an independent non-BouncyCastle generator. Composite, by contrast, binds structurally (three verifiers across three OID families reject corruption of either half). Folding this measured enforcement axis into a four-axis cost model (strategy sizes differ by under 4.4%) overturns the cost-led recommendation: once enforcement is priced in, the compatibility winner Catalyst is displaced by a structurally-bound encoding—a combiner where the operator controls both endpoints, or Composite once a like-for-like P-256 pairing ships. A compatibility-led ranking can thus recommend a strategy whose PQC protection no deployed verifier enforces.

HCTR2 is a wide-block encryption mode that encrypts one fixed-size message as a single unit, so that flipping a single plaintext bit re-randomizes the whole ciphertext. Its main use is disk encryption, where the message is a disk sector. We instantiate it with ARIA, the Korean national block-cipher standard, and implement it on an NVIDIA RTX 4080 GPU. With many independent messages, assigning one thread per message keeps the device occupied. At low queue depth, however, most of the GPU sits idle, and encrypting one 16 KiB message is several times slower than a single CPU core. The reason is that one HCTR2 message is internally sequential, so it cannot simply be split across threads.

We present a fine-grained kernel in which one 32-thread warp cooperates on a single message. The kernel exploits the linearity of POLYVAL. It splits the long hash computation into contiguous per-thread pieces, has each thread compute a partial result, and combines the partials with warp shuffles to obtain exactly the same value as the sequential computation. This brings the latency of one message down to parity with a single CPU core (ARIA-256: 222 μs on the GPU vs. 209 μs on the CPU). Moreover, the number of threads per message and of messages per block acts as a knob that trades latency for throughput, spanning 222 μs/30 GB/s to 1774 μs/49 GB/s. With as few as four messages in flight the GPU already beats the CPU. We validate correctness for all three key sizes.

Primitive-only PQC benchmarks are insufficient for attributing composed hybrid costs on Cortex-M4 because shared hash backends, randomized-signature behavior, and fixed classical/wrapper work affect measured performance. We implement a common bare-metal Cortex-M4 harness for representative KpqC/NIST families, measuring uniform Hash-CT hybrid KEM benchmark rows with X25519 and Bindel et al. hybrid-signature AND-combiner rows. The goal is composed-cost attribution under a uniform benchmark transcript rather than primitive-only ranking.

Our measurements show three attribution effects. First, replacing only Keccak-f[1600] changes SHAKE-heavy signing by up to 2.16×, while SPHINCS⁺-SHA2 and FN-DSA control rows remain at 1.00×. Second, median-only signature tables can change deployment conclusions. In the nominal level-5 signing rows, HAETAE5 beats FN-DSA-1024 by median and mean latency, but its observed maximum reaches 4.53× its median while FN-DSA-1024 remains essentially flat. Third, a local SMAUG-T backend improves standalone SMAUG-T by 1.79–1.82×, but the visible gain drops to 1.42–1.65× inside SMAUG-T+X25519 hybrids. Supporting KEM rows place lattice hybrids at 3.7–8.8 M cycles and HQC hybrids at 19.6–74.5 M cycles. Together, the results motivate reporting composed-cost attribution, backend provenance, and variance alongside primitive timings.

This paper proposes an optimized GPU implementation of the ARIA-GCM authenticated-encryption pipeline (CTR keystream, GHASH authentication, and their AEAD composition): ARIA-CTR uses a packed 32-bit S-box staged in shared memory, GHASH is optimized separately with a fixed-key 4-bit Shoup lookup table, the two stages are integrated as both a two-kernel and a fused single-kernel AEAD, and the same aria_gcm.cu source is tuned for Ampere and Pascal through compile-time parameters. For ARIA-CTR, the four distinct S-box tables are merged into one 1 KiB shared-memory table (R=1 staging) and each thread encrypts CTR_IPT counter blocks in parallel to fill the ALU-bound diffusion layer. For GHASH, each thread owns one segment of sblk blocks, applies W-way Horner interleaving with precomputed powers of H, and keeps the reduction table in shared memory. Experiments on an RTX 3090 and a GTX 1080 Ti show that packed S-box staging improves naive ARIA-CTR by 14.5×, the Shoup LUT improves bit-serial GHASH by 21.5×, and the tuned pipeline reaches 924 Gb/s (CTR), 2,865 Gb/s (GHASH), and 622 Gb/s (fused AEAD) on the RTX 3090. Using a simple sequential-composition model, we show that the GHASH optimization is what shifts the AEAD bottleneck onto ARIA-CTR: without it the pipeline would be GHASH-bound near 120 Gb/s, whereas the tuned GHASH makes CTR account for about three quarters of the per-byte cost. We back the analysis with Nsight Compute measurements of register usage, achieved occupancy, shared-memory bank conflicts, and DRAM traffic.

We present a quantum resource estimation of the Rijndael variants \[ N_b = N_k \in \{4,5,6,7,8\}, \qquad N_r = N_b + 6, \] under the NIST MAXDEPTH quantum cost model. Extending the AES quantum encryption oracle~\cite{ref5} parametrically to arbitrary $N_b = N_k$, we generalize the in-place key schedule, including the single- and double-\texttt{SubWord} cases, the \texttt{ShiftRows} offsets, and the round constants. We implement and verify the resulting oracles using ProjectQ. The verified variants range from 1,624 qubits at a full depth of 1,090 for Rijndael-128/128 to 3,240 qubits at a full depth of 1,839 for Rijndael-256/256. Under the NIST PQC MAXDEPTH bounds $\{2^{40}, 2^{64}, 2^{96}\}$, the Grover key-recovery qubit cost in $\log_2$ units ranges from $\{80.15, 32.15, 10.67\}$ for Rijndael-128/128 to $\{210.65, 162.65, 98.65\}$ for Rijndael-256/256. The standardized analogues at Categories 1, 3, and 5, namely Rijndael-128/128, Rijndael-192/192, and Rijndael-256/256, meet the corresponding AES-based bounds. The intermediate Rijndael-160/160 and Rijndael-224/224 variants provide reference points between the standardized AES key lengths.

Information set decoding (ISD) is the standard generic decoding attack considered for code-based cryptography. A concrete quantum-resource estimate for Grover-accelerated ISD requires an oracle whose dominant component is Gauss–Jordan elimination.

We improve the elimination circuit of Perriello et al. [25] and Jang et al. [15] by not updating the entries that no later pivot or the final weight predicate reads. The required result vector is recovered by a parallel back-substitution on the syndrome register. For the target schemes, our elimination circuit improves the qubit count by about 22% compared to [15]. The Toffoli count improves by about 20% compared to both [25] and [15]. The Toffoli depth improves by about 67% compared to [25] but degrades by about 0.3% compared to [15].

We report logical resource estimates for the quantum ISD attack on HQC and Classic McEliece. The product of the total gate count and the full depth exceeds the NIST post-quantum security thresholds, and the full depth exceeds the MAXDEPTH upper bound.

We also provide fault-tolerant estimates of the physical qubit count and the runtime under a surface-code model with magic-state distillation. As one example, HQC-128 requires about $2^{43}$ physical qubits and about $2^{53}$ years at a 1 μs code cycle.

This paper presents a memory-efficient and high-speed implementation of NTRU+, one of the key encapsulation mechanisms (KEMs) selected by Korea’s post-quantum cryptography project (KpqC), on the ARM Cortex-M4. NTRU+ is small enough to run on its own on a Cortex-M4 class microcontroller, yet in real embedded environments, the peak stack occupied by polynomial buffers and the running time dominated by the NTT become key constraints. To address this, in the proposed technique, we reduce memory by analyzing when each polynomial buffer is actually live and restructuring the algorithm so that only a single buffer is resident during computation, and we significantly improve speed by rewriting the NTT for the mixed-radix structure of NTRU+ in Cortex-M4 assembly. By doing so, the assembly NTT acceleration compensates for the recomputation overhead introduced by the memory optimization, so that the combined implementation is both smaller and faster than the reference. Experimental results show that, relative to the KpqClean_ver2[1] reference implementation, the proposed technique reduces the peak stack by 83–84% while improving the speed of all three operations by up to 1.8×.

FAEST is a symmetric-key post-quantum digital signature scheme and a third-round candidate in the NIST Additional Digital Signatures standardization process. Its signing path concentrates cost in two operations: round-wise constraint generation, which proves in zero knowledge that the AES circuit is computed correctly, and finite-field multiplication, which computes the leaf nodes of a vector commitment. This paper accelerates both operations on a CUDA-enabled GPU, with AES round constraint generation as the main contribution. Specifically, we fuse the three consecutive stages that make up constraint generation into a fused GPU path and keep the intermediate results between stages resident in device memory, thereby reducing host–device data transfer. As a supporting measure, we batch independent finite-field multiplications for leaf nodes, jointly improving end-to-end signing performance. We verify the correctness of the implementation through byte-level output agreement with the CPU reference implementation. Combining fused constraint generation with batched leaf hashing, the full GPU path achieves up to roughly a 3× end-to-end signing speedup over the CPU reference. Furthermore, when AES constraint generation fusion is added on top of leaf hashing that is already performed on the GPU, an additional reduction in signing latency is observed in five of the six evaluated AES s/f variants. The magnitude of this effect does not scale monotonically with the security parameter; rather, it is determined by the per-variant bottleneck structure.

We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under LWE) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.

Dynamic universal accumulators provide succinct set commitments for evolving datasets, but balancing efficiency and scalability remains challenging. In particular, Bilinear Pairing (BP) accumulators offer constant size witnesses, but their public parameters size and dynamic operation costs grow linearly with the global capacity of the set. To address this bottleneck, we propose a trapdoorless hierarchical accumulator (HACC) that keeps BP-style efficient witness update and verification while avoiding this linear dependence. For a set of current size $n$ and a pre-defined parameter $t$ ($t \ll n$), HACC requires only $\mathcal{O}(t)$ public parameters, while supporting addition, deletion, and witness generation in $\mathcal{O}(t\log_t n)$ time, which is far more efficient than the $\mathcal{O}(n)$ costs of BP accumulators (Nguyen, CT-RSA'05, Damg\r{a}rd et al., eprint'08, and Srinivasan et al., CCS'22); moreover, HACC has $\mathcal{O}(\log_t n)$ sized witnesses with amortized $\mathcal{O}(1)$ witness updates. We further integrate polynomial multiproofs to reduce witness verification to constant pairing complexity in read-heavy epoch-based settings. We prove correctness and soundness of HACC under the $t$-SDH assumption in the random oracle model. Experimental results show that under comparable parameter budgets, HACC is $9.7\times$ -- $1803.4\times$ faster than BP accumulators for element update and witness generation, and consumes $34.6\times$ -- $3679.4\times$ smaller public parameters size.

The Lattice Isomorphism Problem asks whether two given lattices $\mathcal L_1$ and $\mathcal L_2$ are related by an orthogonal linear transformation. Haviv and Regev gave a seminal $n^{O(n)}$-time algorithm for this problem based on an isolation lemma (SODA 2014).

We give algorithms for the decision, search, and all-isomorphisms versions of the problem running in time $n^{n+o(n)}$ times a polynomial in the input size. The main new ingredient is a Gaussian heat argument over convex bodies generated by shortest vectors: for $w\sim D_{\mathcal L^*,s}$, the vector $w$ canonically determines $n-o(n)$ independent shortest vectors, leaving a residual instance of rank $o(n)$. The remaining residual dimensions are handled by an $n^{o(n)}$-time canonicalizer obtained by adapting the Haviv-Regev algorithm. We then combine this canonicalizer with a birthday argument to recover all isomorphisms.

For the all-isomorphisms version, this bound is asymptotically optimal in the worst case up to an $n^{o(n)}$ factor. As an extension, we also give, in the QRAM model, a quantum variant running in time $n^{\frac{2}{3}n+o(n)}$. It outputs a representative isomorphism together with generators for the automorphism group, thereby providing a compact description of the entire isomorphism coset.

Password-authenticated key exchange (PAKE) remains central to WPA3-Personal, the personal mode of the latest Wi-Fi security standard, where the Simultaneous Authentication of Equals (SAE) protocol enables secure Wi-Fi access via a low-entropy password. However, SAE’s symmetric password authentication makes all associated stations (STAs) vulnerable once the network-edge access point (AP) is compromised. Although SAE+ (IEEE TIFS 2024) addresses this issue in the client–server model with verifier-based asymmetric authentication, its weak binding of the password-derived verifier, ephemeral randomness, and protocol transcripts still enables key-compromise impersonation (KCI) attacks and offline dictionary attacks. Therefore, designing a verifier-based asymmetric SAE protocol that preserves the SAE workflow while resisting these attacks remains challenging. To address this challenge, we propose AsymSAE, a verifier-based asymmetric SAE protocol tailored for personal Wi-Fi networks. Following the SAE workflow in IEEE Std 802.11-2024, AsymSAE realizes asymmetric authentication by allowing the STA and AP to use the user password and the password-derived verifier, respectively. We further formulate a verifier-based security model to capture the asymmetric structure, and prove the security of AsymSAE in this model. Heuristic security analysis and ProVerif verification demonstrate that AsymSAE provides forward secrecy, transcript-based offline dictionary attack resistance, AP-side KCI resistance, session-key confidentiality, and mutual authentication. Our performance evaluation, including ns-3-based network simulation, demonstrates that AsymSAE can achieve significant verifier-based security enhancement without incurring extra communication overhead, while introducing minimal additional computational overhead and authentication latency.

Event date: 23 September to 25 September 2026

The Department of Applied Mathematics at the Naval Postgraduate School invites applications for multiple tenure-track openings in all areas of computational applied and discrete mathematics. These openings are at the level of Assistant Professor (AD-03); however, exceptional candidates may be considered for appointments at the levels of Associate Professor (AD-05) or Professor (AD-07). For further details, including instructions on how to apply, please see the official advertisement at https://main.hercjobs.org/jobs/22392507. Review of applications will begin immediately and will continue until the positions are filled. Applicants submitting materials by August 1, 2026 will receive full consideration.

Closing date for applications:

Contact: Prof. Anthony P. Austin Department of Applied Mathematics Naval Postgraduate School Monterey, CA 93943-5121 (831) 656-3629

More information: https://main.hercjobs.org/jobs/22392507.

Our group has an available position, which can be filled either at the PhD or postdoctoral level, depending on the applicant’s qualifications, research experience, and fit with the group.

Recent research topics in our group include tight security, secure messaging, key exchange, public-key encryption, and digital signatures. We are also open to considering new topics in provable security. Prior knowledge of formal security definitions and reduction-based proofs is therefore desirable.

We expect candidates to have very good proficiency in English. Knowledge of German is beneficial, since the position includes teaching obligations.

We are looking for a highly motivated candidate with a Master’s degree, or equivalent qualification, in Computer Science, Mathematics, or a closely related field. Candidates who expect to complete their Master’s or PhD degree in 2026 are also encouraged to apply.

To express your interest, please send the following documents to me by email by 14 August 2026:

• A motivation letter that describes your research interests and why you would like to work with our group, at most 2 pages
• A curriculum vitae
• Academic transcripts and certificates
• Contact details of 2 academic referees, at least one of whom should be your thesis supervisor
• For postdoctoral applicants: a list of publications.

Closing date for applications:

Contact: Jiaxin Pan

More information: https://sites.google.com/view/jiaxinpan/open-positions

Who is talking to whom? Consider a group of users who wish to communicate anonymously via a network of intermediate relays. We study anonymous communication under two standard strong adversarial models. A passive adversary observes all network traffic and additionally views the internal states of a constant fraction of corrupted relays, while an active adversary may also control the behavior of these corrupted relays. The goal of an anonymous communication protocol is to ensure that the adversary cannot distinguish who is communicating with whom.

One of the most practical and widely adopted approaches is onion routing, where messages are first wrapped in layers of encryption and anonymity emerges through repeated "shuffling" of onions at honest relays that peel a layer and randomly permute outgoing onions. In general, this approach may not achieve anonymity. The challenge is to rigorously quantify conditions for efficiently achieving anonymity, where efficiency is measured as a function of the protocol's security parameter λ, which we assume, without loss of generality, is at least linear in the network size.

A well-known result from ICALP'18 shows that if each hop in a routing path is chosen uniformly at random from all relays, then onion routing achieves anonymity against a passive adversary whenever both the number of rounds and the server load grow faster than log λ. In this setting, anonymity arises from the fact that every onion is repeatedly shuffled with a uniformly random subset of other onions. However, this assumption requires a fully connected network.

We generalize this result to sparse networks. We show that when routing paths are selected by performing independent random walks on a sparse, constant-degree expander graph, onion routing still achieves anonymity with the same asymptotic efficiency parameters as in the complete-network setting. In particular, this matches the optimal round-complexity bound known for complete networks, despite the fact that onions only shuffle within their local neighborhoods at each round, and an adversary may extract information from observing transitions between neighboring nodes.

We further extend our results to active adversaries. In the sparse-expander setting, we construct, under different conditions, (1) a differentially private protocol that achieves (ε, negligible in λ)-differential privacy, and (2) an anonymous protocol. Both run efficiently in polylogarithmic rounds and incur polylogarithmic server load.