International Association
for Cryptologic Research

Range proofs enable a prover to convince a verifier that a committed value lies within a specific interval without revealing additional information. They are fundamental to privacy-preserving systems including anonymous credentials, e-voting, e-cash, and cryptocurrencies like Monero and Grin. A critical challenge is efficiently proving that multiple committed values simultaneously satisfy range constraints while minimizing communication overhead.

Vector commitment schemes provide a promising approach to this problem. Missileproof (CCS'24) recently proposed a range proof for vector commitments achieving $O(1)$ proof size and verifier time, but with prover complexity of $O(N\ell \log(N\ell))$ for proving $\ell$ values in $[0, 2^N)$.

We present \textbf{Rarus}, an efficient range proof for polynomial-based vector commitments that achieves optimal asymptotic complexity across all metrics. Our key innovation is replacing binary decomposition with optimized $b$-ary decomposition, coupled with Bi-variate Zero-Test and accelerated Uni-variate Sum-Check protocols. Rarus achieves $O(1)$ proof size and verifier time, while reducing prover time to $O\left(\frac{N\ell}{\log(N\ell)}\right)\mathbb{G} + O(N\ell)\mathbb{F}$, where $\mathbb{G}$ and $\mathbb{F}$ denote group and field operations respectively. In addition, our protocol supports arbitrary ranges $[0,R)$ beyond powers of two. Experimental results demonstrate that Rarus achieves a $20\times$ speedup over both Bulletproofs and Missileproof when proving 16,384 values in $[0, 2^{64})$.

The recent work of Hsieh, Lin and Luo [HLL23] (HLL23) provided the first construction of ABE for unbounded depth circuits from the circular evasive LWE assumption, which they introduced. Unfortunately, this assumption has been recently broken [AMYY25]. Finding a new construction for unbounded depth ABE from a safe assumption, without relying on compact functional encryption or obfuscation, is therefore an important open problem.

In this work, we provide a new candidate for ABE for circuits of unbounded depth as well as unbounded width from a novel, falsifiable ``doubly circular'' assumption which combines circular LWE with key dependent message security of a variant of ElGamal encryption in an inseparable manner. We show that the assumption holds in Shoup's bilinear generic group model, which rules out all non-generic attacks. In particular, this implies that our construction is secure assuming circular LWE in the bilinear generic group model, which has a long history of study. We also show that in a restricted setting, it is implied by the standard SXDH assumption and circular LWE.

Pairing-based multilinear polynomial commitments offer succinct verification for sum-check-based proof systems, but existing schemes trade prover group work against proof size and verifier cost. Building on Mercury's representation of a multilinear evaluation as the constant coefficient of a Laurent polynomial, we construct two schemes with different performance trade-offs. Vela uses inversion symmetry to derive a half-length auxiliary polynomial and opens two polynomials at $z$ and $z^{-1}$ with one univariate KZG proof. It has a $2G_1+4F$ proof, a two-term pairing check, and approximately $2N$ opening MSM scalars, at the cost of $O(N\log N)$ field operations. Carina applies the same constant-term reduction once in each coordinate and jointly proves evaluation claims for the committed bivariate polynomial and two auxiliary polynomials with one grid opening. For $N=2^{\mu}$ and $b=\sqrt{N}$, it has a $4G_1+8F$ proof, a three-term pairing check, $O(N)$ field operations, and exactly $N+2 b-6$ opening MSM scalars.

We prove completeness, commitment binding, and knowledge soundness in the algebraic group and random-oracle models under the standard bilinear $q$-DLOG assumption. Our curve-generic Rust implementation also provides common implementations of six pairing-based baselines. On BLS12-381 at $\mu=20$, \vela gives the smallest measured proof (232 bytes, 1.62x smaller than the next smallest) and the lowest measured verification time (2.09 ms). Carina's opening performance is in the same leading tier as the prover-oriented mKZG and CHOPIN implementations, while its 452-byte proof and 2.81 ms verifier improve on both. Compared with the verifier-oriented Mercury, Carina roughly halves opening time at the cost of a modest verifier slowdown.

Vote privacy and verifiability are two fundamental properties which must be maintained for elections. Studies in e-voting technology have demonstrated how elections may be secured through cryptographic techniques including mix-nets, homomorphic encryption, and Zero Knowledge Proofs (ZKPs). The implications and trade-offs that must be considered when designing an e-voting system using multiple cryptographic techniques for simple majority or plurality voting are well understood in the literature. However, it is less clear how these techniques affect the design process for complex e-voting systems such as those based on ranked voting. Examples include Borda count, Condorcet voting, Instant Runoff Voting (IRV), and Single Transferable Vote (STV). In this paper, we systematically analyse the cryptographic design of ranking-based e-voting systems in the literature and explore how the cryptographic techniques utilised by such systems affect the strength of their security guarantees including vote privacy and verifiability. In addition, we explore how their cryptographic designs impact social choice properties including support for various counting functions as well as flexibility in vote casting. Our findings demonstrate that ranked e-voting systems may be largely classified according to the degree of information leakage present in each solution, and that systems belonging to each of these categories share similar properties and usage of cryptographic techniques. We then discuss an overview of our findings and identify a number of open problems following our analysis. Overall, this paper serves as a comprehensive study on the state-of-the-art for secure ranked e-voting systems in the literature.

Private set intersection (PSI) and, more broadly, private set operations (PSO) are fundamental primitives for secure multiparty computation (SMC), enabling participants to jointly compute set relations while revealing no information beyond the prescribed output. As quantum technologies advance, PSI have correspondingly evolved toward quantum secure phase. Existing quantum PSI (QPSI) solutions are limited in their threat models and collusion behavior between third party (TP) and participants. In this work, we present a multi-party QPSI (MP-QPSI) protocol that integrates verifiable quantum fully homomorphic encryption (vQFHE) as the verifiable outsourced quantum-evaluation layer and threshold fully homomorphic encryption (TFHE) as the threshold key-management mechanism. We instantiate the intersection computation via a \(C^{\mathsf{AND}}\) circuit accompanied by simulations on IBM Quantum Platform. We analyze correctness and participant privacy against TP, external eavesdroppers, and collusive behaviors, and we further prove verifiability against a malicious TP under the semantic security model. Finally, we present a modular framework perspective with several realizations, show how to extend the construction to quantum private set union (QPSU) via open-controlled operations. Compared with prior schemes, our protocol provides flexible set operations and stronger resilience under the TP model, including TP-participant collusion, thereby offering enhanced security and broader applicability.

Internet voting can increase voter turnout and reduce operational costs; however, it also facilitates voter coercion. One compelling approach to address this issue is deniable vote updating, which allows voters to cast multiple ballots while counting only their final vote. Despite its intuitive appeal, achieving deniable vote updating together with verifiability and scalability has proven challenging. Therefore, we present FiltrumVote, a scalable, publicly verifiable, and coercion-resistant Internet voting system based on deniable vote updating. It has a quasi-linear cleansing phase, and it is built mainly from zero-knowledge proofs with standard $\Sigma-$protocol techniques. As a result, FiltrumVote is highly scalable: a standard computer takes less than 5 hours to prove all zero-knowledge proofs for one million votes.

Group key agreement protocols are essential for modern secure messaging. Most existing group key agreement protocols assume a centralized model with a semi-trusted service that mediates the communication. This is efficient, but problematic for some important applications, since a central service can be a choke point for surveillance and censorship. There is a nascent literature on decentralized group key agreement that avoids such reliance, but existing proposals either do not scale, with update costs linear or quadratic in the group size, or lack proofs of security. Centralized protocols can offer much lower (logarithmic) cost.

We present BeeKEM, the first decentralized group key agreement protocol with logarithmic update cost in the common case (degrading to linear in the worst case) and proofs of security. We provide an open-source implementation and demonstrate that it is competitive with OpenMLS. BeeKEM opens the door for a range of communication and collaboration applications offering not only end-to-end encryption, but also metadata privacy and censorship resistance.

Edge-AI Internet-of-Things (IoT) devices increasingly perform local neural-network inference in physically accessible environments. While prior physical attacks on neural networks mainly focus on model extraction, parameter recovery, or intermediate computation, the final decision stage remains insufficiently studied. This paper investigates the physical security of ArgMax-based decision logic, which converts output scores into the final class label in many edge-AI deployments. We show that a sequential ArgMax implementation can expose deterministic power-trace patterns associated with loop iterations and conditional maximum updates. These patterns can be used to recover decision-related timing information and guide voltage fault injection, enabling targeted redirection of the final inference result. We implement the attack on a real MCU-based edge-AI platform using an STM32F407VG device running an X-CUBE-AI-deployed convolutional neural network. Under dual-point voltage fault injection, the unprotected ArgMax achieves targeted redirection to all non-original classes in the MNIST case study. To mitigate this threat, we propose Shuffled-ArgMax, a lightweight software-level defense that combines randomized traversal, loop-integrity checking, and redundant decision verification. Experimental results show that, under the same attack setting, Shuffled-ArgMax reduces the targeted redirection success rate from 56.92% to 0%, demonstrating strong resilience against targeted misclassification attacks. Meanwhile, it introduces only a small end-to-end runtime overhead relative to the complete DNN inference.

Mutual correlated agreement (MCA) bounds how many points on an affine line of received words can agree with codewords on many coordinates when the line does not admit a common codeword explanation on those coordinates; the corresponding line parameters are called bad. MCA arises in the soundness analysis of code-based proof systems. For Reed-Solomon codes with arbitrary prescribed evaluation sets, existing deterministic bounds apply only at integer error budgets strictly below the exact Johnson boundary.

Fix integers $r\ge2$ and $h\ge1$. For every sufficiently large $K$, let $L\subseteq\mathbb{F}_q$ be any set of $n=rK$ distinct points and set $C=\operatorname{RS}_{
We also derive a MCA upper bound for maximum distance separable (MDS) codes from a sharp lower bound on the number of rejected local membership tests. For Reed-Solomon codes over sufficiently large fields, the resulting endpoint bound is exact whenever at most $K+1$ agreements are required. It yields exact $2^{-128}$ thresholds for four explicit smooth-domain codes of length $64$: we identify the largest safe integer budget and prove that the next one is unsafe.

As a concrete application to the Grand MCA Challenge, we exhibit a single prime field $\mathbb{F}_Q$, with $Q<2^{256}$, that supports the required smooth domains at all four target rates. With $K=2^{18}$, the first post-Johnson budget has MCA error below $2^{-128}$ at rates $1/2,1/4,1/8,$ and $1/16$, as does the second such budget at rate $1/8$.

This work contains an exposition of the seven foremost unsolved problems in the domain of isogeny-based cryptography, obtained by asking eleven experts in isogeny-based cryptography what they considered to be the most important unsolved problems in isogeny-based cryptography, and curated down to the seven problems in this document. For each problem, an expert wrote a short write-up giving the precise statements and descriptions per problem.

Verifying Groth16 proofs on Bitcoin enables a broad class of trust-minimised applications, bridges, light clients, validity rollups, but Bitcoin script lacks the pairing operations required to evaluate the verification equation natively. A recent line of work on Bitcoin-side garbled-circuit SNARK verification (Delbrag, BitVM3, BitVMX-GC, Glock, Argo MAC) has produced practical constructions but does not provide formal universal-composability analysis.

We present $\Pi_{\mathsf{DV\text{-}Groth16}}$, a protocol for designated evaluation of Groth16 proofs on Bitcoin. The prover holds a standard Groth16 proof $\pi_{\mathsf{in}}$ under a public, one-time ceremony SRS. The verifier generates, from a secret seed, a compact per-session trapdoor SRS for a fixed outer circuit, the inner Groth16 verifier, computed natively over a one-layer 2-chain (BLS12-377 inside BW6-761), and proves it well-formed. The prover produces an outer Groth16 proof that her inner proof verifies, and garbles a small circuit that checks the outer proof in scalar form: after the verifier reveals his seed, the prover signs the discrete logarithms of her pre-committed outer proof elements, and the circuit checks them against the commitments together with the scalarized verification identity, releasing a slashing key on failure. Cut-and-choose enforces garbling correctness; deposits and commitments are locked in Bitcoin UTXOs with a three-tier settlement (refund, slash-fast, slash-commit). The per-session SRS has fixed size, independent of the assertion circuit, and all elliptic-curve computation inside the garbled circuit reduces to three fixed-base scalar multiplications.

We prove that $\Pi_{\mathsf{DV\text{-}Groth16}}$ GUC-emulates an ideal functionality $\mathcal{F}_{\mathsf{DV\text{-}Groth16}}$ capturing the three-tier behaviour against static corruption in the GUC-hybrid model, with a concrete bound assembled from named primitive advantages. We make precise how designated evaluation and enforcement differs from designated-verifier deniability, and exhibit a variant achieving the latter at the cost of a per-proof SRS for the assertion circuit itself.

Generalized integral properties extend classical integral distinguishers, but their search is hindered by the size of the generalized function space. In this work, we study a structured and tractable subclass of generalized integral properties by restricting the generalized Boolean function to a separable form. This separable restriction decouples the plaintext side from the ciphertext side, thereby casting the search as the interplay between plaintext-side suppression of propagation sources and ciphertext-side cancellation of unknown monomials. On the plaintext side, we consider a structured space generated by linear combinations of basic plaintext structures; on the ciphertext side, we work in a degree-bounded Boolean candidate space. This yields an explicit and controllable search space while still capturing meaningful extensions of classical integral distinguishers.

Based on this formulation, we develop two matrix-based solving strategies that avoid exhaustive enumeration of the mapping space. The first is a unified MBM (Matrix--Bipartite graph--Matrix) framework, which reduces the joint search to a Boolean constraint system amenable to MILP. The second is a specialized solver for fixed plaintext structures, where the search for ciphertext-side low-degree mappings is reduced to a linear cancellation system and solved by Gaussian elimination. Experiments confirm the practical effectiveness of the proposed methods. For SPECK and SIMON, our search extends the number of rounds covered by mapping-based integral distinguishers. In particular, for SPECK, whose modular-addition structure makes integral modeling considerably more challenging, the proposed framework still yields improved distinguishers. For PRESNET, RECTANGLE, and SKINNY, our methods identify additional balanced integral properties beyond those captured by previous approaches. These results show that structured search provides a practical way to broaden the reach of automated integral analysis across different cipher families.

Public Key Encryption for Broadcast ($\mathsf{PKEBC}$) is a multi-recipient encryption primitive that guarantees decryption consistency across all designated recipients. Concretely, if a ciphertext $c$ is encrypted for Bob and Charlie, and Bob’s decryption yields a message $m$, then Charlie’s decryption of $c$ must also succeed and produce the same $m$. This property, though seemingly natural, is essential in secure group messaging, where consistent message delivery is often implicitly assumed. However, no efficient constructions of $\mathsf{PKEBC}$ currently exist: known approaches achieve consistency through Non-Interactive Zero-Knowledge ($\mathsf{NIZK}$) proofs of generic statements. Not only is the complexity of the $\mathsf{NIZK}$ statements already prohibitively expensive, but, in addition, it is not even clear if these can be turned into purely algebraic statements while retaining linear-sized ciphertexts. This is crucial to enable the use of efficient $\mathsf{NIZK}$ constructions. This paper presents new generic $\mathsf{PKEBC}$ constructions along with optimized instantiations of each. Concretely, we introduce $\mathsf{PKEBC}_{\mathsf{SM}}$ and $\mathsf{PKEBC}_{\mathsf{FO}[\mathsf{mPKE}]}$, and prove the security of these constructions in the standard and random oracle models, respectively. – $\mathsf{PKEBC}_{\mathsf{SM}}$ achieves consistency via $\mathsf{NIZK}$ proofs. Crucially, we hand-tuned the $\mathsf{NIZK}$ statements of our instantiation to ensure the $\mathsf{NIZK}$ is only used to prove very simple and carefully optimized purely algebraic statements. – $\mathsf{PKEBC}_{\mathsf{FO}[\mathsf{mPKE}]}$ achieves consistency via the Fujisaki-Okamoto ($\mathsf{FO}$) transform (CRYPTO 1999 and Journal of Cryptology 2013) applied to a Multi-Recipient Public Key Encryption scheme ($\mathsf{mPKE}$). Specifically, $\mathsf{NIZK}$'s ciphertext recomputation during decryption ensures ciphertexts are well-formed, eliminating the need for costly $\mathsf{NIZK}$ proofs. We then give two suitable $\mathsf{mPKE}$ instantiations: one based on Kurosawa’s $\mathsf{mPKE}$ (PKC 2002) and the other from Hash Proof Systems. For all our schemes and their instantiations, ciphertext sizes and encryption and decryption times grow linearly with the number of receivers. Our constructions therefore enable the first practical group messaging applications with consistency guarantees.

Digital contact tracing systems play a pivotal role in mitigating the spread of infectious diseases during pandemics by identifying individuals exposed to confirmed cases. In decentralized privacy-preserving contact tracing protocols, users broadcast pseudo-random IDs and, upon infection, upload the relevant IDs to a cloud server. Other users can then download these IDs to determine if they have been in proximity to infected individuals. However, existing protocols often lack verifiability, implicitly assuming honest user behavior when uploading data to the server. This gap creates vulnerabilities, including false positives and false negatives, which hinder the widespread adoption crucial for the effectiveness of contact tracing apps. This paper introduces SPiRiT, a secure and privacy-preserving verifiable contact tracing protocol, designed to address these shortcomings by introducing verifiability, ensuring the legitimacy of uploaded IDs, while still maintaining user privacy. Verifiability ensures whether an upload contains a valid set of pseudo-random IDs with respect to the contagious period of the infected individual, and that the individual claiming those IDs is the legitimate owner, in a privacy-preserving manner. The goal of our design is to maintain a balance between the competing objectives of privacy, security, and decentralization while fostering greater public trust and adoption by addressing the aforementioned vulnerabilities. Through rigorous evaluation using a face-to-face individual interaction dataset, we demonstrate that SPiRiT not only reduces false alarms but also can be on par with or even outperform existing protocols in detecting high-risk contacts.

With the widespread adoption of Field Programmable Gate Arrays (FPGAs) in security-critical industries such as defense and telecommunications, ensuring the confidentiality of sensitive data processed by these devices has become paramount. Side-Channel Analysis (SCA) poses a significant threat, necessitating the protection of cryptographic primitives through effective and efficient countermeasures. Within the framework of well-established formal adversary models, Boolean masking offers provable resistance to SCA by randomizing sensitive intermediate computations using Shamir’s secret sharing. However, the secure and efficient implementation of Boolean masking in hardware presents a complex and error-prone challenge. Physical effects such as glitches, transitions, and couplings can undermine essential security assumptions, potentially weakening the effectiveness of masking. Although robust masking schemes are designed to maintain their security in the presence of glitches and transitions, and their secure implementation can be verified at the gate level using a wide range of automated verification tools – albeit mostly for Application-Specific Integrated Circuits (ASICs) and not FPGAs – leakages caused by coupling effects remain undetectable by such tools, as they occur at a lower abstraction level. In this work, we focus on detecting (low-level) vulnerabilities in masked FPGA designs through experimental and tool-assisted evaluation. The flaws that we target are not detectable at the Register Transfer Level (RTL ) level, and in some cases, not even at the gate level, as they arise from optimizations introduced during synthesis or implementation, or from the specific outcomes of the Place and Route (PnR) process. We demonstrate that these flaws are not only theoretically concerning, but can lead to observable leakages in practical experiments. Furthermore, we show how to formally abstract, unveil, and mitigate such leakages, thereby enabling a security-aware FPGA design flow that spans from the behavioral to the physical level. As an example, we implement all the evaluation steps presented as an extension of PROLEAD and validate its accuracy and effectiveness through practical case studies.

Recently, Boyle, Jain, Servan-Schreiber, and Srinivasan (EUROCRYPT 2025) introduced the notion of simultaneous-message and succinct (SMS) secure computation. In an SMS protocol, after an initial sampling of a common reference string (CRS), two parties—Alice (with a large input) and Bob (with a small input)—can simultaneously exchange encodings of their private inputs and obtain additive shares of the output of a function evaluated over their inputs. The key requirement is succinctness: namely, the sizes of the CRS and each input encoding grow only polylogarithmically in the size of Alice's input and the function output. Boyle et al., and independently Abram, Malavolta, and Roy (STOC 2025), constructed SMS for all bounded-depth Boolean circuits from the plain learning with errors (LWE) assumption.

In this work, we extend the study of SMS along two new dimensions:

Reusable SMS: In this setting, the same input encodings can be reused to compute multiple functions.

Multiparty SMS: In the multiparty setting, we consider computations over one large input and multiple small inputs. Succinctness in this case means the size of the CRS and input encodings can grow with the total length of the small inputs (but polylogarithmically with the length of the long input and the size of the function output).

Assuming polynomial hardness of LWE (with a sub-exponential modulus-to-noise ratio), we construct reusable two-party SMS for all bounded-depth Boolean circuits with polylogarithmic communication. By additionally assuming indistinguishability obfuscation, we present a generic compiler from reusable two-party SMS to reusable multiparty SMS.

Our construction of reusable two-party SMS from LWE relies on a new "dual-use" technique where we reuse an LWE secret key between a lattice-based algebraic homomorphic MAC and a lattice-based homomorphic encryption scheme. This dual-use technique allows us to bootstrap a reusable SMS protocol for quadratic functions into one that supports arbitrary (bounded-depth) Boolean circuits. Along the way, we also show how to adapt a previous lattice-based algebraic homomorphic MAC based on ring LWE to obtain one based on the plain LWE assumption.

AESpolyW, proposed at IEEE S&P 2026, is a wide-block encryption mode designed to exploit instruction-level parallelism between AES and polynomial hashing. Although AESpolyW achieves high throughput and outperforms HCTR2 and EME on most tested platforms, we show that AESpolyW does not achieve strong tweakable-PRP security. Our attack requires only two encryption queries and one decryption query, and distinguishes AESpolyW from an ideal tweakable permutation with advantage close to one. We further show that this weakness directly compromises Encode-then-Encipher authenticated encryption (AE) instantiated with AESpolyW. For the appended-zero, prepended-zero, and inserted-zero variants, we construct fresh ciphertext forgeries that are accepted with probability one. The same attacks also yield chosen-ciphertext plaintext disclosure and complete IND-CCA breaks. These results are structural and do not rely on any weakness of AES, the polynomial hash, or PHASH.

The rise of quantum computing threatens widely deployed public-key cryptosystems, driving the adoption of post-quantum cryptography (PQC) algorithms that rely heavily on modular arithmetic. Existing hardware accelerators of the PQC algorithms for resource-constrained Internet-of-Things (IoT) devices remain limited and lack integrated fault detection mechanisms. In this work, we present CMALU, a Compact, fault-tolerant Modular Arithmetic Logic Unit supporting six operations on a single reconfigurable datapath, with a 2-bit input selecting Mode-0 (un-protected baseline), Mode-1 (on-the-fly parity and invariant checking with a formal single-bit detection guarantee), and Mode-2 (extending Mode-1 along with hardware-reuse recomputation for deterministic silent data corruption (SDC) elimination without datapath duplication). Under system-level fault injection into CMALU internal registers on an NTT accelerator and an Ibex RISC-V core running ML-KEM-512, Mode-1 achieves 100% single-bit and stuck-at detection at zero latency overhead, and Mode-2 achieves 0% SDC. The synthesis results after the post-place-and-route stage on a field-programmable gate array (FPGA) and application-specific integrated circuit (ASIC) implementations with the NTT accelerator targeting 65nm CMOS and the Ibex RISC-V integration targeting Nangate45 45nm confirm CMALU's suitability for resource-constrained IoT deployment.

LESS is a code-based signature scheme built on the linear equivalence problem and, in its v2.0 round-2 form, a candidate in the NIST call for additional post-quantum signatures. No microcontroller implementation of it has been reported: the official benchmarking effort for the additional signatures excluded it on memory grounds, and an x86-massif cross-check puts the reference's peak stack at up to $\approx 836$~KB---beyond the SRAM of even the largest mainstream Cortex-M4. This paper provides the first such implementation, to the best of our knowledge---a complete characterization of LESS (v2.0) on the Arm Cortex-M4 across all seven parameter sets. NIST did not advance LESS to the third round in May 2026; we develop the implementation techniques and the evaluation methodology to outlast that outcome.

We map the speed--memory design space with three operating points, all byte-identical to the NIST known-answer tests. The primary point is a \emph{balanced} configuration signing $4.1$--$4.3\times$ faster than the platform-normalized reference while using $41$--$59\%$ less peak stack. With double-pass signing at category~5, it is the only configuration whose signing we measured on target across all seven sets---at category~5, the resident-matrix configurations exceed the device's 640~KB of SRAM. It is flanked by a \emph{speed ceiling} at $4.5$--$4.7\times$ (at reference-level memory) and a \emph{memory floor} that signs with about a one-kilobyte measured stack at only $1.2$--$1.5\times$ reference time at category~1, with key generation on par with or below reference cost---so at category~1, memory minimization is nearly free.

The speedups rest on three increasingly platform-specific layers: algorithmic restructuring, intrinsic-free two-lane SWAR (SIMD-within-a-register) arithmetic for $\mathbb{F}_{127}$ with a lazy-reduction scheme, and hand-scheduled assembly kernels---including a rank-2 row-elimination kernel---together with a systematic audit of all kernels against the Cortex-M4 timing rules. Read against the reference's own profile, these results indicate that implementation maturity, not the scheme, accounts for a $>4\times$ swing in achievable microcontroller signing---a data point for standardization-time performance evaluation, offered without revisiting the decision.

We further report a catalog of negative results (techniques that help on desktop SIMD but hurt on the M4) and an alignment-safe transpose that returns $\approx 170$~KB of static memory to the stack under an \texttt{-O3} build. The evaluation methodology---Pareto-monotone adoption criteria, byte-identical correctness gates, and coverage and ablation reporting---transfers to the surviving third-round candidates, for which NIST has explicitly called for constrained-device evaluation.

The California Consumer Privacy Act (CCPA) grants consumers the right to request deletion of personal data held by registered data brokers. California’s 2023 Delete Act provides a new mechanism through which consumers can exercise this right by leveraging a centralized Delete Request and Opt-out Platform (DROP), enabling users to submit a single request that must be periodically processed by all registered data brokers. Since this platform aggregates sensitive user information, it is intentionally designed with safeguards against information leakage and unauthorized disclosure. This legislation, and the system it introduces, are positioned to serve as a template for wider deployment, with copy-cat legislation already introduced in many US states.

In this document, we evaluate the privacy architecture of the first-generation DROP system from a cryptographic perspective. The proposed design relies on hash-based record linkage---a widely used technique that offers heuristic rather than rigorous privacy guarantees. We begin by analyzing the inherent risks of this approach and identifying simple, lightweight modifications that can modestly improve its privacy guarantees by making it more difficult for malicious actors to exploit these vulnerabilities.

We then contrast this approach with Private Set Intersection (PSI), a class of provably secure cryptographic protocols that only reveal the intended matching records and nothing more. For future iterations of DROP, we propose a comprehensive PSI-based redesign, arguing that it would substantially reduce the risk of accidental information leakage while incurring only moderate additional computational overhead. Next, we highlight how DROP presents a compelling application for advanced variants of PSI with extended functionalities and stronger security guarantees, and we outline several research directions for the cryptography community, motivated by the unique requirements of such systems. Finally, we identify systemic risks that cannot be mitigated by PSI alone and discuss potential complementary approaches for addressing these broader challenges.

We hope this document serves as a common starting point for the cryptography and policy communities working to design future data deletion systems.