International Association
for Cryptologic Research

Event date: 24 August to 26 August 2026
Submission deadline: 31 July 2026
Notification: 7 August 2026

Event date: 13 December to 15 December 2026
Submission deadline: 15 September 2026

Event date: to
Submission deadline: 30 November 2026

Event date: 12 November to 13 November 2026
Submission deadline: 7 September 2026
Notification: 5 October 2026

Classical deep learning for differential cryptanalysis requires millions of ciphertext pairs, rendering attacks infeasible or easily detectable. This work overcomes this data limitation by introducing quantum differential distinguishers, enabling a practical attacker model where executing few queries is feasible. We design these distinguishers via quantum machine learning based on variational quantum circuits. To address circuit design challenges, we propose QuantumScouter, a reinforcement learning method that discovers compact quantum circuits. Unlike prior work, QuantumScouter explicitly targets metrics like gate count and circuit depth, producing circuits suitable for noisy intermediate-scale quantum hardware. We apply QuantumScouter to the SPECK32/64 and SIMON32/64 ciphers. The models are trained to distinguish ciphertext pairs possessing a meaningful differential from completely random pairs. For SPECK, our approach achieves $0.80$ accuracy, outperforming the $0.53$ of prior work while reducing required qubits from $16$ to $6$. For SIMON, we establish a novel quantum baseline with $0.75$ accuracy. Notably, under a restricted regime of merely $400$ training samples, classical deep learning models struggle. A simple MLP with $361$ parameters fails to capture differential characteristics, resulting in an accuracy of $0.51$, while a deep ResNet with $64{,}737$ parameters overfits to yield an accuracy of $0.55$. In stark contrast, our data-efficient quantum distinguisher extracts meaningful features using only $49$ gates, maintaining $0.80$ accuracy.

We present Trout++, a complete threshold signing suite for ECDSA signatures. Trout++ descends from the recent Trout protocol (Dahari-Garbian, Nof, and Parker, ACM CCS 2025) and inherits its transparent setup, two-round structure, and strong security guarantees, while introducing several significant improvements.

Unlike Trout, Trout++ offers pre-signing, where the first round is key-, signing-set-, and message- independent. This property is not only important in its own right but also enables us to apply the ROAST transformation (Ruffing, Ronge, Jin, Schneider-Bensch, and Schröder, ACM CCS 2022) to our protocol, yielding the \textit{first} arbitrary-threshold (including with a dishonest majority), robust, asynchronous signing protocol for ECDSA signatures.

Furthermore, we introduce several optimizations to the building blocks in Trout that reduce both bandwidth and computation. Our benchmark results show that our implementation of Trout++ is approximately twice as fast \emph{and} twice as small compared to the prior implementation of Trout. We also present a constant-time implementation with running time that is \textit{ten times faster} than Trout's constant-time implementation.

Finally, we show how Trout++ can be composed with an account derivation scheme that does not require additional setups per derivation, enabling more practical solutions for managing key material.

In total, we achieve complexities and functionality comparable to, and closing the gap with, leading solutions for Schnorr signatures (such as FROST).

Batched identity-based encryption (batched IBE), introduced by Agarwal, Fernando, and Pinkas (CRYPTO 2025), enables a key authority to issue a single succinct key that decrypts an entire batch of ciphertexts. However, existing batched encryption protocols support only identity-based access control and do not accommodate expressive attribute-based policies. We are the first to introduce Batched Attribute-Based Encryption (B-ABE), a generalization of batched encryption to the attribute-based setting. In B-ABE, ciphertexts are associated with attribute sets and batch labels, while a single batch key is bound to an access policy and a public digest of the batch. The key decrypts exactly those ciphertexts in the batch whose attributes satisfy the policy, and its size is independent of the batch size. We construct B-ABE in asymmetric bilinear groups and prove security under the standard Decisional Bilinear Diffie-Hellman (DBDH) assumption in the random oracle model.

We further introduce the first Threshold Batched Attribute-Based Encryption (TB-ABE), in which the master secret is distributed among L authorities via Shamir secret sharing. Any subset of at least T authorities can non-interactively generate publicly verifiable key shares that aggregate into a succinct batch key of the same asymptotic size as in the single-authority setting. We formalize security against static corruptions of up to (T-1) authorities and adaptive key-share queries and prove security under the DBDH assumption in the random oracle model.

Lookup arguments are designed to prove that all elements in a query vector appear in a lookup table. These arguments are critical for efficiently proving ZK-unfriendly statements, such as range checks and the evaluation of complex functions. Most existing lookup arguments are optimized for scenarios where the query size is smaller than the table size. However, in many real-world applications, the query size $m$ is often much larger than $n$, the table size. This disparity leads to inefficiencies in such schemes.

To overcome this limitation, we propose Celer, a novel lookup argument in which the prover's runtime increases slowly with $m$, thereby providing improved scalability. The efficiency of our lookup PIOP stems from reducing the number of commitments to be sublinear in the query size $m$, while maintaining field operations linear in $m$. Experimental results demonstrate that our lookup scheme significantly outperforms state-of-the-art lookup schemes. For the workload of query size $m=2^{28}$ and table size $n=2^{16}$ (a real world case in proving Llama language model inference), our scheme achieves a 25.9$\times$ prover-time speedup over plookup and is 9.4$\times$ faster than LogUp.

We study Batched IBE through the lens of Multi-Message Signatures -- a natural extension of standard digital signatures in which a single signing operation signs an entire vector of messages at once. A public open algorithm then derives an opening for each message, allowing anyone to verify that an individual message was signed.

First we show that Multi-Message Signatures are essential by constructing a Multi-Message Signature scheme from every Batched IBE scheme with a sufficiently large plaintext space. We then show how to construct a Batched IBE scheme from a Multi-Message Signature with deterministic verification given an extractable witness encryption for the verification relation, similar to the duality between IBE and digital signatures. Such a witness encryption scheme can be instantiated efficiently for the special case of linearly-verifiable pairing based multi-message signatures.

Next we analyze existing constructions of Batched IBE and extract linearly-verifiable Multi-Message Signatures which provide us with valuable insight into the inner workings of various Batched IBE schemes. Leveraging these insights, we construct the first Batched IBE scheme supporting $q$ key queries per label with an $O(qB)$ CRS size and constant size ciphertexts.

In reaction to the emerging quantum threat, the National Institute of Standards and Technology (NIST) seeks post-quantum secure digital signature schemes. NIST's ongoing competition recently advanced to the third round, in which the Unbalanced Oil and Vinegar scheme (UOV) is a promising candidate due to UOV's conservative design, small signatures, and performant signing and verification. While these benefits make UOV attractive, the implementation aspects for compact hardware acceleration of UOV remain underexplored. Existing hardware accelerators optimize for performance and have large memory footprints. Yet, constrained devices require compact and low-memory hardware support. At the same time, lowering the memory consumption of UOV without sacrificing performance is challenging due to UOV's large public keys and intermediate results. In addition, low-end devices are prone to power side-channel attacks and benefit from lightweight countermeasures. In this work, we focus on the open challenges of compact UOV hardware acceleration. We design a low-memory UOV architecture with runtime-flexible support of NIST security levels 1 to 5. Our architecture uses a load-balanced 16-lane datapath supporting the critical matrix operations of UOV. In addition, we lower UOV's peak memory consumption using a slicing technique and enable on-the-fly data generation via streamlined data realignment. We also include a pipelined Gaussian Elimination unit and a streaming approach for the large public keys needed for signature verification. In addition to compact hardware acceleration, we defend against differential power analysis attacks through a lightweight blinding countermeasure relying on UOV's equivalent keys. Our blinding requires random non-singular matrices, which are not trivial to sample efficiently in hardware. We therefore assess existing sampling approaches and propose a novel technique based on the lower-upper decomposition of matrices. The resulting blinding solely re-uses existing datapath components and limits the runtime overhead to less than 30%. Compared to existing UOV accelerators, our efficient FPGA design reaches up to 5.1x lower signing and 3.2x lower verification latency, while reducing the memory consumption between 2.2x and 16x.

In this paper, we present an optimized implementation of Hamming Quasi-Cyclic (HQC) on the ARM Cortex-M4. We optimize (i) the polynomial multiplication and (ii) the support expansion in fixed-weight sampling, and (iii) propose an optional caching strategy that reuses the public transforms and hash recomputed under a fixed key. For the polynomial multiplication, the fixed-constant multiplications in the Frobenius additive FFT (FAFFT) butterfly spend nearly half of their instructions on VMOV data movements between general-purpose and floating-point registers rather than arithmetic. Because minimizing the XOR count alone can increase the total instruction count, we propose a dirty-aware register-allocation policy and an XOR-operation reordering that reduce the VMOV count by up to $48.1\%$ while leaving the XOR count unchanged. We apply these to a multiplication that combines prior FAFFT-CRT methods, and for HQC-1 we further find a $34\%$ sparser FAFFT modulus that lowers the CRT reconstruction cost. For fixed-weight sampling, we rewrite the support expansion with predicated execution and 4-way unrolling, lowering the per-word cost of its inner loop from $22$ to $6$ cycles while remaining constant-time. On the NUCLEO-L4R5ZI board, our implementation reduces key generation, encapsulation, and decapsulation by up to $33.1\%$, $34.6\%$, and $29.8\%$ over the faster of the two prior state-of-the-art implementations, and the optional caching yields a further reduction of up to $32.7\%$ and $18.9\%$ for encapsulation and decapsulation.

Identity-based key encapsulation remains attractive for managed systems, but practical post-quantum instantiations must balance compact ciphertexts, low decryption-failure rate (DFR), high-throughput and protection-friendly private-key extraction, and meaningful concrete security reductions. Existing NTRU-based IBE schemes satisfy these requirements only partially: compact DLP-style constructions lack a satisfactory reduction and have high failure rates, while LATTE's higher-rank structure and correctness treatment come with larger private keys, larger ciphertexts, and additional encapsulation/decapsulation work. These lines also use moduli and transform roots distinct from those of standardized PQC schemes, complicating deployment in implementations already built around standardized arithmetic.

We introduce `ANSA-IBKEM`, a practical single-level identity-based KEM that retains the compact DLP-style identity relation while redesigning the trapdoor, extraction, correctness, and implementation layers around standardized post-quantum arithmetic. The construction combines annular NTRU trapdoors, Hybrid-Sampling extraction, a BCH-based message layer, and ciphertext compression over the ML-DSA modulus $q=8380417$. At the selected compressed points $(d_u,d_v)=(21,4)$ and $(23,5)$, the resulting ciphertext sizes are $3200\,\mathrm{B}$ and $7168\,\mathrm{B}$, with BCH-tail DFR estimates below $2^{-164}$ and $2^{-248}$ after applying one-sided $95\%$ upper bounds to the measured nonzero-error rates.

We present a layered random-oracle-model security reduction for `ANSA-IBKEM` with an explicit concrete advantage bound and separate accounting for birthday-style collision terms. The proof accounts for the transform layer with explicit HHK-style losses in the identity-based setting, passes from exact extraction to ideal conditional extraction using Rényi divergence, and reduces to a programmed single-user encryption experiment connected to annular-NTRU/RLWE-style assumptions. This route separates transform losses, extraction-distribution losses, correctness terms, message-space terms, collision terms, and lattice-assumption terms, and it gives a proof template for DLP-style lattice IBKEMs. We also give a method for deep arithmetic reuse, with full low-level ML-DSA arithmetic reuse on the $N=1024$ line.

Dilithium, as a quantum-secure digital signature standard in FIPS 204, has received widespread attention for its physical implementation security. NIST selected Dilithium's randomized signing mode as the default, which can mitigate the severe physical attacks that exploit the deterministic signing mode. However, the physical attack resilience of randomized signing mode is currently an open question. In 2024, Krahmer et al. demonstrated a key-recovery attack against randomized Dilithium by exploiting fault injection. The skipping fault correction attack in Krahmer et al.'s work benefits from operational simplicity in practical settings. Nevertheless, it uses a full-rank collection strategy, requiring several effective faults equal to the number of key coefficients.

By developing an optimized skipping fault correction attack, we prove the non-necessity of the full-rank collection strategy. Theoretically, we derive the minimum number of faults M_min and a key-dependent trend for reliable key recovery. For the M_min, we obtain it by analyzing secret coefficient coverage and unique bounded solution probability under the random-row model. Lemma~1 guarantees high-probability coverage of all coefficient positions, while Lemmas~2--~4 and Theorem~1 prove sufficient uniqueness conditions. Furthermore, we instantiate M_min of Dilithium for security levels L2, L3, and L5 with a high key recovery probability. For the key-dependent trend, Remark~2 reveals that the secret key with a larger number of $\pm \eta$ in the coefficients (denoted as $\mathrm{abs_\eta}$) tends to be easier to recover, offering a feature-based insight into recovery efficiency. We formulate the key recovery of Dilithium as an MILP problem and propose an MILP model. Based on the MILP model, we design algorithms of adaptive skipping fault correction attacks for plain and shuffling settings to recover the key with fewer faults.

In our experiments, we explored factors influencing key recovery success, confirming theoretical predictions that success rates increase with more faults and larger $\mathrm{abs_\eta}$. Compared to Krahmer et al.'s work, our improved attack reduces the required number of faults for recovering the private key. Specifically, for the plain setting, fault reductions were 25.9% (L2), 16.2% (L3), and 25.6% (L5). Similarly, for the shuffling setting, reductions were 25.6% (L2), 13.5% (L3), and 26.3% (L5).

NTRU-based bootstrapping offers a high-performance variant of FHEW-like bootstrapping schemes and is simpler than its RLWE-based counterparts. Nevertheless, it remains costly in terms of both memory and time. A key computational bottleneck arises from the constraint $q\mid 2N$ which links the LWE ciphertext modulus $q$ to the NTRU dimension $N$. In this work, we apply extended techniques to remove the limitation $q \mid 2N$. With a large modulus $q$, we are able to complete the bootstrapping algorithms using a relatively small $N$-dimensional ring, thereby improving both time and memory efficiency. Additionally, we employ sorting-based techniques to eliminate unnecessary operations, which further enhances time performance. We also extend this approach to improve the efficiency of NTRU-based multi-key bootstrapping algorithms. We implement our algorithms using the CHIFHE and MKFHE libraries. At the 128-bit security level, our sorting-based techniques (with factor $\eta=16$ ) accelerate single-key bootstrapping by factors of $1.82\times$ and $1.24\times$ over the FINAL scheme (ASIACRYPT 2021) and the key unrolling method (CHES 2024), respectively. For multi-key bootstrapping (with factor $\eta=4$), we achieve a $1.70\times$ speedup over the prior art (ASIACRYPT 2024). In addition, both single-key and multi-key algorithms reduce memory usage by a factor of $\eta$.

The cost of quantum cryptanalysis is dominated by the quantum circuit of the target cipher. Estimating the quantum attack cost of a cipher thus requires building that circuit and measuring its qubit count, Toffoli count, and Toffoli depth. This is manual work that needs expert knowledge and must be redone for each cipher and each cost target. Large language models handle ordinary programming well, but their use in constructing quantum circuits for ciphers is still limited. In this work, we collect quantum circuit optimization techniques that apply across many ciphers. We write these techniques into a guideline for a general-purpose LLM. Given this guideline and a single target cipher, the model produces two circuits. One minimizes the qubit count, and the other minimizes the Toffoli depth. Each circuit is verified against the test vectors of the cipher before its resources are estimated. Using this approach, we implement quantum circuits of CRAFT, MANTIS, QARMA, mCrypton, EPCBC, and Pyjamask for which quantum circuit implementations have not previously been reported.

The server-aided Secure Multi-Party Computation (MPC) model with dynamic participation, where servers may join or leave during the computation is particularly well-suited for practical, long-running applications. Unfortunately, existing protocols supporting dynamic participation either incur communication costs that scale linearly with the circuit size or rely on the heavy hammer of Fully Homomorphic Encryption (FHE). This contrasts with “classic” MPC protocols, where sublinear communication can be achieved without FHE. Focusing on the Layered MPC framework (introduced by David, Ishai, Konring, Kushilevitz, and Narayanan, CRYPTO 2023), we show that this overhead is not inherent. We construct sublinear-communication Layered MPC protocols while maintaining a minimal number of online servers — only two or three per layer. Our constructions rely on a layered-friendly adaptation of Homomorphic Secret Sharing (HSS), which we formalize as HSS with Layered Resharing.

Oblivious transfer (OT) is a foundational tool in secure computation. Random OT-correlated pairs of the form $(r_0,r_1)$ and $(b,r_b)$, where $r_0,r_1,b \stackrel{{}_\$}{\leftarrow} \{0,1\}$, significantly speed up secure computation protocols. Pseudorandom correlation functions (PCFs), introduced by Boyle et al. (FOCS 2020), are an efficient means of non-interactively generating correlated pairs. In a PCF, two parties store short keys that are used to locally generate large amounts of correlated pairs. While pre-quantum PCFs for OT achieve highly compact key sizes (e.g., $30$ kB), a significant gap remains in the post-quantum regime, where existing solutions rely on lattices or learning-parity-with-noise-style assumptions and yield much larger keys. We construct compact post-quantum PCFs for OT. Our construction has key sizes in the range of $100$ kB, approaching the compactness of pre-quantum PCFs and seven times smaller than the most compact state-of-the-art post-quantum alternatives. The key size of our PCF remains invariant regardless of the target number of OTs, in contrast to prior alternatives. We estimate a throughput of $7$ OTs per second for our PCF. We additionally provide a security proof in the quantum random oracle model, constituting the first such analysis of a post-quantum PCF. The core of our construction is a new, compact constrained pseudorandom function (CPRF) for inner-product membership predicates. Its security is based on a natural extension of the parallelization problem, which we introduce as the parallelization problem with auxiliary inputs. We provide an extensive analysis of this assumption as well as an implementation of our construction.

Training machine learning models in untrusted clouds requires strong guarantees of confidentiality, integrity, and correctness, while remaining scalable and resilient to node churn. These challenges are further amplified in emerging agentic AI systems, where autonomous and distributed learning components require trustworthy coordination and secure state management across heterogeneous cloud environments. Existing Trusted Execution Environments (TEEs) lack scalability and remain vulnerable to side-channel attacks for large workloads, while pure secure multi-party computation (MPC) approaches incur prohibitive overhead in practice. SENTRA (Secure ENclave-based TRaining Architecture) addresses these challenges through a hybrid architecture that combines TEEs, secret sharing, and communication-efficient MPC with system level mechanisms that secure the entire training lifecycle. SENTRA introduces a scalable collective attestation protocol that verifies all participating enclaves and enforces hardware exclusivity before any node may store or process secret shares. Training data and model parameters are stored as secret shares in a versioned enclave-backed key–value store (KVS), providing rollback protection and consistent state under adversarial conditions. SENTRA further supports dynamic, fault tolerant membership through Dynamic Proactive Secret Sharing (DPSS)-based resharing, safe packed-MPC computation under degree bounds, and adaptive handling of node failures. Evaluation of a prototype implementation shows that SENTRA achieves up to 8.89 samples/s throughput and 1.29× faster training than the CrypTen baseline in software-only mode. In hardware-enclave mode, SENTRA incurs only an 8.3% performance overhead while providing memory-isolated confidentiality, fault-tolerant membership management, rollback protection, and recovery from node failures in approximately 8 seconds.

Retrieval-augmented generation (RAG) grounds large language models on external knowledge, but its retrieval stage creates privacy risks: user queries may reveal sensitive intents, while retrieval atabases may contain proprietary or confidential records. To address this challenge, we present CoSecRAG, an efficient two-server private retrieval protocol for RAG that protects database and query embeddings under additive secret sharing. CoSecRAG has two core techniques. First, Inner Product Preserving Query Mask (IPQ-Mask) uses one-time correlated masking to transform secure inner-product computation over secret-shared vectors into local linear computation with a public masked-query difference, eliminating online secure multiplications in score computation. Second, Post-Scoring Cluster Pruning (PSCP) reverses the conventional prune-before-score pipeline: it computes secret-shared scores before pruning and privately prunes candidates at the score level, avoiding secure extraction of high-dimensional document vectors and reducing the input size of secure top-\(K\) selection. We implement CoSecRAG and evaluate it on BEIR datasets and large-scale synthetic benchmarks. CoSecRAG preserves retrieval quality while reducing retrieval cost. Compared with the latest two-server private RAG retrieval baseline, it achieves up to \(202\times\) score-computation speedup, \(107\times\) secure top-\(K\) speedup, and \(123\times\) end-to-end online speedup, while reducing communication by up to \(43\times\).

Zero-knowledge (ZK) proof systems have developed rapidly in recent years, with hash functions as one of their central building blocks. Since these often dominate the prover cost, circuit-friendly hash function design has become an active research area. Most hash proposals target prime fields, although recent protocols such as Binius and VOLE-based ZK operate natively over binary extension fields \(\mathbb{F}_{2^n}\). These binary field protocols reduce the cost of proving widely used binary and bitwise statements, thereby opening up new design opportunities. At the same time, the demand for ZK applications such as zkRollups is pushing towards performant hardware acceleration, a requirement that recent designs have largely neglected. Hence, a modern ZK hash function should also be efficient in hardware and fast in plain evaluation, to avoid new bottlenecks in non-circuit workloads.

In this paper, we introduce RainHash2.0, a cryptographic permutation that addresses both gaps. RainHash2.0 is natively defined over binary extension fields, making it a natural match for \(\mathbb{F}_{2^n}\)-based protocols such as Binius and VOLEitH, while being tailored for efficient hardware and competitive plain performance. To achieve this, we exploit new techniques from Binius to horizontally split the round function - arguably a novelty in itself that is particularly effective when finite fields of different sizes are used simultaneously. We implement RainHash2.0 in the Binius and VOLE-based ZK frameworks, comparing it against SHAKE, recent arithmetization-oriented designs, and its direct predecessor RainHash. Across proof size, prover- and verifier runtime, RainHash2.0 delivers significant improvements. In addition, we prototype RainHash2.0 on FPGA hardware and reach efficiency gains of up to 8.8$\times$ over related circuit-friendly hash functions. These results mark RainHash2.0 a practical choice for modern ZK applications.