International Association
for Cryptologic Research

We are looking for a PhD student, focusing on provable security. You will be part of a multidisciplinary team developing practical cryptographic standards for the post-quantum era, with implementation security in mind from the outset. Your research will combine cryptographic design with formal security analysis, helping to bridge the gap between theoretical security and secure real-world implementations.

You will be supervised by K. Hövelmanns, co-supervised by A. Hülsing.

What you can expect from us:

• The opportunity to work at the intersection of post-quantum, provable security, and implementation security.
• Weekly supervision meetings to help you stay on track.
• Guidance on writing, presentation, and career development.
• Flexible working hours.
• A shared interest in producing high-quality research results.

What we expect from you:

• An interest in cryptographic design and formal security analysis.
• A master's degree in computer science, mathematics, or related subjects.
• A solid background in cryptography, algorithms, discrete mathematics, or a related area.
• Strong analytical and problem-solving skills demonstrated in previous projects. Motivation to lead the projects.
• Research experience in the related areas is a plus but not required.

What you will like about Eindhoven:

• Being part of an internationally recognized research environment with strong expertise in cryptography and cybersecurity.
• The energy of an international technology hub (“Brainport”), combined with the convenience of a compact, easy-to-cycle-around city.
• A large international community—fortunately also reflected in the city’s food scene.
• Living in one of the Netherlands’ leading design hubs, home to Dutch Design Week and a lively creative scene.

Application deadline: August 12th

Closing date for applications:

Contact: Please apply via https://www.tue.nl/en/working-at-tue/vacancy-overview/phd-in-post-quantum-cryptography

More information: https://www.tue.nl/en/working-at-tue/vacancy-overview/phd-in-post-quantum-cryptography

We make progress on the question of constructing explicit evaluation places for leakage-resilient Shamir's secret sharing, over composite order fields. Previously, Maji et al. (EUROCRYPT 2024) showed that random evaluation places yield Shamir's secret sharing over the composite order field $\mathbb{F}_{p^d}$ that is statistically secure against physical-bit leakage. Later, Nguyen (EUROCRYPT 2025) established a "dichotomy" that linear code-based secret-sharing scheme over the field $\mathbb{F}_{p^d}$ is either statistically secure or completely insecure against such leakage.

Building upon Nguyen's dichotomy, we present a partial derandomization of evaluation places, improving upon the Maji et al. result for a restricted regime of parameters. We replace the random choice of $n$ independent evaluation places by the iterates $x_j = \Phi^j(x_0)$ of a simple fixed rational function $\Phi$, where the initial point $x_0 \in \mathbb{F}_{p^d}^*$ is randomly chosen. The randomness in the evaluation places thus drops from $nd \log p$ bits to $d\log p$ bits. Our construction is valid for the regime $n = O(d/\log_p d)$, and any reconstruction threshold $k \ge 2$; in fact, the scheme attains perfect security (statistical distance exactly zero) against single-block leakage. Our technique is a partial fraction nondegeneracy argument that exploits the distinct poles of the rational iterates.

We present Mu-qt-PEGASIS, a mathematically precise con- ditional compiler for interactive aggregate signatures built from the qt-PEGASIS effective class-group action. Our central observation is that the torsor structure of the public-key space blocks the standard Schnorr- or BLS-style verification equations used in conventional aggregate sig- natures. We resolve this by separating verification into two layers: a proof-authentication layer that certifies public-key registration and round- robin key aggregation, and a transcript-consistency layer that verifies the final aggregate signature relative to an authenticated aggregate key. The resulting framework is formulated in the programmable random-oracle model. Public-key registration and linked aggregation are authenticated via Fiat–Shamir compilations of explicit public-coin Σ-protocols for the relations Rreg and Rlink . Under the hardness of the Group Action Inverse Problem (GAIP), together with the random-oracle assumptions for Hnizk and Hsig , we prove MU-EUF-CMA security against static corruptions. At the protocol level, for a fixed Fiat–Shamir repetition parameter t, the aggregate signature has size O(t) and is independent of the number of signers n, while the authenticated registration and aggregation transcript remain linear in n.

Boomerang cryptanalysis is inherently a four-point phenomenon, yet its recent geometric formulation relies on a 3-wise representation imposed by a quartet-sum-zero assumption. This simplification makes the transition matrices tractable, but it also removes boomerangs with unequal paired differences and prevents the framework from modeling impossible boomerang distinguishers.

We propose an exact 4-wise geometric framework for boomerang cryptanalysis that is a \emph{strict generalization} of the 3-wise framework: it recovers the 3-wise framework as the equal-difference $a=a',\,b=b'$ specialization, and at the same computational cost additionally covers the unequal-difference boomerangs and impossible boomerang distinguishers that the 3-wise representation cannot reach. By choosing bases adapted to the two value coordinates and two difference coordinates of a boomerang quartet, our framework removes the 3-wise assumption and gives a unified transition-matrix description for both impossible boomerang distinguishers and fixed-key boomerang probabilities.

The framework has two concrete applications. First, it yields a positive (satisfiability) model for searching for impossible boomerang distinguishers from the difference coordinates in the 4-wise representation. Using this model, we find new impossible boomerang distinguishers for \present, \ascon, \skinny, and \gift. Second, it computes fixed-key boomerang probabilities as sums of \emph{quasi-boomerang quartet characteristic} correlations. For the 13- and 17-round boomerang distinguishers of \skinny-64-128 and \skinny-64-192, respectively, the resulting probabilities match the experimental results and explain the gap left by the 3-wise framework through contributions from unequal-difference boomerangs.

Confidential virtual machines (CVMs) provide hardware-rooted attestation and isolation, protecting data in use from untrusted cloud infrastructure. However, current CVM attestation frameworks are limited to a two-party trust model between the cloud provider and the CVM owner, and primarily guarantee only the boot-time state. As CVMs increasingly host public-facing workloads (e.g., LLM inference APIs, web applications) that process end-user data, this creates a three-party trust mismatch among the cloud provider, the CVM owner, and end users. Once a workload is deployed, end-users lack cryptographic assurance of runtime integrity and must implicitly trust the CVM owner for any post-launch modifications. Furthermore, extending continuous runtime attestation to a large number of end users introduces severe scalability bottlenecks and is vulnerable to co-location-based attacks. Existing methods either enforce static post-launch lockdown or rely on CVM owner-maintained software logs that are not hardware-anchored.

We present Vordr, a framework that removes the CVM owners from the end-user's trust domain across the full CVM lifecycle while still allowing workload-level updates/installations with auditability. We introduce a novel architecture that establishes an exclusive administrative binding between a process-based TEE (Warden Enclave (WEN)) and the CVM. This binding strictly blocks the CVM owners (or cloud) from directly manipulating the CVM. Vordr continuously tracks runtime integrity via a hardware-rooted Linux IMA event log anchored to PCR 10, serving time-bounded, platform-unlinkable cached or audit-ready quotes for independent end-user auditing. We optimize the costly IMA-log extraction via a novel incremental attestation design leveraging the IMA log's append-only structure and the WEN's sealed state. We implement Vordr, validate it across several workloads, and show that it provides up to 60.8x speedup for runtime monitoring with huge communication reductions in steady-state incremental rounds compared to prior methods. Vordr delivers highly scalable and verifiable runtime attestation, providing substantially stronger guarantees for runtime integrity and platform unlinkability.

Searchable Symmetric Encryption (SSE) enables data owners to securely store encrypted data on untrusted cloud servers while retaining the ability to perform secure searches and retrieve relevant documents. However, standard SSE schemes expose search patterns (whether two queries are identical), and result patterns (which documents are returned), making them susceptible to leakage-abuse attacks that can infer sensitive information such as the queried keywords and/or document contents. While Oblivious RAM (ORAM) and Private Information Retrieval (PIR) can hide these patterns, their high computation and communication overhead often render them impractical for real-world search workloads. A more efficient alternative is to obfuscate search and result patterns using Differential Privacy (DP). Unfortunately, existing DP-based SSE schemes either provide insufficient query privacy protection, or still incur substantial performance overhead. In this paper, we propose FROST, a novel differentially private SSE scheme that efficiently obfuscates both search and result patterns, while providing strong resilience against all known statistical leakage-abuse attacks. The core component of FROST is our new rerandomized PIR (RePIR) scheme designed for private databases, which allows server-side rerandomization of encrypted PIR query responses. In FROST, we also introduce a novel method for applying DP noises to SSE for search result obfuscation using only simple arithmetic operations. An important property of FROST is that it requires only a single round of communication, with small user-side storage as an additional benefit. We fully implemented FROST and conducted extensive experiments over real-world datasets to rigorously assess its practical performance and resilience. Our experiments showed that FROST not only effectively mitigates pattern-leakage attacks while maintaining reasonable utility, but also achieves up to four orders of magnitude faster keyword search and three orders of magnitude lower bandwidth overhead than prior DP-based SSE schemes.

A Proof of Space, PoS, as introduced by Dziembowski et al. [CRYPTO'15], is a two-phase protocol that enables a Prover to convince an efficient Verifier that it has allocated a large amount of persistent memory to storing some information.

To our knowledge, all existing PoS protocols are only known to be secure in the random oracle model (or under ad hoc assumptions about cryptographic assumptions). We provide an elementary framework for constructing PoS from a combination of derandomization assumptions and cryptographic assumptions.

We provide a few simple instantiations of the framework. We show that non-trivial PoS follow from (a) $\mathsf{E}=\mathsf{DTIME[2^{O(n)}]}$ is hard for exponential-size nondeterministic circuits (an assumption introduced to show $\mathsf{AM}=\mathsf{NP}$), and (b) collision-resistant hash functions. We also show that PoS with nearly optimal parameters and interaction pattern follows from assumption (a) above and (c) SNARGs for $\mathsf{P}$.

The Sumcheck protocol is a cornerstone of modern proof systems, yet its prover remains a performance bottleneck. Even in the multilinear case, the repeated construction of round polynomials leads to significant overhead, limiting scalability in practice. We take a different approach: instead of modifying the protocol, we rethink the representation of multilinear polynomials. We show that any multilinear polynomial admits a simple and structured binary-tree circuit representation, where each node follows a clean recursive rule. This perspective is not merely conceptual; it directly translates into faster algorithms. Our circuit view unifies three core operations: evaluation, summation over the Boolean hypercube, and Sumcheck round generation within a single framework. Construction from the coefficient vector costs exactly nN field operations, and evaluation via bottom-up folding requires exactly N − 1 multiplications — optimal for this class of algorithms. A key structural property of the circuit is its regularity: fixed depth, local recurrences, and no data-dependent branching. This is not incidental — it is a direct consequence of the recursive decomposition, and it is precisely what makes the representation amenable to parallel execution and hardware acceleration. We implement our approach in Rust on the BN254 scalar field and benchmark it against ark-poly with parallelism enabled on both sides. At n = 20, our parallel evaluation kernel achieves a 3.4× speedup over ark-poly (14 ms vs 48 ms). The verifier completes in under 1 μs across all tested dimensions, yielding a prover-to-verifier ratio exceeding 105 at n = 20. Our results suggest that revisiting polynomial representations is a promising direction for accelerating fundamental primitives in proof systems.

Side-channel analysis (SCA) attacks rely on leakage from a target device. It is common to assume that linear operations implemented by XOR gates produce symmetric leakage and carry negligible side-channel information. In practice, leakage from XOR gates produces complex, non-independent, and time-varying asymmetric behavior.

The paper introduces Feature Estimation based Attacks (FEbA) -- a dedicated profiling attack that exploits these asymmetries. The attack is versatile; it was demonstrated to be successful against the sharing and refreshing phases in masking-based implementations by greatly narrowing the guessing key space, with no access to intermediate values.

Such attacks have implications for designs such as ASCON, GIBBON, and ACE, where XORs that utilize the key are vulnerable to attacks regardless of the inherent SCA protection levels used in them (e.g., sponge $rate$, the leak-free components for re-keying, and masking order $d$).

Experimental results indicate that the entropy of a $32$-bit key can be reduced below $1$ bit using (up to) $20,000$ traces from a standalone XOR without any access to intermediate values, or below $500$ traces with access to intermediate values.

Post-quantum cryptography (PQC) standardisation reached a pivotal milestone in August 2024 with the release of NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA), yet the vast majority of deployed public-key infrastructure continues to rely on RSA-2048 and Elliptic Curve Diffie-Hellman (ECDH), both vulnerable to Shor's algorithm on a cryptographically relevant quantum computer. The Harvest Now, Decrypt Later (HNDL) threat renders this risk operationally present: adversaries may archive ciphertext today for future decryption once a Cryptographically Relevant Quantum Computer (CRQC) becomes available.

This paper proposes the Crypto-Agility Readiness Score (CARS), a five-dimension weighted composite index for assessing PQC migration readiness in legacy systems across PKI, TLS, and HSM environments. CARS operationalises five dimensions -- Inventory Completeness, Algorithm Compliance, Architectural Decoupling, Toolchain Readiness, and Governance & Compliance Alignment -- with weights derived via a two-round Delphi process with 12 senior migration engineers.

In an empirical evaluation of 43 open-source cryptographic software repositories, mean CARS values were 24.9 +/- 9.5 (Legacy Crypto Libraries), 25.8 +/- 8.2 (PKI/Certificate Management), 39.7 +/- 15.2 (HSM/PKCS11 Middleware), 47.2 +/- 16.5 (TLS 1.3 Hybrid), and 47.5 +/- 11.1 (PQC Native; overall 34.1 +/- 15.0, n=43). A notable result is that PQC reference implementations score in the At-Risk range despite high Algorithm Compliance (d2 >= 0.61), because Architectural Decoupling (d3) is near zero, confirming that algorithmic presence alone does not imply organisational migration readiness.

Category differences are statistically significant (Kruskal-Wallis H(4) = 17.55, p = 0.0015, epsilon^2 = 0.357, large effect). Construct validity is supported by a moderate convergent Spearman correlation between Algorithm Compliance and Toolchain Readiness (rho = 0.558, p < 0.001, n = 43) and discriminant independence from Architectural Decoupling (rho = -0.031, p = 0.843). A longitudinal case study on oqs-provider (v0.3.0 to v0.6.0) demonstrates that CARS tracks real migration progress (Delta CARS = +21 pts). Microbenchmarks show ML-KEM-768 completes a full KEM cycle in 0.28 ms versus 2.87 ms for RSA-2048 (10.2x faster); authors' own measurements on Apple M1 Pro ARM64 (liboqs-python v0.15.0, n=10,000) confirm the ratio is preserved (M1 Pro: 0.051 ms full KEM cycle). A hybrid TLS 1.3 handshake (X25519MLKEM768) adds approximately 1.29 ms incremental overhead over ECDHE-only. CARS may support structured prioritisation of migration efforts; external predictive validation against migration outcomes remains future work.

SMAC is a recently proposed by Wang et al.~stand-alone Message Authentication Code (MAC) constructed from repeated applications of the AES round function and featuring an aggregation mode, SMAC-1$\times n$, for scalable parallel processing. Although originally designed for high-throughput CPU implementations leveraging AES-NI instructions, its structural properties suggest strong compatibility with hardware parallelism. However, no systematic FPGA-oriented architectural study of SMAC has been reported. This paper presents a scalable FPGA architecture of SMAC implemented on a Xilinx Kintex UltraScale+ KCU116 platform. The $\Pi$ transformation is evaluated in a single clock cycle using fully combinational AES rounds, and throughput scaling is achieved through physical replication of aggregation lanes. All SMAC-1$\times n$ configurations up to $n=16$ are implemented and evaluated. Post-implementation results achieve maximum operating frequencies up to 526\,MHz and peak throughput of 731\,Gbps for SMAC-1$\times 16$. The design exhibits near-linear throughput scaling up to eight lanes and reaches a maximum efficiency of 24.5\,Mbps/slice. These results demonstrate that SMAC’s round-based construction is well suited for FPGA parallelism and enables competitive high-throughput hardware MAC acceleration.

In lattice sieving, the sphere model assumes that sieving elements are distributed close to or on a sphere with uniformly distributed direction. It is extensively used to predict how lattice sieving behaves. In the sphere model the probability that a random pair of vectors reduces is asymptotically $p_n={(3/4)}^{n/2}/\sqrt{3\pi n/8}$. In practice sieving algorithms have been observed to perform better than predicted by the sphere model. It is an open question how this gap behaves asymptotically: does the gap vanish or grow as the dimension grows?

Our work answers this question by showing that it is asymptotically constant. We generalise the sphere model to uniform ball and non-uniform ball models and analyse reduction probability distributions. We find that asymptotically the input distribution only affects the total reduction probability, not the shape of the output length distribution. We show that the reduction probability advantages of our models over the sphere model range from $\times 1.5$ up to $\times 8$.

Distributed cryptography is a new cryptographic paradigm that enables fine-grained decryption capabilities in a trustless setting. In a distributed monotone-policy encryption scheme, users generate their own public and private keys. Thereafter, one can encrypt a message with respect to an arbitrary set of public keys together with an access policy. Any group of users that satisfies the access policy can recover the message; conversely, the message is computationally hidden from any group of users that does not satisfy the policy. The key requirement is succinctness: the size of the ciphertext should be sublinear in the size of the access policy. Distributed monotone-policy encryption generalizes related notions like distributed broadcast encryption (where the access policy is set membership) and silent threshold encryption (where the access policy is a threshold policy). In this work, we achieve the following:

- First, we give the first optimal distributed monotone-policy encryption scheme for the class of DNF policies from the decomposed LWE assumption in the random oracle model. Here, optimal means that the size of the public parameters, the user public keys, and the size of the ciphertext are independent of the size of the policy. As a corollary, we also obtain a (reusable) succinct computational secret sharing scheme for DNFs from decomposed LWE in the random oracle model.

- Next, we show how to adapt our techniques to obtain a distributed monotone-policy encryption scheme for $k$-DNFs in the plain model where the size of the ciphertext is $k \cdot L^{1/2}$, $k$ is the maximum size of each min-term, and $L$ is the number of min-terms in the DNF. This is the first scheme from the decomposed LWE assumption in the plain model. If we settle for a much weaker notion of selective security, then we also achieve full succinctness in the plain model (i.e., where the ciphertext size is independent of the size of the DNF).

- By specializing our results to the setting of broadcast encryption, we obtain an adaptively-secure distributed broadcast encryption scheme with ciphertext size $|S|^{2/3}$, where $|S|$ is the size of the broadcast set. Security relies on decomposed LWE (with a polynomial modulus-to-noise ratio) in the plain model. This scheme is the first lattice-based scheme with adaptive security that supports an a priori unbounded number of users in the plain model. Previous lattice-based distributed broadcast encryption schemes with adaptive security in the plain model assumed an a priori bound on the number of users (but achieved optimal-size ciphertexts that are independent of the size of the broadcast set).

We derive an explicit exponent \(\Psi_\rho\) that bounds the Reed--Solomon MCA bad-slope numerator at every fixed relative radius between Johnson and capacity. The resulting positive-relative-radius exponential-budget safe-frontier certificate strictly improves the smallest-test MDS exponent and gives a constant post-Johnson radius for every positive usable budget exponent. An all-test-size MDS circuit-incidence envelope gives exact large-field capacity plateaux, improved adjacent thresholds, and four explicit length-\(512\), \(2^{-128}\)-secure smooth multiplicative certificates beyond Johnson. An exact CA--MCA decomposition gives challenge-restricted, endpoint-exact linear-budget thresholds through asymptotically half the minimum distance, and monomial equivalence transfers the applicable bounds to circle presentations. A Gowers--cube argument proves primitive max-fiber flatness from an image-normalized Sidon payment at an accessible moment order. The unrestricted subexponential-budget smooth/circle frontier remains open because shortening has positive exponential cost and the analytic payment, residual ray compiler, profile add-back, and matching attacks are not yet available.

Fixed‑weight sampling is a core primitive in many post‑quantum schemes, including the HQC key encapsulation mechanism. An early implementation of fixed-weight vector sampling in HQC was shown by Guo et al. (CHES 2022) to suffer from a timing side-channel vulnerability, leading to complete key recovery. This timing side-channel was fixed in the current HQC version, however, power side-channel leakage is not addressed. In this work, we demonstrate that fixed-weight vector sampling in HQC is vulnerable to power side-channel attacks and present two practical attacks.

First, we construct a power-based distinguisher targeting the support-vector generation and employ the strategy developed by Guo et al. (CHES 2022) to recover the shared key. Our attack recovers the key with a 100% success rate using 900,000 distinguisher calls. On these grounds, we evaluate hiding countermeasures based on dummy operations and find that they linearly increase the trace requirement for a successful distinguishing attack by the number of dummy operations.

Second, we target a masked software implementation of the fixed-weight vector sampling in HQC and demonstrate a single‑trace attack on the support conversion that recovers the secret key, again with a success rate of 100%. We then discuss leakage attribution, specifically how shares are unintentionally recombined. Finally, we investigate how hiding techniques such as bitslicing, shuffling, and dummy operations can enhance the security of the implementation. In particular, the use of shuffling can lead to a complete prevention of our attack.

Our results show that fixed-weight vector sampling of HQC is highly susceptible to power side-channel analysis. In particular, our results highlight that a combination of masking and hiding is required to effectively protect the implementations.

EME is a parallelizable encrypt-mix-encrypt wide-block construction proved secure for m-block messages only in the range m <= n, where n is the block length of the underlying block cipher. Halevi and Rogaway justified this restriction by giving a splicing distinguisher for m >= n + 2, but left open the first excluded length, m = n + 1. We resolve that boundary for the direct, unrefreshed EME-core extension beyond its specified m <= n domain: the original formulas are applied to m = n + 1 blocks while continuing to use the same global mask. Under one fixed tweak, two encryption queries and one decryption query distinguish this extension from a random permutation. The result applies to this unrefreshed extension; refreshed variants such as EME* and IEEE EME2-AES are outside the scope of the distinguisher. The boundary attack is not a shortened form of the known zero-sum attack. At m = n + 1, the non-first coefficients have no nonempty zero-sum; instead, they form a basis and therefore uniquely represent the coefficient 1. Combining this representation with the special equation for the first mixed block gives the cancellation needed for a ciphertext splice. The same mechanism applies to Sarkar's EMME framework: when multiplication by the field element x is replaced by a linear operator psi with degree-n minimal polynomial, the minimal-polynomial relation supplies the corresponding operator identity. EME* and IEEE EME2-AES avoid this setting by refreshing the mask at chunk boundaries. The attack identifies the algebraic obstruction that such refresh steps avoid.

GRAFHEN is a group-based fully homomorphic encryption scheme in which public rewriting rules hide a permutation representation used for decryption. We give a framework for equivalent-key recovery for GRAFHEN instances based on symmetric groups, together with a practical attack that succeeds on every released challenge, including the recommended semidirect construction based on $S_{11}$ with five generators per copy. The recovered generators are determined only up to simultaneous conjugation, which is the natural isomorphism ambiguity of the public presentation. Known-zero ciphertexts transport the decryption subgroup under this conjugation, so the recovered representation suffices to decrypt the challenge ciphertexts. Our attack, HEnbane, first derives short consequences by two complementary procedures: bounded congruence closure and direct cancellation between public rules with a common right-hand side. The closure also supplies generator-order multiples. It then reconstructs one generator tuple by conflict-driven search over partial permutation tables and recovers the second tuple from the public mixed relations in semidirect instances. The reduction and reconstruction problems are parameterized by the permutation degree and generator count rather than by a particular challenge key. The experiments establish practical success for all released instances, while the analysis makes no distributional running-time claim for larger parameter choices in general. The attack shows that the published count of approximately $2^{101}$ equivalence classes is not an attack-cost estimate at the recommended parameters.

This short note discusses in detail a folklore but little-known hybrid hash function grounded on both the discrete logarithm and short integer solution problems. In particular, specific satisfactory parameters are provided to ensure the standard $128$-bit security level for the lattice problem with $256$-bit module, which may be useful in its own right. The hash function is a natural generalization of the classical Pedersen and Ajtai ones. Nevertheless, to the authors' knowledge, no one has previously explicitly analysed their hybrid version. Besides, the obtained result is probably prone to significant further optimizations by applying many tricks from elliptic curve and lattice cryptographies. Hashing is known to be a basic operation for constructing more complex and important hybrid cryptographic schemes. The authors intend to explore this in future articles. However, the hash function under consideration may be precious by itself due to its double provable security. Thus, this introductory work represents a kind of reincarnation of curve-based cryptography whose development has been severely and unfairly undermined by the potential but still vague quantum threat.

This paper proposes a high-speed hardware accelerator for QR-UOV, a multivariate scheme, that executes all three operations: key generation, signature generation, and signature verification. QR-UOV utilizes a quotient polynomial ring structure to reduce the public-key size of the original UOV scheme; however, this introduces functional requirements distinct from other multivariate schemes, such as polynomial-matrix operations over $\mathbb{F}_{q^\ell}$, coefficient expansion for the Mersenne prime field $\mathbb{F}_{q}$, and the expansion of symmetric matrices generated in a compressed form. To accelerate polynomial-matrix multiplication over $\mathbb{F}_{q^\ell}$, the proposed architecture employs a $D \times D$ systolic array ($D$ is the parallelization factor), in which each PE internally contains a polynomial multiply-accumulate unit. For signature verification, the architecture also incorporates a quadratic-form operation unit without explicitly storing the intermediate vector--matrix products. In addition, to ensure a regular data supply from key expansion to matrix operations, the architecture incorporates on-the-fly rejection sampling, which exploits the property that AES-CTR output blocks can be generated independently, as well as an expansion process for the symmetric matrices in compressed form. Furthermore, the architecture enables pipelined processing, overlapping the $i$-th polynomial-matrix operation with the $(i+1)$-th public-key expansion. FPGA evaluation shows that the proposed hardware executes key generation, signature generation, and signature verification in 0.74 ms, 0.28 ms, and 0.19 ms, respectively, at security level I. Furthermore, we confirm that the proposed hardware exhibits a lower LUT-time product than that of existing UOV hardware.

We provide the first construction of identity-based encryption from isogeny-based assumptions. Security of our construction relies on a novel assumption called the "CDH with Mismatched Torsion” (CD-HwMT) assumption, which we introduce. At a high level, the assumption posits the hardness of solving a CDH-like problem even when the adversary is given some additional “safe” leakage. We justify our assumption by showing that, in the Algebraic Isogeny Model, our assumption reduces to well-known assumptions from the literature.

As a bonus feature, our identity-based encryption enjoys anonymity, which means that the ciphertexts hide not only the message but also the target identity. We additionally obtain the first isogeny based constructions of laconic oblivious transfer, as well as public-key encryption that simultaneously satisfies security against high-rate key leakage and key-dependent message/circular security from the CDHwMT assumption. All our constructions can be conjectured to be post-quantum secure.

At the heart of our results lie several new techniques, which we believe will help in building even more advanced cryptography in isogeny-land.