International Association
for Cryptologic Research

Over the last decades, symbolic (Dolev-Yao) methods for the analysis of security protocols have proven to be effective to analyze and establish strong guarantees for widely deployed protocols and systems, such as TLS 1.3, E-voting protocols, EMV, and MLS. On the one hand, analysis methods like Tamarin and ProVerif provide automation and support for user-defined equational theories. On the other hand, methods like DY* offer more flexible and modular reasoning, but hardcode threat models and do not support custom equational theories.

We present DyLean, a framework for the symbolic analysis of cryptographic protocols in the Lean theorem prover. Our framework comprises both a flexible general-purpose symbolic semantics, as well as a concrete proof methodology.

DyLean allows defining protocols and expected security properties; its semantics and equational theories can be customized by the user. Furthermore, the semantics are agnostic of the specific proof methodology: our goal is to provide a generic framework that can be used by the community as a foundation to develop various proof methodologies.

Moreover, we provide a concrete proof methodology inspired by DY*, based on trace invariants. Thus, DyLean inherits from the qualities of DY*: it is able to analyze protocols involving unbounded loops or datastructures, and is able to compose security proofs in a variety of scenarios. Our proof methodology improves on DY* by allowing for user-defined equational theories and threat models. We exercise DyLean on several focused case studies, which include protocols using merkle trees, ratcheting protocols, post-quantum protocols, and protocols analyzed under different equational theories, which demonstrates that DyLean can effectively analyze protocols with each of these features.

Proof-of-useful-work (PoUW) certifies computational hardness, not utility: a certified computation need not be anyone's demanded job. We separate three properties of a work receipt — work soundness ($\mathsf{W}$), job binding ($\mathsf{B}$), and demand exogeneity ($\mathsf{E}$) — and locate the gap at $\mathsf{E}$. Two results are unconditional. First, payments between coalition-controlled requesters and workers are recoverable transfers that contribute no Sybil-resistant cost, so no security lower bound may count them (Lemma 1). Second, under free pseudonyms and endogenous observation a coalition can simulate the receipts of economically independent requesters, so endogenous receipts cannot certify $\mathsf{E}$ (Theorem 1); we lower-bound the cost of evading a stated class of provenance estimators. Building on these, a robustness bound: because a permissionless mechanism must remain live on the zero-demand path, its leader-election floor cannot depend on the demand component of service receipts (Theorem 2), and any admissible receipt boost is quantitatively capped. Fork-independent salvage value of useful outputs can leave security neutral, negative, or positive depending on salvage asymmetry and demand, which we characterize in a stylized free-entry model. Constructively, an irrecoverable tax on every settled payment makes the burn — not proof of independence — the security resource. Deployed evidence comprises one reported audit (Pearl cuPOW) and a reward-program farming analogue; the election-side failure is, at present, a model prediction. Useful-computation receipts are appropriate instruments for payment, collateral, and loss allocation — and a bounded, priced election boost — but not the leader-election floor.

Hamming Quasi-Cyclic (HQC) is a code-based key encapsulation mechanism selected by NIST for standardization, making its resistance to implementation attacks critically important. We present a side-channel attack that exploits load/store leakage in the manipulation of HQC's sparse secret vectors. Analysing Cortex-M4 assembly generated from the reference implementation, we identify a leakage surface in which the low and high 32-bit halves of each 64-bit word leak with different strengths, due to compiler-generated register spilling. We exploit this leakage to construct a simple zero-word distinguisher classifying machine words of the secret vector as zero or nonzero from electromagnetic measurements. The recovered zero positions are then translated into decoding hints, reducing HQC key recovery to a shortened syndrome-decoding problem. We analyse the resulting decoding complexity for all HQC parameter sets: at 32-bit granularity an expected $88.7\%$ of the machine words of~$y$ are zero for HQC-1, cutting the decoding to ${\approx}\,2^{46}$ bit operations. Experiments on a Cortex-M4 validate the predicted low/high-half asymmetry---approximately $500$ traces for the stronger low-half channel and $5{,}000$ for the weaker high-half channel---and recover the zero words of an HQC-1 key at 32-bit granularity. Finally, we discuss practical countermeasures that eliminate the sparsity exploited by the attack.

We formalize the notion of polynomial commitment schemes (PCSs) in the proof assistant Isabelle/HOL and formally verify the security proofs of two variants of the widely popular Kate, Zaverucha, and Goldberg (KZG) construction. Moreover, we formalize the Algebraic Group Model (AGM) by Fuchsbauer, Kiltz, and Loss using a novel constraint-programming-inspired approach. We formalize a reusable abstract definition of polynomial commitment schemes and define games for correctness, binding, hiding, and knowledge soundness/extractability. Based on this, we verify all applicable security proofs for two concrete PCS constructions: the standard (DL-)KZG and a batched KZG, using our AGM formalization in the knowledge-soundness proofs. Our proofs follow Shoup’s sequence-of-games approach, with machine-checked transitions, and are carried out in the CryptHOL framework for formal verification of cryptography in Isabelle. To our knowledge, this work is the first formalization of polynomial commitment schemes, the first formalization of the AGM, and the first formal verification of the security proofs for any concrete polynomial commitment scheme. This work lays the foundation for the formal verification of advanced cryptographic constructions, such as pairing-based zero-knowledge proofs (ZKPs) and succinct arguments.

We study large-scale, field-agnostic, hash-based polynomial commitment schemes (PCSs) with the goal of minimizing prover time while preserving polylogarithmic proof size and verifier time. This setting is motivated by advanced applications of zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs) such as zero-knowledge machine learning (zkML), where committed polynomials may encode billions of parameters and large prime fields are desirable for avoiding wraparound in fixed-point arithmetic.

We introduce SwitchFold, a generic construction of a hash-based multilinear PCS from any sequence of linear codes with geometrically increasing block lengths. The polylogarithmic proof size and verifier time do not rely on any specific algebraic structure of the codes, while the linear prover time follows solely from the linear encoding time. At its core, SwitchFold recursively applies the code-switching technique (Ron-Zewi and Rothblum, JACM ’24), reducing each multilinear extension (MLE) claim under one code to a simpler MLE claim under a shorter code. The generator-matrix MLE claims produced by code switching are accumulated across repeated PCS openings using an accumulation scheme (Bünz et al., TCC ’20), and are then proved through a final recursion. We instantiate SwitchFold with the Brakedown code sequence (Golovnev et al., CRYPTO ’23), whose recursive code structure aligns naturally with our framework; we call the resulting scheme BrakeFold. In contrast to prior code-switching PCSs such as Blaze (Brehm et al., EUROCRYPT ’25) and BrakingBase (Nair et al., ASIACRYPT ’25), SwitchFold does not require an auxiliary foldable code. At the scale of one billion coefficients and 100-bit security, the marginal cost of each additional PCS opening in BrakeFold yields 3.5× smaller proof size and 20.6× faster verification than Brakedown, with only a 1.3× increase in prover time. Its succinctness matches that of BaseFold (Zeilberger et al., CRYPTO ’24), while reducing prover time by 17.0×.

As the usage of Artificial Intelligence (AI) for sensitive purposes increases, there is a growing need for privacy-aware explainable AI (XAI) tools. In this paper, we present a privacy-preserving counterfactual explanation algorithm. Our starting point is a decision-support model that is able to operate on vertically partitioned datasets, meaning that each party holds a different subset of datapoint attributes. The goal of a counterfactual algorithm is to find, given an observation, a datapoint from the (virtual) dataset that is closest to the observation but has a different label. Our algorithm fully preserves the privacy of the n datapoints belonging to the different parties by combining the strengths of homomorphic encryption and secret sharing. Through a number of experiments, we demonstrate the added value of combining multiple datasets in a realistic scenario and show that the privacy-preserving solution does not affect the accuracy. We fully implement our solution and demonstrate that it scales as to thousands of datapoints.

Recently, Shark (S\&P'25) considered the problem of actively two-party secure machine learning inference using an authenticated distributed comparison function (DCF). This is the state-of-the-art work in this setting. On the other hand, Grotto (CCS'23) built a variant DCF with the key size half that of classic DCF. Unfortunately, as Shark states, \textit{it is not known how to extend Grotto to the malicious setting}. In this paper, we present the first actively secure Grotto-style DCF scheme. Our authenticated DCF is deliberately designed on the correlated GGM tree and maintains the key-size advantage of semi-honest Grotto. We further implement an actively secure ML inference framework, named LightShark, which supports efficient primitives (e.g., ReLU, spline, and truncation) and ML models (e.g., VGG-16, GPT, BERT). Compared with Shark, our LightShark outperforms by $1.49 \times \sim 2.69\times$ and reduces communication costs by $66.7\%$ for Bert-base inference. Surprisingly, for larger LLM models, the experimental evaluation demonstrates that our framework works vastly well.

We prove that under a plausible heuristic assumption (on the smoothness of certain random integers), the supersingular isogeny problem can be solved in time and memory $p^{1/3 + o(1)}$. This improves upon the previous best complexity of $p^{1/2} \cdot(\log p)^{O(1)}$. This problem is arguably the central hard problem underlying isogeny-based cryptography, and the cost of its resolution is a major (and often the only) factor in the choice of secure parameters. The impact on concrete parameter sets remains to be clarified, as the asymptotic advantage of the new algorithm is mitigated by a superpolynomial overhead hiding in the $o(1)$ exponent, and by its high memory requirement.

Hybrid homomorphic encryption (HHE) lets a constrained client send compact symmetric ciphertexts while a server transciphers them into homomorphic ciphertexts, making HE-friendly ciphers such as PASTA a practical choice. Efficient and side-channel-secure execution of PASTA on embedded devices, however, remains challenging, since existing hardware relies on dedicated cipher cores and provides no side-channel protection. We present a hardware/software co-design of PASTA on RISQrypt, an existing post-quantum cryptography (PQC) platform, without adding any cipher-specific RTL. The affine layers, S-boxes, and SHAKE128 sampling are executed by the platform's arithmetic and Keccak accelerators under software control. We further integrate first-order arithmetic masking by reusing the masking accelerator for share refreshing and masked-multiplication randomness, requiring no additional hardware while keeping arithmetic on secret shares off the processor datapath. The masked multiplication shows no first-order leakage in a TVLA evaluation with $100\,000$ traces on an Artix-7 FPGA. Compared with a software-only baseline on the same core, the co-design achieves speed-ups of $9.68\times$ and $9.85\times$ in the unmasked and masked configurations, respectively. To the best of our knowledge, this is the first side-channel-protected, hardware-accelerated implementation of PASTA.

Confidential sources are vital for investigative journalism and thus for holding those in power to account. However, sources often face great risks to their privacy and safety. SecureDrop is a system that enables sources to anonymously contact journalists, including at major news organisations around the world. Despite its widespread use, the current design requires physical servers hosted on premises. While cloud-based deployment would alleviate this burdensome requirement and improve SecureDrop's usability and accessibility, it would also introduce new threats to security that are not addressed by the current design. In particular, a lack of end-to-end encryption presents serious risks in the event that a cloud service provider is coerced into revealing information.

In this work, we present and formally analyse a new protocol for SecureDrop which addresses the challenges of off-premises deployment. Our protocol composes an encryption scheme with hybrid post-quantum guarantees and an identity-hiding message-fetching mechanism to provide strong anonymity guarantees. In contrast to existing systems, we minimise incriminating evidence against whistleblowers by providing message-level deniability and by having sources remain stateless. Our formal security analysis combines the Tamarin prover for symbolic analysis and game-based proofs for computational analysis. Finally, our benchmarks demonstrate that the protocol achieves practical levels of performance in a browser context. The Freedom of the Press Foundation plans to deploy the new protocol, with integration efforts beginning in 2026.

Recent algorithmic advancements in the Multi-Party Computation-in-the-Head (MPCitH) paradigm have resulted in more efficient post-quantum digital signature schemes. MQOM is a MPCitH-based digital signature scheme and candidate in the ongoing NIST Post-Quantum Cryptography (PQC) standardization effort, offering performance competitive with lattice- and multivariate-based schemes in software. In this work, we develop a dedicated hardware accelerator for MQOM and analyze the impact of recent algorithmic modifications on hardware performance. This is achieved through the careful co-design of high-throughput symmetric primitive engines and highly-optimized polynomial arithmetic cores, minimizing stalling and supporting entirely on-the-fly computations of all polynomial arithmetic. As a result, no intermediate buffers are required and re-computation or sampling is avoided. Secondly, we analyze MQOM's use of correlated GGM trees for generating MPC party shares, which reduce computational cost at the cost of increased signature size. We observe that this choice leads to increased design flexibility and significantly reduces on-chip memory requirements for hardware designs. Furthermore, MQOM proposes several parameter sets per security level. We analyze the impact of different MQOM parameter sets on hardware cost and performance. Our design with NIST L1 parameters only requires 15 812/9 384 LUTs/FFs and 4.5 BRAMs on FPGA, while performing the signature generation in 0.46 ms and signature verification in 0.38 ms. Compared to state-of-the-art hardware implementations of other MPCitH-based DSAs, we improve the area-time-product (ATP) by a factor $3.5\times$ up to $66.4\times$. Compared to the lattice-based ML-DSA scheme, our MQOM hardware design is only outperformed by a factor $1.5\times$. Our results show that MQOM and the correlated GGM tree structure are hardware-friendly designs, leading to one of the highest HW-vs-SW speedup ratios among similar PQC DSAs, while also attaining the smallest on-chip memory footprint among high-performance hardware implementations.

Adaptor signatures allow a signer to publish a pre‑signature that can be transformed into a valid signature by anyone once a secret witness is learned. Poelstra first suggested this primitive to bypass the limited scripting capabilities of Bitcoin. These schemes were later formalized by Aumayr et al. (ASIACRYPT 2021) and refined by Dai et al. (INDOCRYPT 2022) and Gerhart et al. (EUROCRYPT 2024). In this work, we revisit the constructions of adaptor signatures deployed in practice without any formal proof of security.

First, we demonstrate that the current security model does not capture the ECDSA adaptor signature that underlies most real‑world systems. Second, we propose a relaxed definition and prove that it is satisfied by the ECDSA adaptor construction under the strong unforgeability of ECDSA. Finally, focusing on oracle‑based conditional payments, we formulate the first security model for adaptor‑based Discreet Log Contracts (DLCs) and show that our relaxed notion suffices for their security.

We give in this short note a circuit implementing the matrix-vector product with the 32x32 binary matrix of the AES MixColumns using 88 XOR gates. Previously known circuits minimizing this metric have been published in the past years and achieved 94 XOR, 92 XOR, 91 XOR, and 89 XOR. As far as we can tell, a circuit with 88 XOR was previously unknown.

In secret-key private information retrieval, a client with a short secret key retrieves a database item while hiding the requested index, and possibly also the database, from the server. The server answers using an encoded version of the database, generated via one-time preprocessing. Secret-key PIR provides an attractive "stateless" alternative to stateful PIR and oblivious RAM, and can be viewed as strengthening the standard notion of searchable symmetric encryption by not allowing any access pattern leakage.

We give the first candidate doubly-efficient secret-key PIR schemes that achieve a constant multiplicative storage overhead, asymptotically approaching 1 in natural regimes, together with $k^{o(1)}$ communication and online server work for a database of size $k$. The best previous online server work with constant storage overhead was $k/\textrm{polylog}(k)$.

Our constructions follow the permuted-code blueprint for doubly efficient sk-PIR (Boyle-Ishai-Pass-Wootters and Canetti-Holmgren-Richelson, TCC 2017), and are based on similar assumptions. The main novelty is that we instantiate this blueprint using new families of "$t$-smooth" locally decodable codes with improved tradeoffs between rate, locality, and smoothness. This includes a new $t$-smooth local decoder for Reed-Muller codes using concatenated curves, as well as a construction based on curve-lifted codes that has attractive concrete efficiency features.

We perform extensive cryptanalysis of the underlying assumptions and benchmark performance under realistic parameters, demonstrating the practicality of our schemes. A representative instantiation encodes a $37$ GB database of $18$-bit records with only $4.2$× storage overhead, while requiring the server to read less than $600$ KB from the encoded database per query.

As a companion to the proved bounds in "Shortening Bounds for Reed-Solomon MCA", we formulate the complete finite Reed-Solomon mutual correlated agreement (MCA) problem and a pole-aware conjectural positive-density profile envelope. An exact first-match compiler and realized-image moment and incidence inequalities isolate the payments required for a safe certificate without confusing supports, pairs, rays, and affine slopes. We prove a ceiling-normalized moment obstruction, a projective incidence theorem and benchmark dimension diagnostic, and a moving-scale consequence of the previously proved implication from a Sidon payment through the Balog-Szemer\'edi-Gowers theorem and Boolean-cube growth. Exact unsafe edges, repository audits, and numerical margins lead to four direct adjacent conjectures - two MCA and two auxiliary list inequalities - whose safe sides still require primitive-fiber, residual-projection, algebraic-routing, and add-back payments. In a collision-nonbinding, subexponential-budget identity-candidate branch, we conjecture a non-oracular exhaustive atlas whose exact unsafe--safe bracket, through a proved crossing reduction, yields \(\delta^*_{C_n,\mathrm{off,sup}}=1-\rho_n-g^*(\rho_n,\log_2 |{\mathbb B_n}|)+o(g_n^*)\); the general identity lower route instead uses an exact pole-adjusted target, and no matching bracket is claimed for the unrestricted smooth or circle problem.

Wiener's continued-fraction attack gives the classical provable bound \(d0\), balanced RSA with \(e=\Theta(N)\) can be factored deterministically in polynomial time whenever \(d\leq N^{11/42-\varepsilon}\).

Numerous real-world systems in the FinTech space rely on zero-knowledge proof (ZKP) to verify information without revealing it. For example, range verification is an essential component of transaction systems to ensure that a payment amount does not exceed the payer's wallet balance. However, this verification requires to access the payer's account balance and transferred amount, which they may want to keep confidential. This drives the need for private range verification. In its simplest form, private range verification can be achieved with a zero-knowledge range proof (ZKRP) to verify that a secret value lies within public bounds. When the bounds are also private, ZKRP can still be used, but multiple ZKRPs are needed for each private range verification. This causes a considerable slowdown in the transaction system, which can not only delay transactions but also cause system failures when delays build up beyond control. To address this limitation, we consider the problem of Sequential Private Range Verification, which involves verifying in a sequence that a series of values fall within sequentially-linked private bounds, rather than verifying each private range independently. We propose a novel ZKP, which we call zero-knowledge multiplicative non-negative proof (ZK-MultNNP), and use it in our proposed framework PERSEPHONE to address this problem. We demonstrate experimentally that PERSEPHONE outperforms a ZKRP-based solution by 3x. Furthermore, we observe in a realistic digital payment system that transaction requests are always processed within the Doherty threshold of 400ms with the PERSEPHONE-based system, against only 9% for the ZKRP-based solution.

In this paper, we propose several classes of permutation polynomials having the form $\sum\limits_i(x^{2^m}+x+\delta)^{s_i}+ax$ for $i=1$ or $i=2$, where the exponent $s_i$ satisfies $s_i\equiv 2^j\pmod{2^m+1}$ or $s_i \equiv 2^j\pmod{2^m-1}$ for some different integers $j$, $a\in\mathbb{F}_{2^m}^*$ and $\delta\in \mathbb{F}_{2^{2m}}$. More precisely, by applying the AGW criterion and determining the number of solutions to certain equations over $\mathbb{F}_{2^{2m}}$, several classes of permutation polynomials of the form $(x^{2^m}+x+\delta)^s+ax$ over $\mathbb{F}_{2^{2m}}$ are presented. In addition, we construct some classes of permutation polynomials of the form $(x^{2^m}+x+\delta)^{s_1}+(x^{2^m}+x+\delta)^{s_2}+ax$ over $\mathbb{F}_{2^{2m}}$. Our results generalize some known constructions of permutation polynomials. Finally, we demonstrate that the permutation polynomials proposed in this paper are not quasi-multiplicative equivalent to known ones.

Event date: 26 October to 27 October 2026
Submission deadline: 1 August 2026
Notification: 1 September 2026

Event date: 15 December to 17 December 2026
Submission deadline: 20 September 2026
Notification: 20 October 2026