International Association
for Cryptologic Research

Privacy-Preserving Blueprints (PPBs), introduced by Kohlweiss et al. in in EUROCRYPT 2023, offer a method for balancing user privacy and bad-actor detection in private cryptocurrencies. A PPB scheme allows a user to append a verifiable escrow to their transactions which reveals some identifying information to an authority in the case that the user misbehaved. A natural PPB functionality is for escrows to reveal user information if the user sends an amount of currency over a certain threshold. However, prior works constructing PPBs for such a functionality have severe limitations when it comes to efficiency: escrows are either computationally infeasible to compute, or too large to be plausibly stored on a large-scale distributed ledger. We address these gaps by constructing a space and computation-efficient PPB for threshold comparison, producing escrows under 2kb that can be computed in seconds. The scheme can be instantiated using well-known cryptographic primitives, namely variants of the ElGamal encryption scheme and generic non-interactive zero-knowledge proofs. As an additional contribution, we implement one of the theoretical generic PPB constructions originally proposed by Kohlweiss et al. and find that it performs surprisingly well in practice. For the threshold comparison functionality it requires approximately 14kb escrows, and can be computed in around 12 seconds.

This paper presents a Keyword Private Information Retrieval (Keyword PIR) scheme that achieves a constant-factor online computation and communication overhead compared to the underlying Index PIR, bridging the gap between Keyword PIR and Index PIR, and enabling efficient and privacy-preserving queries over diverse databases. We introduce a new Key-Value Store (KVS) instantiate by Minimal Perfect Hash Function, referred to as MPHF-KVS, in which each keyword query requires only a single index query. We then develop a generic Batch PIR framework that converts Index PIR into Keyword PIR using KVS encoding. In particular, when the KVS is instantiated using a Binary Fuse Filter (BFF-KVS), Keyword PIR can be reduced to Batch PIR. Leveraging the updatable hint structure of PIR with side information, we propose a novel {Rewind \& Skip} technique that enables the execution of multiple queries within a single round.

In MPHF-KVS, the online computation and communication costs are at most $2\times$ those of Index PIR. In our Batch PIR with BFF-KVS, building upon three recent PIR schemes with sublinear server-side online computation and communication cost and without extra hint store, our approach inherits their advantages and achieves keyword query costs of less than $7\times$ the cost of an index query, while still maintaining sublinear online complexity.

The wide deployment of the generative pre-trained transformer (GPT) has raised privacy concerns for both clients and servers. While cryptographic primitives can be employed for secure GPT inference to protect the privacy of both parties, they introduce considerable performance overhead. To accelerate secure inference, this study proposes a public decoding and secure verification approach that utilizes public GPT models, motivated by the observation that securely decoding one and multiple tokens takes a similar latency. The client uses the public model to generate a set of tokens, which are then securely verified by the private model for acceptance. The efficiency of our approach depends on the acceptance ratio of tokens proposed by the public model, which we improve from two aspects: (1) a private sampling protocol optimized for cryptographic primitives and (2) model alignment using knowledge distillation. Our approach improves the efficiency of secure decoding while maintaining the same level of privacy and generation quality as standard secure decoding. Experiments demonstrate a $2.1\times \sim 6.0\times$ speedup compared to standard decoding across three pairs of public-private models and different network conditions.

Transformer models have gained significant attention due to their power in machine learning tasks. Their extensive deployment has raised concerns about the potential leakage of sensitive information during inference. However, when being applied to Transformers, existing approaches based on secure two-party computation (2PC) bring about efficiency limitations in two folds: (1) resource-intensive matrix multiplications in linear layers, and (2) complex non-linear activation functions like $\mathsf{GELU}$ and $\mathsf{Softmax}$. This work presents a new two-party inference framework $\mathsf{Nimbus}$ for Transformer models. For the linear layer, we propose a new 2PC paradigm along with an encoding approach to securely compute matrix multiplications based on an outer-product insight, which achieves $2.9\times \sim 12.5\times$ performance improvements compared to the state-of-the-art (SOTA) protocol. For the non-linear layer, through a new observation of utilizing the input distribution, we propose an approach of low-degree polynomial approximation for $\mathsf{GELU}$ and $\mathsf{Softmax}$, which improves the performance of the SOTA polynomial approximation by $2.9\times \sim 4.0\times$, where the average accuracy loss of our approach is 0.08\% compared to the non-2PC inference without privacy. Compared with the SOTA two-party inference, $\mathsf{Nimbus}$ improves the end-to-end performance of BERT inference by $2.7\times \sim 4.7\times$ across different network settings.

The sum-check protocol is a fundamental building block in succinct arguments. However, its security formalization is often tightly coupled with the larger protocol in which it is embedded, making modular design and analysis challenging. To address this limitation, we introduce \emph{functional proof systems (FPS)}, generalizing interactive proof systems by viewing the verifier as a function parameterized by the prover, and defining security by asserting properties of this function. This novel perspective not only enables a clean, self-contained security definition for sum-check, but also opens possibility for designing and formalizing security of protocols that prove statements dynamically generated during the protocol---both tasks are difficult for traditional proof systems.

We develop a framework for composing multiple FPSs by executing them in parallel, and analyzing security of the composite protocol. We apply this framework to analyze existing protocols, including BaseFold, a popular polynomial commitment scheme, and BulletProofs, a well-known inner product argument, providing more modular and simpler security proofs than their original analysis. Particularly for BaseFold, our security proof avoids the need for introducing a new variant of correlated agreement theorem, thus building its security directly on the well-studied theorems of FRI. Finally, we construct a new transparent, pairing-free, doubly efficient, and homomorphically additive polynomial commitment scheme by composing existing protocols, demonstrating the practical utility of our framework for designing novel cryptographic schemes.

Searchable Encryption (SE) has shown a lot of promise towards enabling secure and efficient queries over encrypted data. In order to achieve this efficiency, SE inevitably leaks some information, and a big open question is how dangerous this leakage is. While prior reconstruction attacks have demonstrated effectiveness in one-dimensional settings, extending them to high-dimensional datasets remains challenging. Existing methods either demand excessive query information (e.g. an attacker that has observed all possible responses) or produce low-quality reconstructions in sparse databases. In this work, we present REMIN, a new leakage-abuse attack against SE schemes in multi-dimensional settings, based on access and search pattern leakage from range queries. Our approach leverages unsupervised representation learning to transform query co-occurrence frequencies into geometric signals, allowing the attacker to infer relative spatial relationships between records. This enables accurate and scalable reconstruction of high-dimensional datasets under minimal leakage. We begin with a passive adversary that persistently observes all encrypted queries and responses, and later extend our analysis to an more active attacker capable of poisoning the dataset. Furthermore, we introduce REMIN-P, a practical variant of the attack that incorporates a poisoning strategy. By injecting a small number of auxiliary anchor points REMIN-P significantly improves reconstruction quality, particularly in sparse or boundary regions. We evaluate our attacks extensively on both synthetic and real-world structured datasets. Compared to state-of-the-art reconstruction attacks, our reconstruction attack achieves up to 50% reduction in mean squared error (MSE), all while maintaining fast and scalable runtime. Our poisoning attack can further reduce MSE by an additional 50% on average, depending on the poisoning strategy.

On a blockchain, users compete for scarce block space in an auction run by the miner to get their transactions confirmed in the block. This auction is called transaction fee mechanism (TFM). Recent work [Rou21, CS23, SCW23] has been focused on incentive compatibility (IC), requiring that honest behavior maximizes the payoff for each type of strategic player: users, the miner, or miner–user coalitions. In this work, we introduce rational-harm proofness (RHP), which rules out any deviation that harms honest parties without also reducing the deviator’s own utility. RHP closes a gap left by IC: IC does not forbid utility neutral yet externally harmful deviations. For example, in a second-price auction, the second-highest bidder can increase the winner’s payment without affecting their own payoff. Such deviation is eliminated by RHP.

We characterize TFMs satisfying RHP alongside incentive compatibility for users (UIC) and miners (MIC). For finite block size, we develop a complete characterization in two models: - In the plain model —where a single miner unilaterally implements the auction—we prove a tetrilemma (3-out-of-4 impossibility): among the four desired properties positive miner revenue, UIC, MIC, RHP against miner–user coalitions, no mechanism achieves all four simultaneously. Meanwhile, any three are jointly achievable in the plain model. - In the MPC-assisted model —where a committee of miners jointly implement the auction via multi-party computation (MPC)—we construct a randomized TFM with a positive miner revenue that achieves UIC, MIC, and RHP against all three types of strategic players. We further show that randomness is necessary: any deterministic TFM satisfying UIC and RHP in this model must confirm no transactions when the number of users exceeds the block size.

Finally, we show that IC and RHP are incomparable: for each strategic role, there are mechanisms satisfying one but not the other in both models. Our results broaden the design objectives for TFMs: beyond incentive compatibility, mechanisms should also preclude costless harm to honest participants

We present an extend-and-prune fault Injection attack on serial implementations of Learning With Rounding that drop the least-significant bits. By iteratively isolating and recovering progressively larger key portions via faults, the attack recovers the secret key.

We extend a PUF-based authentication protocol with key refresh, hierarchical groups, and revocation. Our framework enables secure communication among enrolled devices without server interaction, allowing group leaders to derive subordinate keys and the server to exclude compromised parties through controlled key updates.

Despite decades of research in electromagnetic (EM) side-channel analysis (SCA), practical attacks still require manual effort and domain expertise to identify informative probe locations on target devices. Existing approaches rely heavily on exhaustive grid scanning or handcrafted alignment, limiting attack scalability and realism. In this work, we present the first automated and adaptive EM SCA framework that uses particle swarm optimization (PSO) to navigate the probe. Particles are guided by mutual information (MI) leakage maps, enabling efficient recovery of secret-dependent emissions. We introduce a novel application of the Nyström approximation to accelerate MI estimation across EM trace windows, allowing real-time swarm guidance without full kernel computations. Unlike prior work, our method requires no leakage templates, manual tuning, or alignment assistance, enabling automated attacks with minimal assumptions. We validate our framework on both microcontroller and FPGA platforms running AES-128. PSO-guided scanning identifies high-leakage points faster than grid search and reduces the number of traces required for successful CPA-based key recovery by up to a factor of 16, i.e., saving tens of thousands of traces.

Security protocols enable authentication, key distribution, and secure information exchange, making them essential for network security, yet flaws in their design can lead to attacks. To prevent this, formal verification methods are vital for analyzing protocol correctness. The Dolev–Yao (DY) \cite{Dy} model introduced formalization for name-stamp and cascade protocols, where users apply public-key operations on messages. Brook and Otto \cite{DY-extension} later distinguished between symmetric and non-symmetric cascade protocols, noting that all DY cases were symmetric and that attacker choices were not fully addressed. They highlighted the incomplete characterization of an attacker’s power as an open problem. In this work, we extend the DY model by systematically analyzing all remaining symmetric two-party cascade protocol cases, aiming to provide a more complete foundation for building formal verification tools.

Sanitizable signatures authorize semi-trusted sanitizers to modify admissible blocks of a signed message. Most works consider only one sanitizer while those considering multiple sanitizers are limited by their capacity to manage admissible blocks which must be the same for all of them. We study the case where different sanitizers with different roles can be trusted to modify different blocks of the message. We define a model for multi-sanitizer sanitizable signatures which allow managing authorization for each sanitizer independently. We also provide formal definitions of its security properties. We propose two secure generic constructions FSV-k-SAN and IUT-k-SAN with different security properties. We implement both constructions and evaluate their performance on a server and a smartphone.

Along with the National Institute of Standards and Technology (NIST) post-quantum cryptography (PQC) stan- dardization process, efficient hardware acceleration for PQC has become a priority. Among the NIST-selected PQC digital signature schemes, FALCON shows great promise due to its compact key sizes and efficient Signature Verification procedure. However, FALCON is regarded as highly computationally com- plex, and as a result, few works for hardware acceleration of FALCON can be found in the literature, where the few existing ones only target high-performance. To fill the gap, this paper presents a Lightweight and Efficient hardware accelerator for the Signature Verification portion of FALCON (LEAF), specifically for resource-constrained applications. We propose an efficient design strategy, including a novel data dependence flow, to maximize the utilization of very small resources for all arithmetic procedures. Then, the proposed full-hardware LEAF is built, containing an ultra-lightweight number theoretical transform (NTT) core with a novel twiddle factor access pattern. Finally, we conduct a thorough evaluation to demonstrate the efficiency of LEAF. To the best of our knowledge, this is the first lightweight and mean- while most resource-efficient FALCON Signature Verification full- hardware accelerator in the literature, offering 65% and 66% less aggregate resource usage and achieving 24% and 14% less equivalent area-time product (eATP), compared to the state-of- the-art for FALCON-512 and FALCON-1024, respectively. We hope that this work can spur further research in the field.

The zero-difference attack on AES, introduced by Bardeh and Rijmen in [ToSC 2022(2):43--62], exploits some structural properties -referred to as related differentials- in the AES MDS matrix. Daemen and Rijmen earlier demonstrated that these related differentials appear not only in the AES MixColumns matrix but in all $4\times 4$ circulant MDS matrices [CCDS 2009(1):47--69]. In the same paper, they also showed an example of $4\times 4$ Hadamard MDS matrices for which there exists no related differentials. Combining both results, we can say for example that some $4\times 4$ Hadamard MDS matrices are more ``secure" than any $4\times 4$ circulant MDS matrices. Recently, Jha et al. investigated whether it is possible to characterize $4\times 4$ Hadamard MDS matrices for which we can find no related differentials in [ IACR Commun. Cryptol. 2(1): 37 (2025)]. As a result, they gave a systematic method to construct such ``secure" matrices with respect to their parameters. In this paper, we investigate the same problem for all $2\times 2$ and $3\times 3$ matrices to understand the cryptographic resilience of MDS matrices both theoretically and practically. As a result, we obtain the following results:

- There are no related differentials for any $2\times 2$ MDS matrices. - There exist related differentials for all $3\times 3$ circulant MDS matrices. - There exist related differentials for all $3\times 3$ involutory MDS matrices when the finite field has even size. - We characterize all $3\times 3$ MDS matrices for which there exist no related differentials when the size of the finite field is even. In this way, we fill a gap for the cryptographic resilience problem of MDS matrices over finite fields.

Commit-and-prove zero-knowledge proofs are a generalized version of zero-knowledge protocols that permit proving relations over the committed elements in addition testifying to its knowledge of the initial message. For example, the existing framework (LNP, Crypto22) allow a user to prove that the secret element committed satisfies quadratic relations with bounded norm (ℓ2 or ℓ∞). Security of these frameworks, regarding the zero knowledge property, is mainly assumed by the use of rejection sampling introduced by Lyubashevsky (Asiacrypt09). The main problems with rejection sampling are non-constant time execution and the cost of protecting this step from side-channel attacks. Our contribution is a new framework of proof for zero-knowledge property that proves knowledge and quadratic relations over lattices without basing the security over rejection sampling. The security of our framework is based on the recent Hint-MLWE (KLSS, Crypto23) assumption. This variant of MLWE gives additional hints about the secret in addition to the original input, and is shown to be as hard as its associated MLWE instance when secrets follow discrete Gaussian distributions.

We present arya-STARK, a unified post-quantum secure framework that enables Aggregation-Robust Yet Authentic training in Federated Learning through transparent zk-STARK proofs. Current federated learning deployments remain vulnerable to malicious or Byzantine clients capable of submitting statistically valid yet adversarial gradients, while also relying on quantum-fragile primitives for authentication. arya-STARK bridges these gaps by combining (i) transparent, hash-based zk-STARK proofs to verify gradient-descent updates at the AIR level, (ii) CRYSTALS-Dilithium signatures to guarantee post-quantum authentication of client commitments, and (iii) a Byzantine-resilient aggregation layer integrating $\ell_2$-clipping and trimmed-mean filtering to mitigate poisoning and backdoor attacks. We introduce a new finite-field encoding scheme that supports exact reconstruction of signed real-valued gradients inside STARK execution traces, enabling full verifiability without leaking client data. Our Rust-based proof-of-concept demonstrates that arya-STARK achieves scalable proof generation, microsecond-level verification, and strong robustness against up to 20% Byzantine clients while preserving high model accuracy. To our knowledge, this is the first system to unify post-quantum authentication, transparent zero-knowledge verification, and Byzantine-robust aggregation into a single architecture for secure federated learning.

Position: Postdoctoral Researcher and Faculty (Assistant/Associate/Full Professor) in Post Quantum Cryptography Implementation

Research Area: Efficient, secure, and standards compliant implementation of PQC on software/hardware platforms.

Responsibilities:

Conduct research on implementation and optimization of PQC on CPUs, embedded systems, and accelerators, etc.

Develop and evaluate PQC libraries/prototypes compliant with emerging standards.

Analyze side-channel and fault attack resistance; design and validate countermeasures.

Collaborate with internal and external partners on PQC deployment in real systems.

Publish results in top-tier crypto/security venues; contribute to standardization efforts.

(For Faculty): Usual teaching duties.

Qualifications:

PhD in Crypto, Computer Science/Engineering, or a closely related field.

Strong track record (relative to career stage) in crypto, applied cryptography, or hardware/software security.

Rich experience in implementation of PKC, side-channel analysis and countermeasures, or embedded systems/FPGA/ASIC design for crypto

Excellent programming skills (e.g., C/C++, Rust, etc).

What we offer:

Excellent research environment with global leaders in PQC and with top financial institutions and industry partners.

Internationally competitive salary and benefits such as housing allowance, travel allowance, education allowance, relocation support etc.

Adequate research funds, and university’s supports to apply for national, provincial and municipal talent programs.

How to Apply:

Post-doc: https://career15.sapsf.cn/sfcareer/jobreqcareer?jobId=4200&company=xjtlu.

Faculty: https://career15.sapsf.cn/sfcareer/jobreqcareer?jobId=4087&company=xjtlu.

For Inquiries, please contact Associate Professor Zhang.

Closing date for applications:

Contact: wenbin[.]zhang[at]xjtlu[.]edu[.]cn

The Research Institute CODE in Munich is inviting applications for multiple PhD and Postdoctoral researcher positions. All positions are fully funded according to the German federal salary scheme TV-ÖD E13/E14, depending on qualifications and experience.

Successful candidates will contribute to a research project on post-quantum cryptography and side-channel analysis. They will work with the Embedded Systems Security (ESSEC) Lab (Prof. Michael Hutter) and the Quantum-Safe and Advanced Cryptography (QuSAC) Lab (Prof. Daniel Slamanig), with opportunities to travel, collaborate with industry, and tackle cutting-edge hardware and cryptography challenges.

Research Areas:
We seek motivated researchers with strong interest and experience in one or more of:

• Side-channel analysis, physical and fault attacks, hardware tampering
• Hardware masking: Threshold Implementations, Domain-Oriented Masking, hiding, DRP logic
• Secure and efficient implementations of cryptography in software or hardware
• ASIC/FPGA design security, hardware security, low-resource implementations (e.g., smartcards)
• Post-Quantum Cryptography (PQC)
• Leakage detection, formal methods, and security verification techniques

Requirements:

• Master’s degree or PhD in a relevant field (students near completion may apply)
• For PostDoc positions:
  • Strong research track record, ideally with publications at IACR venues or top security conferences
  • Excellent academic writing and presentation skills
• High motivation, ability to work independently, and good communication skills
• Fluent English (German optional)

How to Apply:
Send an email to Prof. Michael Hutter with the subject: "Application CODE".

Your application should include:
Cover letter, CV, transcripts, and references (or letters).

Closing date for applications:

Contact:
Prof. Michael Hutter
Email: michael.hutter [AT] unibw.de

Applications will be reviewed on a rolling basis until all positions are filled.

The Chalmers CryptoTeam is recruiting! We are seeking two new members:

• A PhD student, who will work on transparency technologies (key transparency and transparency logs) and post quantum security. We envision a new team member with some prior knowledge in cryptography, a genuine interest in the topic, and willing to work in a collaborative environment. The PhD duration is up to 5 years, including taking courses (part of the PhD education) and participating in teaching activities (up to 20% of the full time equivalent).
• A Post Doctoral fellow who will be involved in advising PhD students on provable security, digital signatures with advanced properties, post quantum cryptography and transparency. We envision a new team member with experience in: proof techniques, designing and modelling security protocols, and publishing at IACR conferences. The successful applicant will have the opportunity to contribute to advising PhD and Master students and will participate in teaching activities (up to 20% of the full time equivalent).

The CryptoTeam provides a welcoming, dynamic and forward-thinking environment. Chalmers University is located in Göteborg, Sweden. The starting date for each position is flexible, but expected to be in Spring 2026 or earlier.

Link to PhD ad: https://www.chalmers.se/en/about-chalmers/work-with-us/vacancies/?rmpage=job&rmjob=14411&rmlang=UK

Link to PostDoc ad: https://www.chalmers.se/en/about-chalmers/work-with-us/vacancies/?rmpage=job&rmjob=14411&rmlang=UK

Closing date for applications:

Contact: Assistant Professor Elena Pagnin

More information: https://www.chalmers.se/en/about-chalmers/work-with-us/vacancies/?rmpage=job&rmjob=14411&rmlang=UK

We invite applications for a full-time Research Fellow (Postdoc) position funded by the Australian Research Council project “NextGen Blockchain Privacy & Security: Practical and Quantum-Safe Solutions”, led by Prof. Joseph Liu in the Department of Software Systems and Cybersecurity, Faculty of IT, Monash University.

This is an exciting opportunity to work at the intersection of modern cryptography, blockchain technologies, and post-quantum security, in a highly active research environment with strong international collaborations and a clear pathway to high-impact publications.

About the role: The successful candidate will contribute to designing and analysing practical and provably secure cryptographic protocols for blockchain applications, with a focus on topics such as:

• Privacy-preserving blockchain systems
• Payment channels and Layer 2 solutions
• Scalable and secure off-chain transactions
• Quantum-resistant blockchain privacy mechanisms

You will be expected to conduct high-quality research, lead and co-author papers for top-tier venues, collaborate with local and international partners, and help supervise PhD and honours students working in related areas.

About you: We are looking for a highly motivated researcher who meets the following criteria:

• PhD in Cryptography or closely related area, or near completion (thesis submitted or close to submission)
• Strong background in theoretical and/or applied cryptography, preferably with applications to blockchain
• Experience in at least one of the following: privacy-preserving blockchain protocols, payment channels, Layer 2 or off-chain transaction mechanisms
• Knowledge of post-quantum cryptography is highly desirable
• A strong publication record with papers in top IACR conferences (CRYPTO, EUROCRYPT, ASIACRYPT) or top security conferences (ACM CCS, IEEE S&P, NDSS, USENIX Security)

Note: This position is not suitable for candidates working primarily on non-cryptographic application on blockchain topics, e.g. consensus mechanism, smart contracts, or purely applied blockchain business use cases.

Closing date for applications:

Contact: Interested person please send your CV (with full publication details) to Prof. Joseph Liu (email: joseph.liu @ monash.edu). This position is open until it is filled.