International Association
for Cryptologic Research

This paper presents an accelerated implementation of the Hamming Quasi-Cyclic (HQC) key encapsulation mechanism by leveraging additive Fast Fourier Transform (FFT) for polynomial multiplication (polymuls). A common challenge when applying FFT-based polymuls to HQC are the polynomial degrees fractionally greater than powers of two, making standard FFT polymuls inefficient for those parameters. We introduce a novel combination of additive FFT with the Chinese Remainder Theorem (CRT) to multiply such just-above-power-of-two degree polynomials.

Further optimizations are achieved by caching the FFT transforms of the public and secret keys during or after key generation and reusing the transform of the shared random polynomial during the encapsulation and decapsulation processes. This approach significantly reduces redundant computations.

The effectiveness of these optimizations is evaluated across various hardware platforms, including x86-64 with AVX2 and Galois Field New Instructions (GFNI), as well as ARM NEON on Apple M1 and Cortex-A72 processors. Benchmarks show that on platforms with long carry-less multiplication instructions like PCLMULQDQ, the proposed caching and reuse strategies allow FFT-based implementations to outpace traditional Toom-Karatsuba methods in the Encap and Decap operations of the HQC scheme, even with comparable raw multiplication speeds. On platforms lacking long carry-less multiplication instructions, the additive FFT approach already gives the superior performance.

Threshold signature schemes allow a group of users to jointly generate a digital signature, providing resilience against faults and enhancing decentralization. With the advent of post-quantum cryptography, lattice-based threshold signatures have gained attention as viable PQ-threshold solutions. Nevertheless, existing constructions are limited in terms of their scalability, robustness. Worse, none is compatible with standardized schemes, particularly with the NIST-selected and standardized Module-Lattice-based Digital Signature Algorithm (ML-DSA) algorithm.

In this work, we present the first threshold signature scheme that is fully compatible with ML-DSA, supporting secure and efficient signing for a small number of parties, with an average communication per party upper bounded by 1 MB up to 6 parties. Our construction leverages advanced short secret sharing techniques and integrates optimized rejection sampling to achieve a favorable balance between communication efficiency and correctness in distributed environments. We implement our construction in Go and evaluate its performance across local, LAN, and WAN network settings. Our benchmarks demonstrate that our threshold ML-DSA scheme is not only practically deployable but also well-suited for real-world applications, including multi-device cryptocurrency wallets, threshold-based TLS authentication, and for Tor's directory authorities.

Hamming Quasi-Cyclic (HQC) was a candidate algorithm in the fourth round of the National Institute of Standards and Technology (NIST) post-quantum cryptography (PQC) standardization process and was ultimately selected as a standardized cryptographic scheme in the latest round. To date, although HQC has been optimized for FPGA, CPU, and other platforms, research on GPU-based parallel acceleration remains significantly underexplored. Given this, our research aims to investigate the feasibility and efficiency of hand-optimized HQC implementations on GPU, addressing the current research gap in GPU-based implementations of code-based cryptographic algorithms. In this paper, we introduce a High-performance Implementation of GPU-based HQC, named HIGH. First, we propose a novel architecture for coding-based PQC implementations, significantly reducing redundant global memory access through core fusion. Second, we design a HIKD structure for HIGH, combining a high-order multiplication scheme (HIK) and a low-order multiplication scheme (HID), achieving an impressive 85.6\% improvement over Official fourth round Optimized Implementation. Third, through extensive experimentation, we sought the optimal HIKD combination and identified the optimal parallel parameters, leveraging these optimizations, HIGH surpasses current state-of-the-art benchmarks, with Key Generation, Encapsulation, and Decapsulation performance increased by 20$\times$, 32$\times$, and 39$\times$, respectively.

Secret sharing serves as a critical primitive for distributed systems; however, traditional protocols lack the adaptability required for dynamic environments with unpredictable participant turnover. While Dynamic-Committee Proactive Secret Sharing (DPSS) attempts to address this, existing synchronous solutions suffer from a critical vulnerability: they necessitate a multi-round hand-off phase that effectively imposes a "quiescent window." This requirement forces committee membership to remain static during transitions, directly contradicting the premise of a fully dynamic adversary.

In this work, we propose a Fully Dynamic-Committee model that eliminates the quiescent window by supporting committee reconfiguration in every round. We present two primary contributions. First, we introduce a suite of three perfectly secure Fully Dynamic Verifiable Secret Sharing (FDVSS) schemes that support per-round committee reconfiguration. Among them, our main construction, FDVSS-1, achieves near-optimal round complexity (four rounds) and polynomial communication ($O(n^4)$). Second, building on FDVSS, we construct a perfectly secure Fully Dynamic-Committee Proactive Secret Sharing (FDPSS) protocol. FDPSS achieves share redistribution in a single communication round, removing "quiescent window" during the hand-off phase. Our protocols require no trusted setup and provide optimal resilience ($t < n/3$) against a Byzantine adversary, offering a robust solution for fault-tolerant distributed systems in highly dynamic networks.

Abuse reporting tools like message franking allow end-to-end encrypted (E2EE) messaging platforms to verify user-generated abuse reports as part of their platform content moderation policies. While the lightweight message franking protocol deployed by Meta's Messenger is designed with the assumption that the moderator and the platform processing messages are the same entity, proposals for other message franking-style protocols allow for a separation between the platform and moderator, albeit at a higher cost. Unfortunately, all works in this space assume that there exists a single moderator working with a platform who verifies and moderates all reports. This results in a situation where technical limitations limit platforms' moderation policy options.

This paper introduces new techniques that allow E2EE messaging platforms to work with multiple vetted moderators, giving users options in their choice of moderators for messages they send to their friends. Verifiable abuse reporting in a multi-moderator setting requires new security notions to capture deniability requirements with respect to the platform and other moderators, as well as new privacy requirements with respect to users' choice of moderator(s). We comprehensively study these requirements and propose three protocols for verifiable abuse reporting in this setting, offering a range of security and performance tradeoffs for different deployment scenarios. We evaluate the performance of our proposed schemes, showing that in many cases they match or exceed the performance of prior schemes that only support a single moderator.

This paper introduces a design methodology for synchronous stream ciphers based on sparse expander graphs as the primary state evolution mechanism, and demonstrates its viability through EGC-Stream, a concrete 128-bit cipher instance. In contrast to conventional designs built around LFSR/NLFSR feedback or complex filtering functions, the proposed approach derives security from structural diffusion induced by a regular Cayley graph combined with a uniform nonlinear Boolean update rule. Key material is injected through a lightweight LFSR mechanism that is deliberately decoupled from the diffusion structure, enabling clear separation between state mixing and key influence. The cipher operates on a 128-bit internal state composed of a 64-bit primary expander-based state and a 64-bit LFSR, and produces one keystream bit per clock cycle following a fixed 256-cycle warm-up phase. Security is evaluated using exact solver-based bounds for short-round differential and linear trails, complemented by empirical algebraic and statistical experiments. These results characterize the cipher’s local trail behavior and observed output properties under the tested configurations. Complementary algebraic experiments based on black-box Algebraic Normal Form (ANF) reconstruction demonstrate rapid saturation of algebraic degree and dense Boolean representations of keystream bits. Statistical evaluation using the NIST SP 800-22 test suite confirms the absence of detectable biases within the tested limits. Hardware efficiency is assessed through baseline FPGA and ASIC implementations. On an Artix-7 FPGA, EGC-Stream achieves deterministic single-bit-per-cycle output with modest resource usage and competitive throughput. ASIC synthesis in a 45 nm standard-cell library results in a compact implementation within the range of established lightweight stream ciphers. Overall, EGC--Stream demonstrates that expander-graph-based diffusion provides a practical, hardware-friendly, and analytically tractable foundation for stream cipher design.

A keyword $\mathbf{s}$ is a subsequence of a text $\mathbf{t}$ if $\mathbf{s}$ can be obtained by deleting some characters of $\mathbf{t}$. Otherwise, $\mathbf{s}$ is considered a non-subsequence of $\mathbf{t}$. Determining (non-)subsequence relationships involves various fields, e.g., genetic analysis, blockchains, natural language processing, etc. Ling et al. (SCN 2024) provided a succinct argument for non-subsequences from multivariate sumcheck (Lund et al., FOCS 1990) whose prover's runtime is at least $\mathcal{O}(n + N + |\Sigma|)$ where $n$, $N$, and $\Sigma$ are respectively the lengths of strings $\mathbf{s}$ and $\mathbf{t}$, and the alphabet $\Sigma$ capturing all characters of $\mathbf{s}$ and $\mathbf{t}$. As indicated by Ling et al., proving non-subsequences is non-trivial since one needs to model such an argument into smaller ones for sumcheck, permutation, and lookup.

We propose a subsequence scheme that separates proving either subsequence or non-subsequence arguments into two phases: (i) proof of preprocessing and (ii) proof of (non-)subsequence argument, assuming $n \ll N$ (i.e., $|\mathbf{s}| \ll |\mathbf{t}|$). Then, we can make a proof of preprocessing with inputs $\mathbf{t}$ and $\Sigma$ in advance, without any knowledge about $\mathbf{s}$. When $\mathbf{s}$ is known, we can determine whether $\mathbf{s}$ is a subsequence of $\mathbf{t}$ and proceed to prove that $\mathbf{s}$ is a (non-)subsequence of $\mathbf{t}$. Employing cached quotients (IACR ePrint 2022/1763), we achieve the running time quasilinear in $N + |\Sigma|$ for preprocessing, while the running time of proving (non-)subsequences is $\mathcal{O}(n \log_2 (N + |\Sigma|))$. Since $n \ll N$ and $\log_2(N + |\Sigma|)$ is small, this saves the prover's runtime, assuming a preprocessing depending only on $\mathbf{t}$ is computed in advance. As $\mathcal{O}(n \log_2 (N + |\Sigma|))$ is sub-linear in $N + |\Sigma|$, we achieve a text-sub-linear proving time.

The Safety-Security-Interaction Group at the Computer Science Department of the University of Oldenburg invites applications for a 4-years post-doc position in trustworthy AI in the context of medical applications (full-time, paygrade E14 TV-L). The term “trust” is to be interpreted broadly and may include topics such as reliability, robustness, fairness, explainability, and auditability, however, the main focus should be on security and privacy aspects. The position is part of the AI Incubator “Connected Health Nordwest”, a collaborative effort of the University Medicine Oldenburg (UMO), the Department of Computer Science at the University of Oldenburg, the Oldenburg Institute for Information Technology (OFFIS), and the German Research Center for AI (DFKI).

The post-doc position will be equipped with 2 Ph.D. student positions (4 years each, full-time, E13 TV-L) and access to extensive laboratories and infrastructure for testing technologies.

Excellent command of the English language is required; German language skills are not required.

Application deadline: 31 January 2026

Complete job announcement and application procedure: https://uol.de/job889en

Closing date for applications:

Contact: Prof. Dr. Andreas Peter ([email protected])

More information: https://uol.de/job889en

Silence Laboratories is looking to hire a full-time cryptography researcher starting in early 2026. Candidates should hold (or be close to completing) a PhD, or otherwise be able to demonstrate a comparable level of proficiency in cryptography. The position will be focused on designing and implementing lattice based cryptography tools and so proven expertise in this domain (through papers at top venues, and other public engagement) is a must. Experience with development in Rust, and familiarity with MPC, FHE, and threshold signature protocols are bonuses.

At Silence, you can expect unique and impactful opportunities to put theory to practice, freedom in how you approach your work, competitive pay, and a chance to work with some of the top research and engineering talent.

The position will be fully remote with occasional travel for in-person offsites, as well as for conferences and workshops per your interest.

In order to apply, please send your CV, and a link to your website (if available) to [email protected] with the title “Full-time Researcher 2026 Application [Your Name]” by January 20th 2026 at the latest for full consideration.

A more detailed posting can be found at: https://md.silencelaboratories.com/s/uoCQUi3hz

Closing date for applications:

Contact: [email protected]

More information: https://md.silencelaboratories.com/s/uoCQUi3hz

We are looking to recruit a lecturer in cryptography at King’s College London to work with us within the cybersecurity group.

We think it’s fair to say we got strong expertise in lattice-based and post-quantum cryptography here, as well as in protocols with an applied cryptography bent. For this position, we do not aim to strengthen lattices further, but rather aim to strengthen other areas of cryptography, e.g. protocols, applied cryptography, cryptography in the wild or theory.

The application deadline is somewhat far into the future (5 March 2026). So, if you like, there’s time to reach out to discuss or even to come visit us to check us out.

Closing date for applications:

Contact: Martin Albrecht ([email protected])

More information: https://martinralbrecht.wordpress.com/2026/01/05/lecturer-%e2%89%85-assistant-professor-juniorprofessor-maitre-de-conferences-in-cryptography-at-kings-college-london-2026/

We present a deterministic framework for navigating $p$-isogeny graphs of genus $g \ge 2$, addressing the lack of canonical and auditable primitives in higher dimensions. The framework integrates two components: the Certified $p$-Isogeny Step (PICS) and a Non-Decomposition Certificate (ND). PICS constructs the unique Frobenius-compatible inseparable isogeny by extracting kernel directions from Hasse--Witt invariants and differential subresultant profiles, thereby eliminating randomized kernel selection. Complementarily, ND serves as an algebraic filter that rejects Jacobians compatible with product decompositions by enforcing cyclicity in the associated differential operator module. We prove that the rejection density scales asymptotically as $O(p^{-1})$. Experimental validation using a C-based backend over 256-bit prime fields demonstrates that the certification logic incurs a relative overhead of less than $0.2\%$ compared to the mandatory Hasse--Witt computation. By enforcing strict determinism and structural safety, the resulting transition unit provides a verifiable primitive for auditable parameter generation and isogeny-based time-lock puzzles.

We revisit the question of whether it is possible to build succinct non-interactive arguments ($\mathsf{SNARG}$s) for all of $\mathsf{NP}$ under standard assumptions using non-signaling probabilistically checkable proofs [Kalai-Raz-Rothblum, STOC' 14]. In particular, we observe that using exponential-length PCPs appears to circumvent all of the existing barriers.

For our main result, we give a candidate non-adaptive $\mathsf{SNARG}$ for $\mathsf{NP}$ and prove its soundness under:

- the learning with errors assumption (or other standard assumptions such as bilinear maps), and - a mathematical conjecture about multivariate polynomials over the reals.

In more detail, our conjecture is an upper bound on the minimum total coefficient size of Nullstellensatz proofs (Potechin-Zhang, ICALP 2024) of membership in a concrete polynomial ideal. We emphasize that this is not a cryptographic assumption or any form of computational hardness assumption.

Of particular interest is the fact that our security analysis makes non-black-box use of the $\mathsf{SNARG}$ adversary, circumventing the black-box barrier of Gentry and Wichs (STOC '11). This gives a blueprint for constructing $\mathsf{SNARG}$s for $\mathsf{NP}$ that is not subject to the Gentry-Wichs barrier.

We show that a simple eavesdropper listening in on classical communication between potentially entangled quantum parties will eventually be able to impersonate any of the parties. Furthermore, the attack is efficient if one-way puzzles do not exist. As a direct consequence, one-way puzzles are implied by reusable authentication schemes over classical channels with quantum pre-shared secrets that are potentially evolving.

As an additional application, we show that any quantum money scheme that can be verified through only classical queries to any oracle cannot be information-theoretically secure. This significantly generalizes the prior work by Ananth, Hu, and Yuen (ASIACRYPT'23) where they showed the same but only for the specific case of random oracles. Therefore, verifying black-box constructions of quantum money inherently requires coherently evaluating the underlying cryptographic tools, which may be difficult for near-term quantum devices.

Among the countermeasures against side-channel analysis attacks, masking offers formal security guarantees and composability, yet remains challenging to implement efficiently in hardware due to physical defaults like glitches and transitions. Low-latency masking techniques aim to mitigate the performance penalties but can inadvertently compromise security in certain architectural contexts. In particular, the recently proposed Time Sharing Masking (TSM) technique enables single-cycle masked implementations with composability under the SNI and PINI notions but fails to satisfy stronger composability guarantees required in iterative designs, i.e., OPINI. In this work, we show that TSM-based constructions can exhibit first-order leakage when used in single-register feedback architecture, such as round-based implementations of ciphers. To address this, we propose two new masking schemes: TSM+, a more efficient variant of TSM satisfying only PINI (but not SNI), and OTSM, a construction satisfying OPINI, enabling secure round-based designs. Our improved round-based masked implementations of PRINCE and AES ensure security in latency-critical applications under both glitch- and transition-extended probing model while demanding for slightly more area consumption.

Batch arguments (BARGs) are non-interactive arguments for conjunctions of NP statements, with proof size that is sublinear in the number of statements. Several previous works studied the communication complexity of BARGs, focusing both on the CRS size and on the additive overhead of the proof, defined as the difference between the proof size and the size $m$ of a single NP witness: - Devadas et al.~[FOCS 22] constructed BARGs with additive overhead that is independent of $m$, however, their CRS size is polynomial in $m$. - Paneth and Pass [FOCS 22] constructed BARGs where the CRS size is independent of $m$, but with higher additive overhead $m^{1-\epsilon}$.

Under the hardness of LWE, we construct BARGs where both the CRS size the additive overhead of the proof are independent of $m$. Such BARGs can be recursively composed an unbounded polynomial number of times without losing succinctness. Along the way, we also considerably simplify the construction of fully local somewhere extractable hash functions used in the construction of Devadas et al.

We study the design of Oblivious RAMs (ORAMs) that allow a client to access memory outsourced to a remote, untrusted server without revealing the client’s data access pattern. We are interested in concretely efficient constructions and prior works have yielded different ORAM frameworks with various trade-offs. Tree-based constructions such as RingORAM [Ren et al., USENIX’15] obtain low communication overhead, but require client storage of linear position maps and two roundtrip queries. Hierarchical schemes such as FutORAMa [Asharov et al., CCS’23] further reduce communication at the cost of more roundtrips during queries. Finally, SQRT-ORAM [Goldreich, STOC ’87] enables fast queries of one roundtrip and one block of communication at the cost of larger amortized communication costs. We present two new constructions, LatORAM and Lat 2 ORAM, that simultaneously obtain the positive traits of all three types of ORAM constructions. Online queries are blazing fast with one roundtrip and a single block of communication like SQRT-ORAM. Fixing the client memory sizes for comparison, the online communication cost of our constructions are 5-8x smaller than RingORAM and 5-10x smaller than FutORAMa even though both RingORAM and FutORAM a require multiple roundtrips per online query. Furthermore, our total amortized communication is also up to 50% smaller. To obtain our constructions, we present a new lazy approach of lateral stash growth that delays large shuffles.

Of independent interest, we present improved oblivious merging schemes for specific settings important for our ORAMs. Our constructions solely rely on symmetric cryptography.

We study a new pairing, beyond the Weil and Tate pairing. The Weil pairing is a non-degenerate pairing $E[m] \times E[m] \to \mu_{m}$, which operates on the kernel of $[m]$. Similarly, when $\mu_{m} \subseteq \mathbb{F}_q^*$, the Tate pairing is a non-degenerate pairing $E[m](\mathbb{F}_q) \times E(\mathbb{F}_q) / [m]E(\mathbb{F}_q) \to \mu_{m}$, which connects the kernel and the rational cokernel of $[m]$. We define a pairing \[ \langle{\quad}\rangle_m : E(\mathbb{F}_q) / [m]E(\mathbb{F}_q) \times E(\mathbb{F}_q) / [m]E(\mathbb{F}_q) \to \mu_{m}\] on the rational cokernels of $[m]$, filling the gap left by the Weil and Tate pairing. When $E[m] \subseteq E(\mathbb{F}_q)$, this pairing is non-degenerate, and can be computed using three Tate pairings, and two discrete logarithms in $\mu_{m}$, assuming a basis for $E[m]$. For $m = \ell$ prime, this pairing allows us to study $E(\mathbb{F}_q) / [\ell]E(\mathbb{F}_q)$ directly and to simplify the computation for a basis of $E[\ell^k]$, and more generally the Sylow $\ell$-torsion. This finds natural applications in isogeny-based cryptography when computing $\ell^k$-isogenies.

We introduce one-time oblivious polynomial signatures (OOPS), a signature scheme based on polynomials over pairing-based elliptic curves that can securely produce signatures for up to a threshold of $n$ different messages. Signing more than $n$ messages allows anyone to forge signatures under the given parameters, making it necessary to reparameterize the scheme occasionally. We show that this property is not a severe limitation though by demonstrating how to build various efficient OOPS-based cryptographic protocols, including delegatable signatures, $1$-out-of-$n$ oblivious transfer, and partially oblivious PRFs.

Approximate Agreement (AA) is a relaxation of consensus that requires honest parties to output values that are close and within the honest inputs' range. Introduced as a relaxation of exact consensus, AA has become a versatile primitive with applications from blockchain oracles to cyber-physical systems. This paper provides a systematization of knowledge (SoK) on byzantine-resilient AA in complete networks.

We mainly focus on the real-valued variant, and chart the feasibility frontiers in synchronous, asynchronous, and network-agnostic models. We compare protocols in terms of resilience, round complexity, and communication efficiency, while also clarifying overlooked details and gaps.

Beyond standard requirements on the outputs, we discuss stronger conditions, such as having the outputs \emph{close} to the honest inputs' median. Moreover, we briefly situate the real-valued AA problem within the broader landscape of AA, where other input domains such as higher-dimensional spaces and graphs introduce further challenges.

We propose a novel mechanism for garbling wires and gates of a logical circuit in a privacy-free environment, focusing on the authenticity of the protocol. It is based on one-hot encodings, tensor products and elliptic curve arithmetic. This scheme is designed to work with arithmetic gates, but we also show gadgets to implement transitions from binary inputs to arithmetic outputs and vice versa. For our scheme, each arithmetic gate takes at most one cyphertext of material to execute its functionality (assuming knowledge of the garbled inputs and their cleartexts). We show an application to blockchain transactions. The security of the scheme is proved in the UC setting.