International Association
for Cryptologic Research

In this paper, we present RISQrypt, the first unified architecture in the literature that implements Kyber (ML-KEM) and Dilithium (ML-DSA), standardized lattice-based Post-Quantum Cryptography (PQC) algorithms, with masking. RISQrypt is a hardware–software co-design framework that integrates dedicated cryptographic accelerators to speed up polynomial arithmetic, hashing, and mask-conversion operations, the latter being one of the primary bottlenecks in masked implementations of lattice-based PQC. Our design achieves low latency while providing both theoretical and practical side-channel security, as validated through experimental evaluation. Specifically, the masked decapsulation of Kyber768 requires 109K clock cycles, while masked signing of Dilithium3 requires 1230K clock cycles on average. These results demonstrate 11.3x time-performance improvement over existing masked implementations. Our performance results for unprotected functions also outperform the existing work by up to an order of magnitude. In addition, prior designs are more limited in scope, generally supporting only a single scheme and lacking the unified, crypto-agile framework that enables support for both Kyber and Dilithium as in our architecture. Leveraging the HW/SW co-design approach, our proposed architecture can be readily extended to other PQC standards such as Falcon and SPHINCS+, as well as to algorithms sharing similar computational building blocks, through firmware reprogramming.

The Fischlin transform yields non-interactive zero-knowledge proofs with straight-line extractability in the classical random oracle model. This is done by forcing a prover to generate multiple accepting transcripts through a proof-of-work mechanism. Whether the Fischlin transform is straight-line extractable against quantum adversaries has remained open due to the difficulty of reasoning about the likelihood of query transcripts in the quantum-accessible random oracle model (QROM), even when using the compressed oracle methodology. In this work, we prove that the Fischlin transform remains straight-line extractable in the QROM, via an extractor based on the compressed oracle. This establishes the post-quantum security of the Fischlin transform, providing a post-quantum straight-line extractable NIZK alternative to Pass’ transform with smaller proof size. Our techniques include tail bounds for sums of independent random variables and for martingales as well as symmetrization, query amplitude and quantum union bound arguments.

We introduce Bolt, a new Multilinear Polynomial Commitment Scheme (MLPCS) designed for high-performance SNARKs over binary fields. Bolt is geared towards SNARKs for large computations, in which prover speed is paramount but one can afford slightly larger proofs. The construction is based on the code-switching paradigm; our core technical contribution is a new "proof-system friendly" error-correcting code with extremely efficient encoding both asymptotically and concretely. Bolt offers a significantly faster prover than prior works, while maintaining a moderately larger, yet still reasonable, proof size.

Theoretically, Bolt achieves a commitment time of approximately $(3+\varepsilon) \cdot N$ field additions plus a Merkle Tree hash computation of size $(1+\varepsilon) \cdot N$ field elements, where $N$ is the size of the multilinear polynomial and $\varepsilon>0$ is arbitrarily small. The prior state-of-the-art, Blaze (Brehm et al., Eurocrypt 2025) used more than $8N$ field ops and a $4N$ size Merkle hash.

Concretely, our implementation demonstrates that these asymptotic gains translate into substantial real-world speedups. Our benchmarks show that for $N=2^{30}$ over a $32$-bit field, Bolt achieves a commitment time roughly $3 \times$ faster than Reed-Solomon based schemes, albeit with a moderately larger proof. Bolt also offers better commitment time and proof size than recent linear-time schemes. For example, its commitment time is about $1.34 \times$ faster than Brakedown (Golovnev et al., Crypto 2023) and with a $2 \times$ shorter proof.

This paper investigates hash-function constructions derived from lightweight block ciphers, that are suitable for evaluation in fully homomorphic encryption (FHE) settings. We focus on PRINCEv2, a 64-bit lightweight block cipher with 128-bit keys and low algebraic complexity, which is particularly amenable to FHE evaluation. However, the small block size of such ciphers limits the applicability of standard hash-function transforms. Indeed, achieving 128-bit collision resistance in the (n, 2n) setting, i.e., with 64-bit blocks, requires a quadruple-block-length (QBL) compression function, for which no generic construction is known. In this work, we propose a concrete QBL compression construction tailored to PRINCEv2 and analyze its collision resistance. Candidate QBL designs inspired from existing double-block-length constructions are also outlined. As a further contribution, we describe a carefully optimized homomorphic circuit design for PRINCEv2. The resulting implementation outperforms previous works in both operation counts and computational depth. Experimental timings demonstrate the practical feasibility of evaluating the corresponding hash constructions under FHE with low latency, while providing cryptographically small failure probability.

Event date: 6 October to 9 October 2026
Submission deadline: 15 May 2026
Notification: 23 June 2026

Event date: 23 November to 25 November 2026
Submission deadline: 10 June 2026
Notification: 10 August 2026

Event date: 9 May to 10 May 2026
Submission deadline: 15 March 2026
Notification: 10 April 2026

Event date: 9 May 2026
Submission deadline: 6 March 2026
Notification: 20 March 2026

Event date: 5 May to 8 May 2026

The Computer Security and Industrial Cryptography (COSIC) group belongs to the Electrical Engineering Department at the KU Leuven. The COSIC team has about 100 researchers, including 9 professors, 6 researcher managers/experts, 20 postdoctoral researchers, 60 PhD students, 8 visitors, and 7 support staff.

We are looking for a motivated candidate for a PhD position on practical fully homomorphic encryption. The student will be a part of the FINAL project team. The research will include the design and implementation of novel techniques and improvements for the FINAL scheme using advanced cryptographic techniques such as MPC, FHE, and Zero Knowledge Proofs with the explicit intention for industrial deployment.

Responsibilities:

Design and implement efficient building blocks and protocols for the FINAL scheme.

Improve and optimize implementations for industrial deployment

Plan, design, and evaluate test cases with industry stakeholders

More info and how to apply
https://www.esat.kuleuven.be/cosic/vacancies/

Closing date for applications:

Contact: [email protected]

More information: https://www.esat.kuleuven.be/cosic/vacancies/

This is an urgent call for interested applicants. A funded Ph.D. student position is available for Fall 2026 to work on different aspects of Cryptographic Engineering in the Bellini College at USF (Tampa, FL) with Dr. Mehran Mozaffari Kermani.

We need an applicant who already does have Master’s in Computer Engineering or Computer Science with hardware background (do not contact if you have not obtained a Master’s degree, this position is not for direct Bachelor’s to Ph.D.)

Please send email me your updated CV (including list of publications, language test marks, and references), transcripts for B.Sc. and M.Sc., and a statement of interest to: mehran2 (at) usf.edu as soon as possible. NOTE: The successful candidate will be asked to apply formally very soon to the college, so all the material has to be ready. We do not require GRE.

Closing date for applications:

Contact: Prof. Mehran Mozaffari Kermani

A position for a postdoctoral researcher in isogeny-based cryptography is available in the research group led by Prof. Lorenz Panny in the Department of Mathematics at TUM, located at the Garching campus.

The group was established in 2023 and primarily focuses on mathematical and algorithmic aspects of post-quantum cryptography, ranging from constructive to cryptanalytic considerations. At this time, the group consists of the group leader and two PhD students (one at TUM, one external).

This position is part of the DFG-funded CRYPTIQ project, a cooperation with Prof. Christophe Petit (Université libre de Bruxelles, Belgium). The position is limited to about 2 years (depending on the start date), with a salary following the German TV-L scale for civil servants (level E13). Funding for attending academic events is available.

Requirements for the position include a doctoral degree in a suitable field (mathematics or computer science), as well as solid English skills in speaking and writing (knowledge of German is not needed). The ideal candidate has previously completed novel research projects on topics in (or related to) isogeny-based cryptography, and has built an excellent academic track record in the process.

Applications should include:

• Detailed academic CV.
• (Link to) applicant's PhD thesis.
• Information about possible/desired start dates.
• Name(s) and email address(es) of one or multiple professors willing to provide a letter of recommendation directly to us upon request. (There is no need to send a letter immediately as part of the application.)

Applications will be reviewed starting March 1 until the position is filled. Please send your application files to [email protected] with a meaningful subject line. Feel free to contact the same address for any questions about the position.

Closing date for applications:

Contact: Lorenz Panny <[email protected]>

The Department of Information Security and Communication Technology invites applications for a PhD Research Fellow position in Post-Quantum Cryptography for Privacy Preserving Protocols. The successful candidate will be offered a 4‑year appointment that includes teaching responsibilities.

The selected candidate will conduct research in Post-Quantum Cryptography with a particular focus on privacy-preserving protocols. The research will cover major Privacy-Enhancing Techniques (PETs), including Fully Homomorphic Encryption (FHE), Secure Multi-party Computation (MPC), and Zero-Knowledge Proofs (ZKPs). The candidate will design, analyze, and implement advanced privacy-preserving cryptographic protocols, with applications to real-world domains such as machine learning, distributed systems, and blockchain technologies.

At NTNU we want to increase the proportion of women in scientific positions. Female students are therefore encouraged to apply.

The application deadline is March 20, 2026

For more information, please check the official job announcement.

Closing date for applications:

Contact: Associate professor Jeongeun Park ([email protected])

More information: https://www.jobbnorge.no/en/available-jobs/job/295226/phd-candidate-in-post-quantum-cryptography-for-privacy-preserving-protocols

Internship: Automated Complexity Evaluation for Differential Cryptanalysis

Context The evolution of cryptography and emerging threats (IoT, AI) requires robust encryption schemes. The TAGADA library (Libralesso et al. 2021) assists cryptographers by estimating differential distinguisher probabilities. However, evaluating the full security of an algorithm requires measuring the global time complexity of attacks, beyond simple probabilities.

Objectives The goal is to model and automate the complete complexity evaluation of differential attacks. Key missions include:

• Key Recovery Integration: Incorporating automated key recovery phase evaluation into existing resolution models.
• Global Optimization: Developing methods to optimize overall attack complexity instead of isolated sub-problems (balancing distinguisher probability vs. key extraction cost).
• Security Bounds: Identifying more precise security limits for encryption standards.

Candidate Profile Master’s or Engineering student in Computer Science, Mathematics, or Cybersecurity. Strong interest in symmetric cryptography and algorithmic optimization. Proficiency in English (technical reading/writing). Future Prospects Depending on results, this internship can lead to a PhD in Cryptanalysis (eligible for EU citizens).

Closing date for applications:

Contact: Loïc Rouquette

The paper addresses the challenging and timely issue of vote buying in electronic voting. Electronic voting is a well established process in modern democracies. However, problems such as vote buying continue to pose a significant challenge. This paper aims at addressing this issue by leveraging the novel concept of Anamorphic Encryption to enable voters to cast their original vote together with a hidden ``fake" one. In this way voters can pursue their true preferences unobstructed while providing a compliance proof to potential vote buyers. The security of our construction is proved through a formal security analysis, that considers powerful adversaries who aim at breaching user privacy and influencing votes. We believe that this innovation e-voting approach can enhance the overall security of e-voting systems and pave the way to avoid electoral manipulation.

Interactive Oracle Proofs (IOPs) enable a probabilistic verifier interacting with a prover to verify NP statements while reading only few bits from the prover messages. Zero-Knowledge IOPs (ZK-IOPs) have the additional guarantee that a query-bounded (possibly malicious) verifier learns nothing about the NP witness.

We initiate a systematic study of ZK preservation under IOP composition, and prove general composition theorems for ZK-IOPs in the 2- and multi-IOP setting. Our main result shows that ZK is preserved in the setting of perfect, black-box, straight-line ZK (the standard setting for ZK-IOPs), if the outer IOP has an additional mild property that is satisfied by existing ZK-IOPs. Contrary to common belief, this does not follow from composition theorems for multiparty protocols (Kushilevitz, Lindell and Rabin, STOC`06).

Our composition theorems show that ZK-IOPs can be modularly designed by composing sub-protocols, and ZK of the composed system follows seamlessly from the ZK guarantees of its building blocks. Using our composition theorems, we easily derive both new and known results on ZK-IOPs in various settings, including ZK preservation under parallel/sequential composition, ZK of IOPs for sumcheck and codeswitching, ZK of IOPs for NP using arithmetization and sumcheck, and ZK preservation under IOP proof composition (reproving a result of Bootle, Chiesa and Liu, EC`22).

We present new algebraic attacks on Poseidon2 and Poseidon2b. We exploit the specific structure of the matrices that define the linear layers in the hash function which allows us to improve round-skipping for the constrained-input constrained-output CICO problem. The security of many circuit-friendly hash functions has been measured by their resistance against attacks on the CICO problem. However, we show how to boost our round-skipping attack when directly modelling algebraic preimage attacks of Poseidon2(b) in compression and sponge mode. To the best of our knowledge, our attack provides the first examples where finding preimages is easier than solving the corresponding CICO problem in Poseidon2(b). Furthermore, we describe the first algebraic collision attack that outperforms its algebraic preimage counterpart. We improve over state-of-the-art algebraic attacks for a range of parameters, e.g. for one recommended $128$-bit parameter set we improve over previous state-of-the-art algebraic collision attacks by a factor of $2^{106}$. However, due to the algebraic security margin this does not mean the primitive falls short of its claimed security level. Finally, we discuss how our attacks can be mitigated without affecting the efficiency of Poseidon2(b).

This paper focuses on quantum key-recovery attacks on block ciphers. Previous works on quantum differential and truncated differential attacks like [Kaplan et al., ToSC 2016] have shown that classical algorithms for key-recovery, typically based on generating differential pairs and sieving them, can be accelerated by up to a quadratic speedup using variants of quantum search, quantum amplitude amplification, and quantum collision-finding.

In this paper, we introduce a new quantum truncated differential key-recovery attack, which leverages the quantum convolution algorithm introduced in [Schrottenloher, CRYPTO 2022] and previously used in linear cryptanalysis. We adapt this algorithm to the case of differential cryptanalysis, by rewriting the probability of a differential of an $n$-bit cipher as a convolution of functions with $2n$-bit input. We then construct a quantum state whose amplitudes encode the probability of the differential for different key guesses, and use this as the starting point of a quantum search. In some cases (although not on practical ciphers so far), the speedup is better than quadratic compared to classical attacks. We also extend the framework to related-key differential attacks.

We give applications to a 9-round attack on QARMAv2-64 adapted from [Ahmadian et al., DCC 2024] and a 12-round related-key attack on AES-256 from [Boura et al., CRYPTO 2023], which show improvement over classical attacks and over Kaplan et al.'s strategy when taking into account the amount of memory and the type of quantum memory used (as our attack requires only quantum-accessible classical memory).

An Asynchronous Complete Secret Sharing (ACSS) protocol enables a dealer to distribute \( N \) Shamir shares such that all parties eventually receive their shares over an asynchronous network. It serves as a fundamental building block for asynchronous Secure Multiparty Computation (MPC) and Byzantine Agreement. In this work, we focus on the statistically secure ACSS with optimal resilience (\(t < n/3\)). Recently, Ji, Li, and Song~[CRYPTO'24] proposed the first ACSS protocol with amortized linear communication. However, their scheme lacks guaranteed termination, and they identified the construction of a linear-communication ACSS with guaranteed termination as an open problem. Furthermore, their protocol requires a large amortized bound of \( N = \Omega(n^{11} \kappa) \), where \( n \) is the number of parties and \( \kappa \) is the size of the secret. In this work, we resolve the open problem and significantly reduce the amortized bound by presenting a linear-communication ACSS protocol with guaranteed termination and a lower bound of \( N = \Omega(n^{4}+n\kappa) \). Our ACSS protocol can be directly applied to asynchronous MPC protocols, ensuring both guaranteed termination and improved communication per multiplication gate, as well as to asynchronous Byzantine Agreement.

Threshold signatures split the secret key among $n$ parties, where any subset of at least $t$ parties can collaboratively produce a valid signature. They have been widely deployed in applications such as blockchain systems. Lattice-based threshold signatures have also attracted considerable attention due to their post-quantum security guarantees. However, existing lattice-based constructions still face significant efficiency challenges, particularly when the number of parties becomes large. Recent lattice-based threshold signatures such as TRaccoon (Eurocrypt’24) and Ringtail (S\&P’25) support large thresholds, but they either require three interaction rounds or incur heavy communication costs in the two-round setting, limiting their practicality.

In this paper, we present $\mathsf{TalonG}$, a novel two-round lattice-based threshold signature that overcomes these limitations via a new trapdoor semi-commitment technique. This variant of commitment relaxes the standard binding requirement to a weaker form, allowing an efficient instantiation from the NTRU assumption and enabling a compact two-round signing protocol with low communication.

For $t=1024$ and 128-bit security, $\mathsf{TalonG}$ achieves significant improvements among existing lattice-based threshold signatures: its total communication per party and public key size are both minimal, at 26.9 KB and 2.0 KB, respectively. While the resulting signature size is larger (17.7 KB), it remains practical and highly competitive. $\mathsf{TalonG}$ is thus well-suited for real-world large-scale deployments where both round efficiency and communication load are critical.