International Association
for Cryptologic Research

Chenu and Smith introduced the notion of $(d,\varepsilon)$-structures, pairs consisting of an elliptic curve over $\mathbb{F}_{p^2}$ and an isogeny of degree $d$ from the curve to its Galois conjugate. They also defined an ideal class group action on a set of supersingular $(d,\varepsilon)$-structures, inherited from the action on oriented supersingular elliptic curves. As cryptographic applications of this action, they outlined extensions of the CSIDH key exchange and of the Delfs-Galbraith algorithm for the supersingular isogeny problem. In particular, their extension of the Delfs-Galbraith algorithm, called the generalized Delfs-Galbraith algorithm, is expected to be more efficient than the original one by a constant factor. Therefore, it is important to find efficient methods for evaluating the ideal class group action on $(d, \varepsilon)$-structures.

In this paper, we focus on the case $d=2$ and present explicit radical 3-isogenies for evaluating the action of the class of a prime ideal above 3. Our approach relies on two representations of $(2,\varepsilon)$-structures: (i) reductions of degree-2 $\mathbb{Q}$-curves and (ii) Montgomery curves. In particular, we show that any $(2,\varepsilon)$-structure can be represented as a pair of a curve coefficient (of a degree-2 $\mathbb{Q}$-curve or a Montgomery curve) and a single sign. From these representations, we derive radical 3-isogenies that efficiently implement the action of the class of a prime ideal above 3. As an application of our radical 3-isogenies, we give an explicit algorithm of the meet-in-the-middle method for finding an ideal class connecting two given $(2, \varepsilon)$-structures, which is a part of the generalized Delfs-Galbraith algorithm.

The IACR Fellows Program recognizes outstanding IACR members for technical and professional contributions to the field of cryptology. Today we are pleased to announce thirteen members that have been elevated to the rank of Fellow for 2026:

• Amos Beimel: for fundamental contributions to secret sharing and secure computation.
• Colin Boyd: for contributions to public-key cryptography and fostering the growth of the Australian cryptologic community.
• Jean-Sébastien Coron: for essential contributions to cryptanalysis, the design of cryptographic primitives, and side-channel security, and for outstanding service to the IACR.
• Fierre-Alain Fouque: for a wide range of contributions to cryptanalysis and asymmetric cryptography and for service to the cryptologic community.
• Henri Gilbert: for linear cryptanalysis and for other fundamental contributions to symmetric-key cryptanalysis, and service to the cryptologic research community.
• Nadia Heninger: for impactful contributions to the analysis of deployed cryptographic protocols and service to the IACR and the wider security community.
• Aggelos Kiayias: for outstanding contributions to cryptographic designs, including the science and implementations of blockchains, for educational leadership, and for service to the IACR.
• Brian LaMacchia: for outstanding service to the IACR and the cryptologic community and for technical contributions to cryptologic practice.
• Gregor Leander: for seminal contributions to symmetric cryptography and outstanding service to the IACR community through editorial leadership, conference organization, and sustained scientific excellence.
• Willi Meier: for seminal contributions to the design and analysis of stream ciphers, and a life long dedication to conducting and promoting research in symmetric-key cryptology.
• Vinod Vaikuntanathan: for fundamental contributions, including to fully homomorphic encryption, secure computation, quantum cryptography, and information-theoretic cryptography.
• Huaxiong Wang: for significant contributions to the design and analysis of cryptosystems and outstanding service to the cryptologic community, particularly in the Asia-Pacific region.
• Hoeteck Wee: for fundamental contributions to the design, construction, and implementation of advanced encryption schemes.

We present RoKoko, a new lattice-based succinct argument system that achieves a linear-time prover alongside polylogarithmic communication and verifier complexity. Asymptotically, our construction improves upon RoK and Roll (ASIACRYPT 2025), the first post-quantum SNARK with $\tilde{O}(\lambda)$ proof size, by a multiplicative factor of $\Theta(\log \lambda)$. Practically, our system yields proofs of roughly $200$KB, while outperforming the state-of-the-art polynomial commitment scheme Greyhound (CRYPTO 2024) with a $100\times$ faster verification time, similar prover time, and competitive proof size. Our framework natively supports (tensor-)structured relations, such as polynomial evaluation and sumcheck relations.

At a high level, our construction follows the recursive split-and-fold paradigm: the prover first splits the witness into $\rho$ sub-witnesses, sends the corresponding cross-terms, and then folds them into a single witness that is shorter by a factor of $\rho$ using verifier challenges. Prior works typically restrict $\rho = O(1)$ to preserve succinct verification and maintain the optimal $\tilde{O}(\lambda)$ proof size. We overcome this “constant barrier”, which enables larger $\rho$ and thereby reduces the proof size. To achieve this, we introduce the following technical contributions.

(i) Committed folding. Instead of sending $O(\rho)$ cross-terms in the clear, the prover commits to the messages and later proves that the committed vector satisfies the verification relations. This enables the use of a larger shrinking factor, thereby reducing the number of recursion rounds. While this strategy has been successfully used in LaBRADOR (CRYPTO 2023), additional care is required here to preserve succinct verification. (ii) Recursive commitments. We generalise the double-commitment technique from LaBRADOR into a framework for recursive commitments, yielding further compression in commitment size. This results in concrete improvements in communication within each recursion round. (iii) Sumcheck-driven structured recursion. We extend the sumcheck framework from SALSAA (ePrint 2025/2124) to prove substantially more complex constraints arising in our construction (and open for future extensions), including correctness of random projections, inner-product claims and well-formedness of recursive commitments. While expressing these constraints as sumcheck relations requires considerable technical effort, the resulting protocols compose seamlessly with the structured recursion, yielding both linear-time proving and succinct verification.

We construct compilers that convert any secure signature scheme into a single-round blind signature scheme. An important property of the construction is that the final blind signature has exactly the same format as the underlying signature scheme, making the blind signature scheme backwards compatible with the underlying scheme. Our compilers make use of (two-key) fully homomorphic encryption and zero-knowledge proofs to ensure unforgeability and blindness of the final scheme. We present three compilers where the main differences is which party does the bulk of the work: the client, the signer, or both. Along the way we introduce a new notion of verifiable FHE that we call committed verifiable FHE, where the verifier does not see the circuit in the clear.

The BBS+/BBS signature scheme is a key building block for anonymous credentials and privacy-preserving authentication and is currently being standardized and increasingly deployed in practice. To avoid the problem of single-point-of-failure, many threshold BBS+ protocols have been recently proposed for general $t$-out-of-$n$ settings. In practice, however, a $2$-out-of-$2$ policy between a server and a mobile device is sufficient to distribute trust while keeping the system lightweight. Yet, existing threshold designs still require at least three rounds/passes and multi-kilobyte communication in the two-party setting. In this work, we focus on the two-party setting and show that one can achieve reduced interaction while maintaining low computational and communication overhead. Specifically, we present a two-pass two-party BBS+ signing protocol that requires only 0.85KB of communication per signature, about 27% of the currently most bandwidth-efficient work (S&P'25) in the $2$-out-of-$2$ setting. It achieves competitive signing times (roughly 62ms for one party and 46ms for the other) and remains efficient even for large message vectors (e.g., $\ell = 500$), making it attractive for practical deployments. Overall, our protocol is only slower than the fastest OT-based design (S&P'23) but uses nearly two orders of magnitude less bandwidth. We provide a full simulation-based security proof in the standard real-ideal paradigm. As an extension, our protocol can be generalized to a $2$-out-of-$n$ threshold setting naturally.

Multi-signatures are a fundamental cryptographic primitive in distributed systems, enabling a set of parties to jointly produce a compact signature on a common message. Of particular interest are constructions instantiated over pairing-free cyclic groups with a two-round signing protocol, as such schemes offer improved efficiency and deployability in practice. Support for key aggregation is an additional highly desirable property, allowing multiple public keys to be combined into a single succinct aggregate public key against which aggregate signatures can be verified. To improve concrete security guarantees, several works have proposed constructions with tight security reductions. However, existing tightly secure constructions have significant limitations. Notably, T-Spoon by Bacho and Wagner (Crypto 2025) is currently the only pairing-free two-round multi-signature scheme that simultaneously achieves tight security and supports key aggregation. Despite these advantages, T-Spoon incurs substantial efficiency overhead: its signatures comprise nine field elements and two group elements, resulting in prohibitively large signature sizes for many practical applications.

In this work, we introduce Earpick-MS, a tightly secure two-round multi-signature scheme over pairing-free cyclic groups that supports key aggregation while achieving compact signatures. Concretely, signatures in Earpick-MS consist of only three field elements and a single bit, thereby reducing the signature size by a factor of approximately 3.5 compared to the state-of-the-art T-Spoon construction. We further present Earpick-TS, a threshold signature variant of our scheme. Earpick-TS retains the same compact signature size and constitutes the first pairing-free two-round threshold signature scheme with a tight security proof. Prior to our work, achieving tight security in pairing-free threshold signatures required at least three rounds of interaction (Chen, PKC 2025; Bacho and Wagner, CiC 2026). Finally, we propose Earpick-muMS, an additional variant that achieves tight security in the multi-user setting while retaining the same compact signature size.

LayerZero Labs is a research-driven protocol company building the infrastructure for cross-chain interoperability. We are looking for a Cryptographer to join our research team and contribute to the design, analysis, and implementation of cryptographic protocols at the core of our systems.

This is a full-time role based in Vancouver, BC. We provide relocation assistance and visa/immigration support for candidates requiring it.

Responsibilities

• Design and analyze cryptographic protocols with a focus on zero-knowledge proof systems (SNARKs/STARKs), proof aggregation, and recursive composition
• Contribute to applied research translating theoretical constructions into production-grade implementations
• Evaluate cryptographic assumptions and assess security of existing and proposed primitives
• Collaborate with low-level systems engineers on performance-critical implementations in Rust/C++

Qualifications

• PhD (or equivalent research experience) in Cryptography, Mathematics, or Computer Science
• Deep expertise in the design and/or cryptanalysis of zero-knowledge proof systems or lattice-based schemes, including their related primitives
• Strong publication record or demonstrable open-source research contributions
• Comfort working at the intersection of theory and engineering — you can write a security proof, implement a cryptographic primitive, and benchmark code
• Experience with Rust or C++ is a strong plus
• Background in distributed computing or GPU development is a plus

Closing date for applications:

Contact: Kenneth Yun, Talent @ LayerZero Labs

More information: https://layerzero.network/zero

We invite applications for a fully funded PhD studentship focusing on the design and evaluation of post-quantum cryptographic solutions for next-generation communication systems.
The project lies at the intersection of cryptography, network security, and systems, with an emphasis on the integration and performance evaluation of quantum-safe mechanisms in 6G and IoT environments.
Funding covers tuition fees at the UK Home rate and includes a tax-free stipend (£21,805 per year, UKRI rate). International and non-UK applicants are welcome to apply; however, they will be required to cover the difference between Home and International tuition fees.
For more information, you can contact: Dr Vipin Sathi ([email protected]) Dr Essam Ghadafi ([email protected])

Closing date for applications:

Contact: Dr Vipin Sathi or Dr Essam Ghadafi

More information: https://www.ncl.ac.uk/postgraduate/fees-funding/search-funding/?code=comp2175

Research Topics:

• Cryptanalysis of hash functions in both classical and quantum settings.

Applicant Skills / Background:

• A strong background in cryptography, mathematics, computer science, or a related discipline.
• Excellent communication and interpersonal skills, with the ability to work effectively in a collaborative research environment.
• Strong critical thinking and analytical skills, with fluency in technical English.
• Proficiency in programming.

Closing date for applications:

Contact: Hailun Yan

We are seeking an exceptional Postdoctoral Researcher to lead high-impact research in the foundations and applications of lattice-based cryptography. This position is designed for an independent researcher across all aspects of post-quantum cryptography, and you will join a premier research environment. The role will focus on all aspects of lattice-based cryptography, including (classical and quantum) cryptanalysis of post-quantum cryptosystems. The ideal candidate will have a PhD in Computer Science, Mathematics, or a related field, along with a stellar publication record that includes publications in CRYPTO, EUROCRYPT, ASIACRYPT, STOC, or FOCS. They should demonstrate, a proven ability to conduct independent research, and clear ambition evidenced by the ability to solve fundamental problems in computational complexity and cryptography. We offer an internationally competitive salary commensurate with the candidate’s elite standing, as well as a generous travel allowance with full funding for attendance at major international conferences and collaborative visits to top global research groups. The position also provides significant research autonomy, with the freedom to define your research agenda. Interested candidates should submit a CV, a brief research statement highlighting their most significant contributions and their research plan for the next three years, and contact information for three references.

Closing date for applications:

Contact: Divesh Aggarwal ([email protected])

The Cryptography Research Group at the Institute of Computer Science at the University of Tartu invites applications for a Ph.D. position in applied post-quantum cryptography, with a focus on the efficient and secure implementation of lattice-based cryptographic schemes. The selected candidate will design, implement, and analyze practical lattice-based cryptographic primitives that remain secure against quantum-capable adversaries. The research will emphasize high-performance implementations, scalability for real-world systems, and strong protection against implementation-level threats such as side-channel attacks.

Candidates with experience in lattice-based cryptography or related areas of computer science and mathematics are especially encouraged to apply. Applicants should hold (or expect to obtain by spring) an MSc degree or equivalent with a research thesis and have a solid background in mathematics or theoretical computer science, including prior exposure to cryptography. Programming experience particularly in Python/SageMath/Magma and/or C/C++ and/or Java and/or Verilog HDL is highly desirable.

The PhD position begins on September 1, 2026, and has a duration of four years. PhD student receives a net monthly stipend of about €1900, while the cost of living in Tartu remains relatively affordable. For more details, https://crypto.cs.ut.ee/Main/PQCPosition2026

Interested candidates should send their applications (including CV, B.Sc./M.Sc. thesis, academic transcripts and motivation letter with a brief statement of research interests) to Sedat Akleylek ([email protected]).

The application deadline is April 16, 2026.

Closing date for applications:

Contact: Sedat Akleylek, ([email protected])

More information: https://crypto.cs.ut.ee/Main/PQCPosition2026

The Swedish NCSA, which is a part of the Swedish Armed Forces, is hiring cryptographers to work on COMSEC systems that protect Swedish, EU and Nato classified information. The job description includes but is not limited to - developing and evaluating cryptographic algorithms and protocols, - writing requirement specifications for and evaluating COMSEC systems, - developing policies, standards and methods in cryptography, and - continuously monitoring the state of the art in cryptography. The job requires a Swedish citizenship and security clearance. For further details, see the job description in the job offer (in Swedish).

Closing date for applications:

Contact: Contact Martin Ekerå ([email protected]), Madeleine Leander ([email protected]) or the HR department ([email protected]) with any questions.

More information: https://www.forsvarsmakten.se/varnplikt-och-karriar/jobba-i-forsvarsmakten/lediga-jobb/47930/kryptolog-till-avdelningen-for-krypto-och-it-/

In view of its ongoing development, the CRYPTO group of the University of Versailles St-Quentin-en-Yvelines (France) invites applications for the following full-time position.

A tenured Assistant Professor position (“Maître de conférences”) is open to highly qualified candidates who are committed to a career in research and teaching. Preference will be given to candidates with very strong research achievements in one or several of the areas related to the general fields of cryptology and information security.

Responsibilities include research, supervision of undergraduates and graduate students, preparation and management of research projects, and teaching in various study programs.

How to apply: Applications must be sent exclusively via the ODYSSEE portal (https://odyssee.enseignementsup-recherche.gouv.fr/). The list of mandatory documents to be provided is defined by the decree of 6 February 2023 (https://www.legifrance.gouv.fr/loda/id/JORFTEXT000047183295/).

Deadline for submitting applications: Friday, April 3, 2026, 4 PM, Paris time (France).

For selected candidates, in person auditions will take place on Monday, May 18, 2026 (in Versailles).

IMPORTANT NOTE: A “Qualification aux fonctions de Maître de conférences” certificate from the french “Conseil National des Universités” is usually required to apply. However candidates who already hold a an Assistant Professor (or equivalent) position may in some cases be exempted from this certificate.

Closing date for applications:

Contact: Louis Goubin, Full Professor, head of the "Cryptology and Information Security" group

e-mail: louis.goubin (at) uvsq.fr

More information: https://odyssee.enseignementsup-recherche.gouv.fr/procedures/recrutement-ec/offres-poste/fiche-offre-poste/261715

This paper presents the first blind signature scheme in a pairing-free group with the following properties: (1) the signing protocol consists of only three moves; (2) the proof of one-more unforgeability relies solely on the Decisional Diffie-Hellman (DDH) assumption in the Random Oracle Model (ROM); and (3) the construction makes only black-box use of the underlying group. This resolves a major open problem in the area, as all prior pairing-free blind signatures either additionally relied on the Algebraic Group Model (AGM) or required at least four moves. Moreover, a recent lower bound by Dietz et al. (ePrint, '26) shows that three moves are optimal for such constructions.

Both the communication complexity and the signature size in our scheme consist of a constant number of group elements. Our construction in fact achieves strong one-more unforgeability (which was not known for any of the recent AGM-free constructions requiring four moves), and we also present a partially blind variant. Furthermore, blindness is statistical (in the ROM). Our approach is based on a new construction paradigm that combines a conventional (yet, by itself, not fully secure) blind signature scheme (specifically, the blind Okamoto-Schnorr scheme) with a carefully crafted algebraic MAC.

Privacy-Enhancing Know Your Customer (KYC) integrates one-time-use anonymous tokens (OTATs) into self-sovereign identity frameworks, such as the EU Digital Identity (EUDI) Wallet, Apple’s Private Access Tokens, and W3C’s Privacy-Preserving Advertising proposals (e.g., Private State Tokens), to enable regulatory compliance while preserving user anonymity. To mitigate targeted denial-of-service (DoS) attacks and prevent token misuse (e.g., farming and replay), this paper designs a new OTAT, iToken, that first achieves issuer hiding not only at verification but also throughout issuance, thereby strengthening both OTAT’s resilience and user privacy. We introduce a new primitive, a canonical blind ring signature (BRS), that adopts a blind-and-ring pattern, ensuring the ring structure is present from the outset and is initiated by the signer within the interactive blind signing protocol. We also provide two generic constructions, one from a linear function (LF) and homomorphic encryption, and another from an LF and a commit-and-prove sum argument. We finally prototype BRS and iToken, achieving efficient signing bandwidth and competitive computational performance.

The rapid progress of quantum computing threatens widely deployed public-key cryptosystems such as RSA and Diffie–Hellman, accelerating the transition toward post-quantum cryptography (PQC). During this migration, hybrid key encapsulation mechanisms (KEMs) that combine classical and post-quantum primitives are strongly recommended by standardization bodies and cybersecurity agencies. However, existing hybrid designs mainly focus on combining post-quantum KEMs with Diffie–Hellman–style constructions, while the systematic integration of standardized classical public-key encryption (PKE) schemes with post-quantum KEMs remains largely unexplored.

In this work, we introduce two generic hybrid constructions, $\mathsf{HybKEM}$ and $\mathsf{HybKEM}^{*}$, that combine a classical PKE scheme with a post-quantum KEM satisfying ciphertext second-preimage resistance (C2PRI). We prove that both constructions achieve IND-CCA security in the standard model. The refined construction $\mathsf{HybKEM}^{*}$ additionally relies on a new security notion of the classical PKE scheme, termed partial ciphertext second-preimage resistance (PC2PRI), which captures second-preimage resistance when a designated ciphertext component is fixed. This new property enables shared-key derivation from only a designated PKE ciphertext component in $\mathsf{HybKEM}^{*}$, leading to improved efficiency. Finally, we provide a systematic analysis of the PC2PRI property for several standardized classical encryption schemes, including ECIES, PSEC, and SM2.

The Grover oracle is the core component of the Grover search algorithm. Instead of constructing a Grover oracle from scratch, we consider the common practice of constructing a Grover oracle from an existing fully functional quantum circuit (FFQC). An FFQC typically performs computations for a primary target and includes ancilla restoration for qubits used as intermediate storage. Although such circuits can be directly integrated into an oracle, we find that this inevitably introduces circuit redundancy. To address this, we propose a low-depth transformation method that converts an existing FFQC into a low-depth Grover oracle. Additionally, our method can further reduce the width while retaining the previously achieved low depth. We analyse an implementation of the AES quantum circuit and further reduce the circuit width from 7280 to 7104.

At EUROCRYPT 2024, Flórez-Gutiérrez and Todo introduced the puncturing technique for linear key recovery attacks. Puncturing works by modifying the map which evaluates the linear approximation as a function of the plaintext, ciphertext and key by setting carefully chosen coordinates of its Fourier transform to zero. These modifications are intended to reduce the time complexity of the attack at the cost of an increase in data complexity. In this note, we revisit the model which is used to estimate the data complexity, clarify some of its underlying assumptions, and improve its accuracy. This leads to a revision of the cost estimates for several applications of puncturing in the literature, most notably for attacks whose data complexity is close to the full codebook.

Shuffle is a basic primitive for secure computation. Secret-shared shuffle refers to oblivious permutation over secret-shared data, which has broad applications in secret-sharing-based secure computation. Since shuffle is typically used in highly sensitive applications, malicious security is often necessary to provide realistic security guarantees. This paper proposes a new family of two-party maliciously secure secret-shared shuffle protocols with linear communication/computation cost and constant-round communication. Achieving this goal has been proven non-trivial by several recent attempts. We answer this question by proposing a new and simple shuffle paradigm based on authenticated correlations. We start by proposing a simple and efficient protocol template based on authenticated correlations with linear cost and constant-round communication. The protocol can be enhanced to be fully authenticated against a malicious sender, which avoids selective-failure attacks that incur the main overhead in existing solutions. However, our roadmap introduces a consistency issue from a malicious receiver, and the challenge is how to resolve the issue while preserving the expected efficiency property. To this end, we propose new efficiency-preserving consistency checks, enabled by a set of new techniques, optimizations, and analyses. Combining the consistency checks with our framework based on authenticated correlations, we propose two maliciously secure secret-shared shuffle protocols with linear cost and constant-round communication. We have implemented our protocols. Performance evaluation shows that our protocols are faster with lower communication than the state-of-the-art.

Scantegrity II became the first governmental election run with a cryptographic end-to-end election verification (E2E-V) protocol. E2E-V protocols allow the public to verify proofs that the election was executed correctly, but participation in this important process is largely left as an opt-in, ad hoc exercise. We present Zeeperio, a special purpose zk-SNARK argument (built with application-specific arithmetization) that can issue proofs for Scantegrity elections that can be verified automatically via smart contracts for inexpensive on-chain verification. A Zeeperio verification contract running on Ethereum costs under $30 USD (at time of writing) per election (and the cost is constant in the number of ballots). By not relying on general purpose zk-SNARK toolkits, like circuit or zkVM compilers, Zeeperio's tailor-made argument offers multiple order-of-magnitude improvements to prover efficiency over implementations from the research literature. For example, Zeeperio requires under 5 hours on a commodity laptop for an election with 100,000 ballots to produce a proof in the kilobyte range.