International Association
for Cryptologic Research

We develop the radix-2 number-theoretic transform (NTT) and its butterflies, the twisting trick and why it never changes the transform, the freedom to use Cooley--Tukey butterflies in both directions, incomplete NTTs, Good's trick, and the ways all of these combine---closing with the coefficient-bound bookkeeping that motivates the whole toolkit. This note is intended to help implementers of postquantum cryptography, and is compressed from the author's lecture slides in his Postquantum Cryptography class at National Taiwan University (2020--2025). It may be otherwise trivial for FFT experts who know the DIT--DIF equivalence inside out---except that they tend not to ever encounter incomplete NTTs.

Commutative diagrams of isogenies between supersingular elliptic curves, which are called isogeny diamonds, have become fundamental to isogeny-based cryptography for both constructive and cryptanalytic purposes. In parallel, proofs of knowledge of isogenies have been widely studied and have found many applications. In this work, we combine these two directions and introduce zero-knowledge proofs of isogeny diamonds, namely, we prove knowledge of isogenies that form a commutative diagram between four curves.

We present four constructions that work in various settings. The first, Windmill-ZKP assumes that the prover knows only two parallel isogenies in the diamond. The second, Cube-ZKP assumes the prover has knowledge of four of specified degree isogenies. Finally, Kube-ZKP and Kani-ZKP prove knowledge of isogeny diamonds whose degree sum is smooth. We also provide proof-of-concept implementations of the proposed constructions and compare their performance. Our results demonstrate the trade-offs between security, efficiency and compactness in these constructions.

Running Transformer inference and retrieval-augmented generation (RAG) over confidential data forces a choice: either expose prompts and documents to a cloud operator, or keep the data on-premises, which confines the deployment to weaker self-hosted models. Existing defenses span five mechanism families: secure computation (MPC and FHE), trusted execution environments (TEEs), static obfuscation, differential privacy, and hybrid TEE-and-obfuscation splits. No prior systematization compares them on a common footing of mechanism, threat model, and deployment cost, and none covers the RAG retrieval layer. We organize the field by deployment readiness: the likelihood a scheme is adopted in practice, scored on performance, utility, and threat-model fit. The scoring spans inference and RAG retrieval, both dense and graph. We find that no family dominates: each attains at most two of the three criteria, and which one it sacrifices is fixed by its security basis, so the deployable choice is set by the constraint an application can least afford to relax. Even trusted hardware is no exception, since every surveyed scheme ignores the side channels to which it is most exposed. We further surface hidden deployment costs, such as client reliance and a custom serving path, identify private graph-RAG as the least-served setting, and find that no design yet keeps a pipeline confidential from query to answer.

Private Set Intersection (PSI) enables parties to compute the intersection of their input item sets while preserving privacy. In many real-world applications, however, each item is accompanied by a sensitive weight, and the ability to privately compute over such weights is crucial. Existing research in this direction is fragmented and driven by application-specific goals, with representative examples including PI-Sum (computing the sum of weights over the intersection), inner-product Private Join and Compute (computing the inner product of weight vectors over the intersection), and Item with Maximum Weight Sum (identifying the intersection item with the maximum combined weight).

In this work, we propose a unified framework for private computation on weighted set intersection. We formalize \textit{Private Filtering and Aggregation for Weighted Set Intersection} (PFA-WSI) as an ideal functionality parameterized by a joint scoring function $f$ and a predicate $P$, supporting two output modes: (i) \emph{predicate-filtered output}, which reveals a predicate-selected subset of intersection items, and (ii) \emph{aggregated output}, which reveals only aggregate statistics over matched items. By instantiating $f$ and $P$ appropriately, PFA-WSI captures deployed and studied tasks such as PI-Sum, inner-product PJC, and IMWS, and also accommodates richer metrics arising in practice, such as $L_1$- and $L_2$-type distance statistics on matched item weights.

To realize PFA-WSI efficiently, we introduce a novel core building block, Oblivious Encrypted Weight Transfer (OEWT), which enables a receiver to obtain encryptions of the sender's weights for intersection items and random-looking ciphertexts otherwise. Building on OEWT and additively homomorphic encryption, we present modular protocol constructions for different instantiations of $f$ and for both output modes. We prove simulation-based security in the semi-honest model and provide detailed communication and computation analyses. Our experiments show that our constructions scale to million-sized sets with practical performance that matches or surpasses the state-of-the-art.

MQOM v2 derives every correlated-GGM root from a fresh \(\lambda\)-bit master seed using a fixed PRG call with zero salt. A public opening reveals either the corresponding root or its XOR with a fixed prefix of the long-term MQ witness. Because the resulting root functions are shared by all signatures, keys, salts, and v2 releases, repeated master seeds expose linear equations in the witness. We give a passive classical EUF-CMA attack in which an optimal three-record parity-indexed XOR triangle detects every usable collision, recovers the complete signing key, and produces a fresh-message forgery. In Category I at the permitted \(Q=2^{64}\) signing-query boundary, the attack has birthday-regime success \(0.393395296381\) with error \(O(2^{-64})\). A rank-two extension recovers two unrelated keys, while reusable global tables attain membership-certified lower bounds of \(0.632030733547\) for the complete triangle and \(0.776706354579\) for the record-optimal one-root allocation at \(P=Q=2^{64}\).

The same fixed root functions support full-key recovery in every security category and allow precomputation to be reused across targets and versions. A streaming first-distinguished-point construction replaces storage of the signature corpus by certified chain coverage and an identifier-free endpoint index. Its membership-hit law is exact conditional on realized distinct coverage, with separate forecasts for chain construction, tags, fingerprints, and MPHF storage. A Category-I \(\mathrm{GF}(2)\) design point uses 52 GiB, \(2^{52}\) signatures, and target coverage \(C=2^{77}\); conditional on that coverage, its success is \(0.631940886333\) and its normalized serial forecast is below \(2^{94}\). Pinned probes reproduce the fixed roots for every official tag from v2.0.0 through v2.1.1 and a pinned current revision in Categories I, III, and V. Salt-bound, domain-separated root expansion eliminates the collision and reusable-precomputation channels.

Oblivious Transfer (OT) is a fundamental cryptographic primitive and a core building block for many multiparty cryptographic protocols. While existing OT extension techniques achieve excellent asymptotic efficiency for very large batches, their performance degrades when the total number of OTs is only moderate, since the cost of generating the required base OTs is no longer effectively amortized. In this work, we close this gap by presenting OT constructions that achieve square-root communication complexity for batched OT generation. Concretely, our protocols generate $\ell$ random OTs using $O(\lambda\sqrt{\ell})$ communication.

Our constructions are inspired by recent advances in homomorphic secret sharing and techniques for distributed discrete logarithm computation, and explore complementary points in the design space. The first construction is based on the Damg{\aa}rd--Jurik cryptosystem and standard assumptions, at the cost of a one-time trusted setup. The second eliminates the need for any setup, relying instead on a power-DDH assumption over prime-order groups. For typical parameters with $\lambda=128$, our schemes require approximately $2.5$ KB and $1$ KB of communication, respectively, to generate $128$ random OTs, and outperform existing OT extension techniques for batch sizes up to $\ell \leq 2^{15}$.

Shuffle arguments are a fundamental building block in mix-nets and related privacy-preserving systems, where they are used to prove that a set of ciphertexts or commitments is a permutation and rerandomization of another set without changing the underlying messages. Existing communication-efficient shuffle arguments rely on classical assumptions, whereas known lattice-based constructions are still significantly less efficient. In this paper, we present a lattice-based shuffle argument with short proofs by using the subset-checking approach of Abdolmaleki et al. (SCN 2024) in the lattice setting. Our main construction proves correct shuffles of Ajtai commitments and is built on the ABDLOP commitments and lattice-based zero-knowledge framework of Lyubashevsky et al. (Crypto 2022). The protocol is secure under the Module-SIS and Module-LWE assumptions in the random oracle model. A key technical ingredient is a rerandomization method for the derived commitment key, which restores the distributional properties needed for soundness even when the input commitments may depend on the prover. We further extend our approach to obtain shuffle arguments for ciphertexts and public keys, yielding applications to lattice-based mix-nets and single secret leader election. Finally, we implement our construction and compare it with prior lattice-based shuffle protocols, obtaining substantial improvements in communication, proving time, and verification time.

The Princeton DeCenter invites applications for Postdoctoral Fellows, (including more senior researchers) with academic or industry experience expected to begin in Feb. 2027 through Feb. 2028. They will be appointed at the rank of Postdoctoral Research Associate or at a more senior rank, as appropriate. The Term of appointment is based on rank. Positions at the postdoctoral rank are for one year with the possibility of renewal pending satisfactory performance and continued funding; those hired at more senior ranks may have multi-year appointments. Fellows must have their Ph.D. in hand by the start of the appointment. Fellows will join a vibrant intellectual community dedicated to advancing research on blockchain, decentralized technologies, and their applications, across computer science, economics, law, political science, philosophy, and related fields. The DeCenter is a newly established interdisciplinary hub at Princeton University devoted to exploring the decentralization of power and trust through blockchain (and similar) technology.

Closing date for applications:

Contact: [email protected]

More information: https://apply.interfolio.com/185365

The Frontier AI Security Residency is an eight-week, fully funded programme in Cambridge, UK, running from 12 October to 4 December 2026. Residents work full time on a single project. Projects range from tamper-evident enclosures for AI accelerators, side-channel workload verification, and TEE and attestation security to zero-knowledge proofs of inference, formal verification of security-critical hardware, threat modelling, and founding new organisations in the space. We are looking for people with experience in areas such as hardware security, chip design and verification, firmware, applied cryptography, formal methods, ML systems and networking. No prior AI safety background is required. Mentors include professors at Oxford, USC, WPI and NC State, as well as engineers from Arm, Intel, Google DeepMind and the OpenTitan project. The programme includes a stipend. Applications close on 2 August 2026 and are reviewed on a rolling basis. Apply: securefrontier.ai Know someone who would be a strong fit? Refer them here: https://airtable.com/appXP6Vad759fSHQE/pag0Pf82Rmjcz1228/form

Closing date for applications:

Contact: [email protected]

More information: https://www.securefrontier.ai/

The Amazon Cryptographic Libraries (ACL) team builds the cryptography that AWS services and a growing open-source community depend on, including AWS-LC, our FIPS-validated open-source libcrypto. As an Applied Scientist on the team, your primary focus will be formal verification: building machine-checked proofs that cryptographic implementations are correct. You will also contribute to algorithm implementation, assembly-level optimization, and the adoption of post-quantum cryptography (ML-KEM, ML-DSA, SLH-DSA). You will work alongside researchers, scientists and partner with Amazon's Automated Reasoning Group, building deep expertise in an environment where your proofs and code ship across AWS.

See link for application.

Closing date for applications:

Contact: Jake Massimo

More information: https://www.amazon.jobs/en/jobs/10476858/applied-scientist-amazon-cryptographic-libraries

Applications are invited for the post of Lecturer in Information and Cyber Security (Teaching and Research) in the Department of Computing, Security, and Mathematics.

Royal Holloway’s Faculty of Science is home to the world-renowned Information Security Group (ISG). The group is placed within the Faculty’s Department of Computing, Security, and Mathematics. The ISG has a record of outstanding research and hosts established research groups under the themes of: Cryptography, People and Society, Smart Card and IoT Security, Systems and Software Security. The ISG is now recruiting for a research and teaching lectureship in information and cyber security.

The ISG is committed to delivering excellent teaching at both undergraduate and postgraduate level. Our MSc in Information Security, the first of its kind anywhere in the world when it was launched in 1992, is accredited by The National Cyber Security Centre (NCSC) and has over 4,000 alumni worldwide. The Department has received an ACE-CSE Gold Award recognising excellence in cyber security education from the NCSC.

We welcome applications from individuals with a strong academic track record whose work relates to one or more of the ISG’s themes. We particularly welcome applications from those with industry and practice experience as a complement to their academic track record. Applicants will have, or show the potential for, a track record of excellence in both teaching and research and will demonstrate a strong trajectory in academic research that has the potential for significant impact. The successful applicant will demonstrate expertise in undergraduate and postgraduate teaching and the supervision of both undergraduate and postgraduate students.

The post is based in Egham, Surrey where the University is situated in a beautiful, leafy campus near to Windsor Great Park and within commuting distance from London. There will be also the opportunity to develop and deliver postgraduate programmes at our Central London campus, located in Bloomsbury.

Closing Date: 11 September 2026

Interview Date: 28 September to 9 October 2026

Closing date for applications:

Contact: Christian Weinert ([email protected])

More information: https://jobs.royalholloway.ac.uk/Vacancy.aspx?ref=0726-245

We present a fast implementation of Falcon (FN-DSA) signature verification with AVX-512. On a modern AMD Zen5 core, it completes a Falcon-512 verification in 3.6 microseconds, 2.6 times faster than an already optimized baseline, with comparable gains on Zen4, and consistent results across clang 21 and gcc 15.

The speedup comes from rewriting the Number-Theoretic Transform (NTT) and from vectorising all other stages of the verification algorithm. The novelty is to use a 32-bit Barrett-style representation, instead of the reference 16-bit Montgomery, and adopt Shoup-Harvey precomputed multipliers for twiddle reduction.

With all optimizations applied, hash-to-point (and specifically Keccak) is the dominant cost. We therefore propose a non-standard Falcon variant that replaces SHAKE256 with KTP256, an XOF based on KangarooTwelve with parallel squeeze. It cuts verification to 2.2 microseconds on Zen5, yielding 4.2 times over the baseline, and is of independent interest for any post-quantum scheme that uses a Keccak sponge to sample large amounts of data from a fixed seed. All code is open source.

Due to the insecurity of McEliece cryptosystems instantiated with Generalized Reed-Solomon codes, there have been several proposals of McEliece type systems that replace the permutation matrix by a matrix $M$ with larger row and column weight. In many of them, the secret key is still a GRS code. There have been successful attacks on some of those schemes with row and column weight between $1$ and $1 + R$, where $R$ is the rate of the code. The case of weight two and larger has been left open in these works. Subsequently, several authors proposed schemes with weight exactly two and with even higher weight. We provide distinguishers for the public codes appearing in these cryptosystems in the high rate regime. In addition, we give a framework to turn a good enough distinguisher into a key-recovery attack. In the case where the matrix $M$ has row and column weight $2$, we can successfully attack the scheme in the high rate regime using a cube code distinguisher.

Private Set Operations (PSO) enable mutually untrusted parties to securely compute arbitrary functions (e.g., union, intersection, and cardinality) over their private input sets, which have wide applications in many real-world scenarios. Existing PSO protocols fall short of practical deployment for several reasons. (1) \textit{Function-specific}. Real-world privacy-preserving applications often require multiple set operations within the same task, while existing solutions typically address individual functionalities (e.g., intersection or union) in isolation, making it difficult and costly to support diverse set operations in a unified and efficient manner. (2) \textit{Lacking malicious security}. As PSO is commonly employed in highly sensitive applications, it is often necessary to provide strong adversarial guarantees with malicious security. Unfortunately, most of existing works only achieve semi-honest security, which limits their practical applicability. (3) \textit{Restricted settings}. Majority of existing works focus exclusively on the two-party setting. How to extend them to the multi-party setting with malicious majority securely and efficiently is unclear. To date, designing a maliciously secure multi-party PSO (mPSO) framework that efficiently supports diverse set operations remains an open challenge.

This paper presents the \textit{first} maliciously secure mPSO framework, named UM-PSO, that supports a broad range of set operations with practical efficiency. At the core of our framework is a function-independent preprocessing phase that prepares a reusable pool of secret-shared items, which can then be leveraged to securely compute diverse set functionalities in the online phase. To achieve malicious security efficiently, we design verification mechanisms on top of SPDZ-based authenticated secret sharing, along with tailored techniques and optimizations to further improve practical performance. We implement our protocols and report concrete performance results. For a representative setting with 5 parties and a total of $2^{12}$ 128-bit items, our framework achieves an online running time of $0.627$ seconds and incurs $3.35$ MB of communication. Compared to the baselines, our framework achieves up to $51\times$ speedup and $76\times$ lower communication cost.

PRIVIDEMA project (Privacy-Preserving Identity Management for Digital Wallets and Secure Data Sharing and Processing for Cyber Threat Intelligence Data) advances the state of the art in cryptographic and Privacy-Enhancing Technologies (PETs) to enable secure, interoperable, and trustworthy data exchange across sectors, with a focus on the domains of Cyber Threat Intelligence and Digital Identity Management. This paper presents two representative real-world use-cases: (1) privacy-preserving digital identity management based on the European Digital Identity (EUDI) Wallet, and (2) privacy-preserving Cyber Threat Intelligence (CTI) sharing for Software Bill of Materials (SBOMs) and vulnerability datasets. Both use cases showcase how advanced PETs, including Fully Homomorphic Encryption (FHE), Federated Learning (FL), and Differential Privacy (DP), can be composed to protect sensitive data throughout its lifecycle while maintaining analytical and operational utility. Together, these use cases chart a practical course toward more scalable, standards-compliant, and privacy-preserving data ecosystems that align with Europe’s vision for secure and trustworthy digital services.

Internet shutdowns are used authoritarian regimes to suppress communication that end up crippling essential Internet-driven services, besides the obvious silencing of dissent. Traditional tools like VPNs and Tor, dependent on active Internet connections, falter during these blackouts. Earlier solutions, such as Dolphin, delivered meagre bandwidth and weak privacy safeguards, exposing a glaring weakness in the battle against digital oppression.

ViNET, a system that cleverly repurposes Video over LTE (ViLTE) calls, often operational during shutdowns, into a stealthy conduit for real-time Internet access. By ingeniously embedding network traffic in ViLTE packets, ViNET achieves robust 60 to 400 Kbps transmission rates, matching 2G speeds and surpassing previous solutions like Dolphin by 1500x–4000x, while ensuring end-to-end TLSbased confidentiality and integrity. This performance enables text-based web browsing with page loads in seconds to minutes, 1 MByte file downloads in ≈30s, and seamless messaging over Telegram.

ViNET also outsmarts machine learning-based traffic classifiers, achieving a remarkable false positive rate, at times as high as 40%, when attempting to detect ViNET using SOTA models. With such standout metrics, ViNET emerges as a formidable ally, offering a performant, reliable and privacy-first lifeline, in the face of Internet shutdowns.

Post-Quantum Cryptography is now in its deployment phase. Amongst the threats encountered in real-world applications is Side Channel Analysis, a cryptanalysis branch relying on the study of physical leakages from unsecured implementations. However, the FALCON post-quantum signature includes non-linear functions on real numbers, and applying the generic masking countermeasure to these functions has only been recently studied. In this work, we use convergent sequences to approximate the function and a minimax polynomial to compute the first term of the sequence. The method is applied to the computation of the inverse, the inverse square root and the square root in FALCON. A theoretical analysis of the security in the t-probing model using the NI criterion and its variants is proposed. Compared to the existing state-of-the-art which only covers the inversion for floating-point implementation, this paper is generic and works with any representation and precision for real numbers.

Torus Fully Homomorphic Encryption (TFHE) enables the homomorphic evaluation of arbitrary functions via Programmable Bootstrapping (PBS). However, the modulus switching step inherent to bootstrapping introduces a rounding error that forces the discretization of the input space, limiting the achievable precision on real-valued inputs. We propose a correction algorithm based on a first-order Taylor expansion, applied after bootstrapping, that directly mitigates this rounding error. Our method leverages the many-LUT technique to simultaneously recover encryptions of the function and its derivative within a single PBS, making the correction essentially free in terms of bootstrapping latency. We support our construction with a heuristic average-case noise analysis, validated by empirical measurements, and demonstrate a tenfold reduction in bootstrapping noise standard deviation. As a proof of concept, we apply our method to the numerical integration of ordinary differential equations under encryption.

This paper gives a modular and unified framework within which to derive fast protocols for Private Set Intersection (PSI). At the core of this is a new primitive, that we define, and that we call a Just-In-Time OPRF (JIT-OPRF). We show how to obtain PSI generically from any JIT-OPRF, and then how to obtain JIT-OPRFs from Oblivious Transfer (OT) and Vector Oblivious Linear Evaluation (VOLE). We recover as special cases PSI protocols in the literature based on these two assumptions. Our results and proofs throughout are concrete rather than asymptotic, with explicit bounds that allow one to determine security parameters to achieve a desired level (e.g.~128 bits) of proven security in practice. Our results show interesting differences in the concrete security of OT and VOLE based PSI. Beyond the practical contribution of concrete-security, our work adds conceptual simplicity to this area, and opens the door to new PSI protocols via the construction of new JIT-OPRFs.

Falcon was selected by NIST in 2022 for standardization as a post-quantum digital signature scheme. Among all standardized signature schemes, Falcon achieves the smallest signature size. Its main drawback, however, is its reliance on floating-point arithmetic, which plays a critical role in the security analysis. This reliance poses significant challenges for practical implementations: some platforms lack floating-point units, floating-point division is not constant time on many processors, and protecting floating-point computations against side-channel attacks using masking techniques is particularly difficult on embedded devices.

To address portability issues, Pornin (ePrint 2019/893) proposed an implementation of \falcon that emulates floating-point arithmetic using integer operations. While it enables deployment on a wider range of platforms, this approach incurs a substantial performance penalty compared to the native floating-point implementation.

This work studies the theory and practice of implementing Falcon's signing procedure in fixed-point arithmetic. This requires a specific analysis of the boundedness and precision of intermediate variables.

1. Our boundedness analysis revolves around a key fact: almost every intermediate variable arising during key expansion and signing is bounded by a function of four quantities that can be computed at key generation time. Our modified key generation enforces thresholds on these quantities through a light rejection step that rejects less than 50% of initial Falcon keys. This then yields sharp, unconditional bounds on all fixed-point variables. Establishing these bounds is highly nontrivial, and relies on Gaussian concentration arguments as well as on symplectic pairs, a generalization of symplecticity.

2. Our precision analysis remains, for now, partly empirical. Following a Rényi divergence argument, our main theorem proves the security of fixed-point Falcon conditioned on error bounds of certain intermediate values. These error bounds are derived empirically based on extensive experiments.

We provide a C fixed-point implementation. It is approximately a factor of two slower than the original floating-point \falcon implementation, but achieves a speedup of an order of magnitude compared to emulated floating-point implementations.