International Association
for Cryptologic Research

We present the first ciphertext-only distinguishing attack on 5-round AES and a key-recovery attack on 6-round AES for all key sizes under ASCII-encoded English-language plaintext distributions, as well as additional ciphertext-only results under uniform ASCII distributions.

Our attacks are enabled by a new analytical framework for estimating truncated differential probabilities in 5-round AES, a problem that remains largely unresolved beyond restricted configurations. Existing approaches, relying on statistical sampling, integral cryptanalysis, or differential distribution tables of super S-boxes, are primarily limited to settings with a single active diagonal in the plaintext and a single passive inverse diagonal in the ciphertext. Our method extends this line of work by providing analytical estimates over a substantially broader range of configurations.

We construct this framework by combining precise computations of MDS-level transition probabilities with a systematic enumeration of truncated differential characteristic classes. By organizing characteristics into equivalence classes defined by diagonal propagation patterns, we enable structured aggregation of probability contributions. This approach captures configurations with a single active diagonal in the plaintext and arbitrary passive inverse diagonals in the ciphertext, as well as the complementary setting involving multiple active diagonals in the plaintext and a single passive inverse diagonal in the ciphertext.

Our results are validated through independent derivations, consistency checks against prior work, and computer-aided enumeration. More broadly, the framework offers a systematic approach to truncated differential analysis of AES and potentially other AES-like SPN ciphers.

We revisit the notion of PViO [Jain-Jin, FOCS’22] – an indistinguishability obfuscation (iO) scheme for Turing machines with unbounded input length that guarantees security for pairs of machines whose equivalence can be proven in Cook’s Theory PV.

Known constructions of PViO require subexponentially-hard iO for circuits. We give the first construction based on polynomially-hard iO and other standard assumptions. We further show how to replace iO with EFiO – an efficiently falsifiable variant, thus obtaining a construction based on efficiently falsifiable assumptions.

Central to our result is a new twist to the celebrated punctured programming technique [Sahai-Waters, STOC’14], where one can program an obfuscated probabilistic function on its entire input domain in one shot instead of an input-by-input manner. Our key ingredient is the notion of function secret sharing [Boyle-Gilboa-Ishai, EUROCRYPT’15]. We further show the versatility of our technique by removing the use of complexity-leveraging in two applications of iO: unleveled fully homomorphic encryption, and adaptively-sound succinct non-interactive arguments for “trapdoor” languages.

Non-native arithmetic is a key bottleneck in SNARK design. It introduces large overheads, and application designers often have to avoid it through the use of non-standard arithmetization friendly hash-functions or other means like elliptic curve cycles. Besides performance concerns, non-native circuit arithmetization is also a major cause of implementation errors. In a collection of 27 critical bugs in real world ZK systems (0xPARC/zkbugtracker), 9 were related to non-native arithmetization. We tackle these challenges by constructing a \emph{minimal overhead} SNARK for integer computation that generically handles non-native arithmetic. We follow the recipe of Zaratan (PKC 26), which proves an integer relation such as $a\cdot b = c + u\cdot m$ by fingerprinting---reducing it to the same relation but over a randomly sampled prime field. Realizing this recipe requires an integer mod-PCS that commits to integer polynomials and opens their evaluations modulo a random prime, which is crucially chosen after the underlying PCS's setup and commitment phases. Our central contribution is \emph{Limber}, the first practical integer mod-PCS construction that asymptotically has $o(1)$ multiplicative commitment overhead and can be instantiated with any standard field polynomial commitment scheme, including ones over small fields. Combining Limber with a PIOP for integer R1CS over the random prime yields our SNARK. We demonstrate its practicality by implementing our scheme and showing that we can prove RSA arithmetic more than $67\times$ faster than prior circuit-based approaches.

MAYO is a signature scheme based on the Unbalanced Oil and Vinegar (UOV) construction and a third round candidate in the NIST standardization process for additional post-quantum signature schemes. We present a memory-optimized pure- C implementation of MAYO signature verification that reduces RAM consumption by 97–99% compared to the reference implementation provided by the PQM4 project [KPR+] at the cost of increasing runtime by 50–200% and while maintaining code size. This reduction finally enables verifying MAYO signatures on smart cards and small microcontrollers with only a few kilobytes of RAM. We achieve it through three coupled design choices: a) we expand the public key vector-by-vector on the fly rather than all at once at the start; b) we reorder the calculation of the matrix product SPS so that each vector of P is used exactly once, which avoids repeated expansions; and c) we add precomputed multiples of each P-vector directly onto the result instead of accumulating P-vectors before multiplication. We provide results using the PQM4 framework for all parameter sets listed in the specification and supported by PQM4 on our platform, including three main parameter sets MAYO{1,2,3}. This enables direct comparison with other post-quantum digital signature schemes. Further parameter sets not supported by PQM4, including the fourth main parameter set MAYO5, are measured on our own framework, which supports key and signature generation on the host. Our results for non-standard MAYO parameter sets offer insights into the performance and scalability of the proposed approach that may inform ongoing standardization efforts.

Rotational-XOR (RX) cryptanalysis extends rotational cryptanalysis by combining rotational relations with XOR translations, enabling the analysis of symmetric-key primitives even in the presence of symmetry-breaking constants. Existing analyses of RX characteristics, however, typically rely on independence assumptions when estimating characteristic probabilities, which may lead to inaccurate probability evaluations and even incompatible characteristics.

In this paper, we introduce the first application of the geometric approach to RX cryptanalysis. Inspired by the quasidifferential framework of Beyne and Rijmen, we develop an algebraic representation of RX characteristics and establish exact formulas expressing fixed-key RX characteristic probabilities in terms of rotational-quasidifferential trails. As a result, RX characteristics can be analyzed without relying on round-independence assumptions. By incorporating the key schedule into the state space, we further derive an exact expression for the Expected Rotational-XOR Probability (ERXP), the RX analogue of the Expected Differential Probability (EDP).

We apply the framework to the AND-RX ciphers SIMON and SIMECK. In particular, we experimentally validate the theoretical predictions of the framework through the fixed-key analysis of a previously known RX characteristic for SIMECK32/64. We also revisit incompatible RX characteristics of SIMECK48/96 and SIMECK64/128, identifying additional constraints that lead to incompatibility. Finally, we reanalyze rotational-XOR differential rectangle attacks on SIMECK48/96 and obtain corrected estimates of the corresponding weak-key classes. These results demonstrate that the proposed framework provides an effective tool for the exact analysis of RX cryptanalysis and establishes a foundation for the study of rotational cryptanalytic techniques within the geometric approach.

We are recruiting PhD students, postdoctoral researchers, and research interns to join a new research group advised by Dr. Tiantian Gong at Nanyang Technological University (NTU Singapore).

• PhD students: Fall 2027 intake.
• Postdoctoral researchers and research assistants: Applications are considered year-round, with flexible start dates.

Our research aims to build the theoretical foundations and practical systems needed for secure and privacy-preserving distributed computation. Current interests include:

• Foundations of secure computation, including new cryptographic primitives, new perspectives on classical primitives, and fundamental lower and upper bounds.
• Secure computation for emerging computer systems, including strengthening privacy guarantees and mitigating harmful collective behavior in agentic AI, blockchains, cloud computing, and other distributed systems.

Applicants with backgrounds in cryptography, theoretical computer science, security, distributed systems, mathematics, or related areas are welcome.

For application instructions and further details, please visit:
https://www.ttiangong.com/openings

Closing date for applications:

Contact: Tiantian Gong ([email protected])

We are hiring two postdoctoral researchers at Boston University to work at the intersection of systems and applied cryptography.

About the role. We are building secure and scalable computing infrastructure using secure multiparty computation (MPC), fully homomorphic encryption (FHE), and trusted execution environments (TEEs). We seek candidates who combine strong foundations with hands-on systems engineering and want to help build an open-source system for deploying secure data workflows in the cloud. This NSF-funded project (https://www.nsf.gov/awardsearch/show-award/?AWD_ID=2613424) builds upon years of research by the PIs, and we already have an exciting set of real use cases from stakeholders eager to adopt the system.

The positions are initially offered for 1 year, with possibility of renewal for 1 additional year. The start date can be September 2026, January 2027, or September 2027.

Responsibilities

• Collaborate with faculty members, PhD students, and our academic and industry partners
• Contribute to research spanning systems, cryptography, data analytics, and machine learning
• Design and implement cryptographic protocols and full-stack software solutions
• Mentor graduate and undergraduate students
• Participate in a vibrant, interdisciplinary research environment

Requirements

• PhD in Computer Science, Computer Engineering, or closely related field
• Experience with MPC, FHE, TEEs, or related technologies
• Excellent programming skills in one or more of the following languages: C++, Rust, or Go
• Strong academic record with publications and presentations at top-tier security and/or systems venues
• (Optional) Experience with open-source software development practices and/or contributions to open-source projects

Closing date for applications:

Contact: Interested candidates should email Vasia Kalavri ([email protected]), Mayank Varia ([email protected]), and John Liagouris ([email protected]) with a detailed CV and a 2-page research statement. Applications will be reviewed on a rolling basis starting August 15 and until the positions are filled.

Recent works have highlighted the risk of deterministic memory encryption, as used for example in AMD SEV. In the so-called ciphertext side-channel attack, an adversary leaks sensitive information, such as cryptographic keys, from an encrypted VM by observing changes in the encrypted contents of the memory. To date, countermeasures have been quite restricted in scope and have not addressed the root cause. Alternatively, some studies suggest adding freshness to memory encryption. However, this approach is considered impractical due to the performance overhead introduced by fetching such freshness values for every single memory access.

In this work, we propose an efficient approach for eliminating most of the overhead of fetching the aforementioned freshness. Our core idea is to repurpose the ECC memory area to efficiently store random nonces or counters. We propose a range of implementations with varying trade-offs between security guarantees and performance overhead, and demonstrate that we can achieve a solid baseline security even with small random nonces. By leaving a portion of ECC memory unused, we show that it is possible to efficiently integrate protection mechanisms such as memory integrity and memory tagging, while limiting the overall performance overhead to approximately 2%.

Private Function Evaluation (PFE) facilitates the secure computation of private functions on private inputs in an oblivious manner, ensuring that both the function and the inputs remain confidential throughout the entire computational process. PFE has garnered significant attention due to its critical applications in various domains, such as privacy-preserving healthcare systems and privacy-preserving credit checks, where safeguarding the confidentiality of the function itself is of paramount importance.

However, despite its broad applicability, existing PFE schemes often exhibit inefficiencies, even in relatively straightforward scenarios such as the evaluation of lookup tables. To mitigate these limitations, we propose a novel variant of PFE, termed Preprocessed Private Function Evaluation (PPFE), which leverages preprocessing techniques to significantly enhance the efficiency of online computations. Within this framework, we introduce a specialized construction tailored specifically for lookup table operations, achieving sublinear complexity during the online computation phase.

The efficacy of the proposed approach is demonstrated through experimental evaluations. For a lookup table of size $2^{24}$, the online computation time required to process a single query is about 3 milliseconds, representing a performance improvement of more than an order of magnitude compared to existing results. Furthermore, the proposed scheme exhibits strong scalability, effectively handling thousands of adaptive queries within the same framework.

The McEliece code-based cryptosystem, utilizing binary Goppa codes, is the earliest public-key encryption scheme that is still considered post-quantum secure. We present a simple, classical quasipolynomial-time distinguisher for Goppa--McEliece in the asymptotic "Classic McEliece" regime: for code length $n$, extension degree $m=\Theta(\log n)$, Goppa degree $t=\Theta(n/\log n)$, and public-code dimension $k=\Theta(n)$, the algorithm runs in time $n^{{\mathcal O}(\log n)}$ and distinguishes the McEliece public key from the uniform distribution over $\mathbb F_2^{k\times n}$ with advantage $1-o(1)$. The distinguisher is not merely asymptotic: it applies to all Classic McEliece parameter sets considered in the NIST process and yields improved (though not yet practical) concrete attack estimates.

Our distinguishing attack originated from a failed attempt to construct doubly efficient private information retrieval (PIR) protocols from algebraic locally decodable codes, and can be intuitively explained from the PIR perspective. We extend this provable algorithm to a heuristic $n^{{\mathcal O}(\log n)}$-time ciphertext-decryption attack that recovers the message from a noisy codeword.

Selfish mining undermines incentive compatibility of proof-of-work blockchains, letting a miner earn disproportionate rewards at a hashrate lower than the majority threshold. A decade of work has asked whether a strategy is profitable, however, far less is understood about when it becomes profitable. Timing is critical since selfish mining operates at a loss before it turns a profit, typically requiring tens of weeks to break even in the classic case.

In this paper, we present a holistic study of the time-to-profitability (TTP) of existing selfish mining strategies structured around four contributions. First, in the single-attacker setting, we characterize TTP across the full strategy space and find that TTP-minimizing and profit-maximizing strategies frequently diverge, making attack horizon a critical metric. In particular, under realistic fee dynamics, the use of incentive transactions to recruit honest-but-rational miners enable incentivized strategies to reach profitability up to $15\times$ faster than classic selfish mining at the same hash rate. Second, we explore TTP for the first time in the multi-attacker setting, showing that the difference in strategies between opposing attackers has a dramatic impact on joint-profitability lag. Third, we generalize intermittent selfish mining by exploring temporal composition over the full strategy space and show that its purported benefits are largely overstated. That is, alternating strategies rarely outperform the best static strategy in terms of either TTP or long-term profits. Finally, and building off our earlier findings, we explore adaptive, state-conditioned strategy selection at the difficulty adjustment period (DAP) level. We compare a general-purpose LLM agent against a fixed decision-tree selector, both implementing the same selection criteria. We find that both selectors reliably identify profit-maximizing strategies from observed network conditions, at a low operating cost, lowering the expertise barrier to exploiting adaptive selfish mining.

Lattice-based cryptography offers a promising direction for transitioning Bitcoin toward post-quantum security, serving as a secure replacement for currently deployed discrete logarithm signatures. The primary advantages of lattice-based signature schemes include the compact combined size of signatures and public keys (e.g., in some cases below 1.6 KB), the robustness of underlying security assumptions, and an algebraic structure that, while not yet yielding practical constructions, holds potential for advanced functionality such as threshold and multi-signatures, compared to hash-based constructions. In this paper, we present a self-contained review of three lattice-based signature schemes, with Bitcoin's post-quantum transition as the motivating application: Dilithium, Falcon, and Hawk. The latter was recently withdrawn from NIST standardization following a key-recovery attack; we retain it because its design paradigm remains of independent interest. For each protocol, we detail the high-level intuition, the necessary technical preliminaries, low-level mechanics, performance, and security analysis. We then assess the deployment aspects relevant to Bitcoin: the on-chain footprint, determined by the combined public-key and signature size and compared against hash-based alternatives; the target security level for outputs that may remain unspent for decades; implementation constraints, such as Falcon's floating-point signing; and wallet key derivation.

No prior exposure to lattice-based cryptography is assumed: all the required background is developed within the document.

Threshold Decyption (TD) enables a set of decryptors, each holding a secret key share, to collaboratively decrypt ciphertexts. Lots of TD schemes consider only CPA security under static corruptions, but a stronger and more reasonable security notion in practice is CCA security under adaptive corruptions, which enhances the ability of adversaries to obtain partial decryptions of chosen ciphertexts and adaptively corrupt decryptors during the protocol. There are many works on TD from lattices, seeking for post-quantum security. However, none of these TD schemes achieves both adaptive security (i.e., security under adaptive corruptions) and polynomially-bounded modulus in lattices. Given the fact that polynomial modulus provides more post-quantum confidence than super-poly modulus, Devevey et al. [PKC 2021] left constructing an adaptively secure TD with polynomial modulus from lattices as an open problem.

In this paper, we resolve the above open problem by proposing three adaptively secure (t,N)-TD schemes based on the LWE assumption, all with polynomial modulus under appropriate settings. - TD0: an adaptively CPA-secure scheme in the asynchronous setting in the standard model, whose modulus is polynomial for small number of users N. - TD1: an adaptively CCA-secure scheme in the asynchronous setting in the standard model, whose modulus is polynomial for small N and bounded decryption queries. - TD2: an adaptively CCA-secure scheme in the synchronous setting in the random oracle (RO) model, whose modulus is polynomial for bounded decryption queries.

The main technical challenge is to limit the leakage of secret key shares arising from decryption queries, while keeping the modulus a polynomial. To overcome this barrier, we develop a refined polynomial noise flooding technique based on a detailed min-entropy analysis of secret shares conditioned on linear matrix hints, leveraging recent advances on Matrix-Hint LWE. Based on our new technique, we build TD1 using the replicated secret sharing (RSS) scheme, hence supporting only small N. To enable larger N, we design TD2 using the Shamir secret sharing scheme, in which we further integrate our new technique with the zero-sum masking technique [Katsumata et al., CRYPTO 2024] to restrict the secret key leakage. To the best of our knowledge, our TD1 and TD2 are the first non-interactive lattice-based threshold decryption schemes achieving adaptive CCA security and polynomial modulus, simultaneously. Moreover, they achieve the strongest notion of adaptive CCA security among those compared in [Brzuska et al., PKC 2026]. We further establish robustness for both TD0 and TD1 via publicly verifiable partial decryptions, ensuring that the combination either outputs the correct plaintext or aborts.

In multi-epoch deployments, private set union~(PSU) operates in an adaptive-input loop: after observing the union at epoch $t$, the receiver may choose its next input for epoch $t+1$. Liu et al.~(EUROCRYPT 2026) formalized this multi-epoch adaptive-input setting for updatable private set intersection and provided an instantiation, but their framework does not extend to PSU. Meanwhile, existing PSU protocols are analyzed only in the single-shot setting. We present the first semi-honest, adaptive-input-secure updatable PSU protocol supporting two-sided add/delete updates in the multi-epoch adaptive-input setting of Liu et al. Our construction is built around a new primitive, the updatable oblivious key-value store (uOKVS). Its defining rule, distributional erasure, requires each refresh to be distributed identically to a fresh static encoding of the current key set, rather than merely indistinguishably. We realize uOKVS by combining the Band-OKVS of Bienstock et al. with a PRF under a persistent key. The resulting refresh reuses a cached factorization, so its per-epoch encoding cost scales linearly rather than quadratically in the band width $w$. Building on this layer, we obtain a multi-epoch PSU protocol whose leakage is limited to set and update cardinalities, even against adaptive-input adversaries. We implement the protocol and benchmark it in a single-threaded setting. At $n = 2^{20}$ with per-epoch updates $\Delta = 55$ over $10$ epochs, the online per-epoch wall-clock time is $1.41$ s on LAN, yielding a $30.9\times$--$98.9\times$ speedup over prior static PSU protocols re-executed from scratch at each epoch.

Event date: 6 May to 7 May 2027
Submission deadline: 30 November 2026
Notification: 11 January 2027

Event date: 16 September to 18 September 2026

HPI is recognized as one of the leading university institutes for computer science (www.hpi.de). Our goal is to strengthen Europe's digital sovereignty with excellent research and practice-oriented teaching in computer science. At HPI, we are convinced that excellence is created when knowledge from different disciplines is collaboratively combined to create responsible and pioneering solutions for the future.

In our research clusters "Systems," "Data and AI," "Foundations," "Digital Health," "Security," and "Business and Society" researchers from various disciplines work together on topics relevant to solving the challenges facing society. The Digital Engineering Faculty of the University of Potsdam and HPI offers a computer science engineering degree program that is unique in Germany.

In the course of its strong growth, the Hasso Plattner Institute is offering a PhD position in the research group Cybersecurity - High-Assurance Systems, led by Prof. Dr. Chitchanok Chuengsatiansup, which investigates mechanisms to safeguard our digital information with the focus on cryptographic engineering, side-channel analysis, implementation optimization, and post-quantum cryptography.

The application deadline is 20 September 2026.

For further information and how to apply, please visit:
https://jobs.plattnerfoundation.org/HPI/job/Potsdam-PhD-position-%28fmx%29-High-Assurance-Systems-14482/1362941055/

Closing date for applications:

Contact: Chitchanok Chuengsatiansup

More information: https://jobs.plattnerfoundation.org/HPI/job/Potsdam-PhD-position-%28fmx%29-High-Assurance-Systems-14482/1362941055/

We are looking for a PhD student to join the Crypto Team and Security Group at Chalmers with Christoph Egger as main supervisor. The position is fully funded for 5 years and comes with 20% teaching duties in the department. The Crypto Team currently has 2 faculty members, one Post-Doc and 4 PhD students and is embedded in the security group that captures a wide range of topics.

Depending on the interests of the applicant, possible research topics include fine-grained and bounded space cryptography, realization of idealized models, relationship between cryptographic notions, and similar topics in foundational cryptography. Alternatively, a focus on formal methods for Cryptography is possible. One or two extended research visits are encouraged during the doctoral study. Applicants should have a strong interest in the mathematical analysis of algorithms in general and cryptography in particular. A master's degree in mathematics, computer science, or a related discipline is required. The working language in the department is English, and applicants are expected to be fluent both in written and spoken English. Swedish courses are available for interested students.

Applications are due August 14 (or until filled)

Closing date for applications:

Contact: Christoph Egger: [email protected]

More information: https://www.chalmers.se/om-chalmers/arbeta-hos-oss/lediga-tjanster/?rmpage=apply&rmjob=15017

We are looking for outstanding PhD students and postdoctoral researchers to join the cryptography group led by Dr. Michael Reichle at INSAIT in Sofia, Bulgaria. INSAIT is already a top research institute in AI and Theory and you have the opportunity to help shape INSAIT into a world-class research institute for Cryptography and Security. Sofia offers great gastronomy, an affordable cost of living and quick access to nature, with many parks and Vitosha Mountain just outside the city.

Topics. Research areas include post-quantum cryptography, protocols for signatures and encryption, and zero-knowledge proofs. Applicants with interests in related areas of cryptography are also encouraged to apply.

PhD applicants. You should hold (or be close to completing) a Master's degree and have a strong background in cryptography, theoretical computer science, mathematics, or a related field. You will be co-supervised by Mariana Raykova under the Google PhD fellowship program.

Postdoctoral applicants. You should hold (or be close to completing) a PhD in a related field. A strong research record, ideally including publications at IACR conferences or leading security venues, is preferred.

The positions are well funded and come with no teaching obligations. The start date is flexible, with positions available from October 2026 onward. Applications will be considered on a rolling basis until the positions are filled.

Closing date for applications:

Contact: Please apply via https://insait.ai/information-security-and-cryptography. For questions, please contact Michael Reichle ([email protected]).

More information: https://insait.ai/information-security-and-cryptography

The Department of Computing at The Hong Kong Polytechnic University (PolyU) is offering multiple fully funded PhD positions in the broad area of cryptography and cybersecurity. Successful candidates will work with Dr. Yu Shen (https://shenyu-official.icu/) and conduct research in areas including, but not limited to:

• Blockchain security and privacy
• Distributed computing and consensus
• Secure multi-party computation, cryptographic protocols, and game theory
• Quantum cryptography

The PhD positions are fully funded for 3–4 years, with a competitive monthly stipend. Detailed information on scholarships and tuition fees is available at: https://www.polyu.edu.hk/cee/prospective-students/research-postgraduate-programme/scholarships-and-tuition-fee/

Eligibility Requirements

Applicants should have:

• A strong background in cryptography, cybersecurity, theoretical computer science, or related areas; and
• Fulfilled the general PhD admission requirements of PolyU:
https://www.polyu.edu.hk/study/pg/research-postgraduate

Application Procedure

Interested candidates are invited to send the following materials to Dr. Yu Shen at [email protected]:

• Curriculum vitae (CV)
• Academic transcripts
• A brief statement describing research interests and relevant experience

Applications will be reviewed on a rolling basis until the positions are filled. We welcome highly motivated candidates with a strong interest in advancing the foundations and applications of modern cryptography to apply.

Closing date for applications:

Contact: Yu Shen ([email protected])