International Association
for Cryptologic Research

We study the communication complexity of information-theoretic asynchronous multiparty computation (AMPC) with optimal resilience $n=3t+1$ and malicious security. In this setting, the only known result with linear communication per gate is due to Goyal, Liu-Zhang, and Song [CRYPTO ’24]. However, their construction incurs a large communication overhead of $\Omega(n^{14})$ elements that is independent of the circuit size, rendering their result only of theoretical interest. By additionally assuming a random oracle, Bandarupalli et al. [CCS ’25] reduce the communication overhead to $\mathcal{O}(n^3)$ while maintaining the linear communication per gate, at the cost of only achieving malicious security with fairness.

In this work, we remove the random oracle assumption and design an information-theoretic AMPC protocol that achieves malicious security with abort. The communication complexity of our construction is $\mathcal{O}(|C|n + Dn^2 + n^3)$ field elements for an arithmetic circuit of size $|C|$ and depth $D$, assuming a functionality for Agreement on Common Set (ACS).

Our main technical contribution is a novel verification mechanism with the following guarantee: whenever verification succeeds, there exists a subset of at least $t+1$ honest parties whose local computations are mutually consistent, and the final output is correct with respect to their computation. In contrast to prior approaches that require all honest parties to hold consistent states and execute identical computations before verification, our mechanism tolerates inconsistencies among honest parties while still ensuring that the verified computation is correct for at least one such honest subset, if the verification succeeds.

Distributed monotone-policy encryption augments public-key encryption with fine-grained decryption capabilities in a trustless manner. In this scheme, users independently generate a public/private key-pair and post their public key to a public-key directory. Thereafter, anyone can encrypt a message to a set of public keys together with an access policy. Any set of users that satisfies the access policy can decrypt the ciphertext while the message should remain computationally hidden to any unsatisfying set of users. The primary efficiency requirement is succinctness: namely, the size of the ciphertext should be sublinear (or polylogarithmic) in the description length of the policy. Distributed monotone-policy encryption directly generalizes recent trustless cryptographic notions like threshold encryption with silent setup and distributed broadcast encryption.

In this work, we show how to construct distributed monotone-policy encryption for Boolean formulas in disjunctive normal form (DNF formulas) that supports an unbounded number of users. Security relies on the decomposed learning with errors (LWE) assumption, a simple and falsifiable lattice assumption, in the random oracle model. Previously, such a scheme was only known from plain witness encryption in the random oracle model. Our scheme has a transparent setup and the ciphertext size is $\mathsf{poly}(\lambda, \log N)$, where $N$ is the number of variables in the DNF formula.

We propose a novel notion of Two-Factor Authenticated Key Exchange (TFA-KE), defined in the universal composability model (UC), which extends asymmetric PAKE (aPAKE) by a 2nd authentication factor in the form of a $t$-bit one-time code computed by a personal device based on a clock or counter. Our notion strengthens the security of standard integration of aPAKE with short authentication codes by additionally slowing down offline brute-force password search in case of server compromise by a factor of $2^t$. In other words, our TFA-KE notion uses $t$-bit authentication codes not only to improve on-line security of password authentication, as is the current practice, but also to strengthen password security on server corruption, whilst retaining the ability of aPAKE to avoid the common but deplorable practice of relying on "secure-channel" encryption for password protection.

We show a generic framework for implementing TFA-KE, with two efficient instantiations. Our key enabling tool is a tight one-way function (TOWF) with an algebraic structure that allows for its evaluation on a secret-shared input. We initiate the study of such functions, and we provide two proposals which we show to be tightly one-way in the Generic Group Model. Tightness means that a function evaluation on an input sampled from domain $\mathcal{X}$ takes $\Omega(|\mathcal{X}|)$ time to invert, which in our application implies that offline password search attacks are slowed to $\Omega(|D|\cdot 2^t)$ for passwords sampled from dictionary $D$.

We build a leveled fully homomorphic encryption (FHE) scheme that achieves IND-CCA1 security under the learning with errors (LWE) assumption in the standard model. It is the first scheme of this kind that does not rely on succinct non-interactive arguments of knowledge (SNARK) to obtain security against active adversaries. Instead, we use the gadget lattice trapdoors introduced by Micciancio and Peikert [Eurocrypt 2012] in combination with a dual version of the GSW FHE scheme [Gentry, Sahai, Waters, Crypto 2013]. Instead of proving the integrity of a ciphertext with a SNARK, we use the gadget trapdoor to recover the LWE noise of a ciphertext. This ensures IND-CCA1 security because it allows us to determine whether a ciphertext queried to the decryption oracle will reveal information about the secret key to an adversary.

Our scheme is fully compact, multi-hop and requires very few changes to the original GSW scheme beyond the key generation and decryption algorithm. In particular, the homomorphic operations remain unchanged. We also follow ideas from Bourse et al. [Crypto 2016] to obtain IND-CPA-D security almost for free, without requiring correctness.

This paper introduces a novel set of code-based protocols to demonstrate algebraic relationships in zero knowledge. Specifically, we present a comprehensive collection of secure arguments of knowledge for verifying additive and multiplicative relationships between syndrome-committed secrets, including matrix products, which enable us to construct a generic arithmetic circuit framework. We leverage these primitives to formulate a rich variety of privacy-oriented primitives, such as a post-quantum range proof, lookup argument, and verifiable shuffle protocols. These contributions provide the necessary ingredients to transition advanced confidential designs, such as cryptocurrencies, into the post-quantum code-based setting.

We present multi-query attacks on key-then-hash (KTH) functions in the blinded keyed hash model that achieve an advantage growing quadratically in the number of queries up to a small constant factor from the information-theoretic upper bound. We introduce three families of attacks. Catch attacks exploit the group structure of the digest space and achieve deterministic success with $2\sqrt{\varepsilon^{-1}}$ queries. Group attacks embed high-probability differentials into subgroups of the message space of quadratic advantage. Translation attacks exploit offset-invariance to linearly scale any existing attack. Our attacks apply in two concrete settings: with $\Delta$ fixed to $0$, they target the compression phase of farfalle-based primitives such as Xoofff, and with $\Delta$ as a free parameter, they target deck-based wide block cipher constructions such as the double-decker. We connect optimal query set construction to results in additive combinatorics and generalize our results to concatenated KTH functions. Experiments on NH and Xoodoo[3] show our attacks reach an advantage within a factor $2^{4}$ of the theoretical bound. Our analysis reveals that for bit-sliced permutations with degree-2 round functions, solution set overlap is inherent, limiting but not preventing the attacker from approaching the bound. Our experiments highlight that trail cores with a large number of active columns in the last round are particularly dangerous for KTH functions, introducing a new criterion for the design of permutations used in such constructions.

For any key-then-hash function, there is no security gap between key recovery and forgery. The expected cost of recovering the key given differential-based forgery, in the information-theoretic setting, is logarithmic in the number of solutions to the underlying differential equation. The notion of weak-key classes as defined by Handschuh and Preneel in their CRYPTO 2008 paper does not apply to key-then-hash functions. Every key is equally vulnerable, and the attack complexity is entirely determined by the universality bound. This applies to four out of six keyed hash function families studied in their paper, namely, NH, NMH, WH and Square Hash. In this paper, we revisit the analysis done in 2008 to NH through the lens of the key-then-hash framework. We are able to prove that the properties attributed to the class of weak keys in NH are actually intrinsic to the whole key space. Furthermore, this result can be generalized to any key-then-hash function. We demonstrate this generality by applying our framework to key-then-hash constructions instantiated with Xoodoo[3] and Square Hash, and show that an efficient key recovery is possible.

In this paper, we present RISQrypt, the first unified architecture in the literature that implements Kyber (ML-KEM) and Dilithium (ML-DSA), standardized lattice-based Post-Quantum Cryptography (PQC) algorithms, with masking. RISQrypt is a hardware–software co-design framework that integrates dedicated cryptographic accelerators to speed up polynomial arithmetic, hashing, and mask-conversion operations, the latter being one of the primary bottlenecks in masked implementations of lattice-based PQC. Our design achieves low latency while providing both theoretical and practical side-channel security, as validated through experimental evaluation. Specifically, the masked decapsulation of Kyber768 requires 109K clock cycles, while masked signing of Dilithium3 requires 1230K clock cycles on average. These results demonstrate 11.3x time-performance improvement over existing masked implementations. Our performance results for unprotected functions also outperform the existing work by up to an order of magnitude. In addition, prior designs are more limited in scope, generally supporting only a single scheme and lacking the unified, crypto-agile framework that enables support for both Kyber and Dilithium as in our architecture. Leveraging the HW/SW co-design approach, our proposed architecture can be readily extended to other PQC standards such as Falcon and SPHINCS+, as well as to algorithms sharing similar computational building blocks, through firmware reprogramming.

The Fischlin transform yields non-interactive zero-knowledge proofs with straight-line extractability in the classical random oracle model. This is done by forcing a prover to generate multiple accepting transcripts through a proof-of-work mechanism. Whether the Fischlin transform is straight-line extractable against quantum adversaries has remained open due to the difficulty of reasoning about the likelihood of query transcripts in the quantum-accessible random oracle model (QROM), even when using the compressed oracle methodology. In this work, we prove that the Fischlin transform remains straight-line extractable in the QROM, via an extractor based on the compressed oracle. This establishes the post-quantum security of the Fischlin transform, providing a post-quantum straight-line extractable NIZK alternative to Pass’ transform with smaller proof size. Our techniques include tail bounds for sums of independent random variables and for martingales as well as symmetrization, query amplitude and quantum union bound arguments.

We introduce Bolt, a new Multilinear Polynomial Commitment Scheme (MLPCS) designed for high-performance SNARKs over binary fields. Bolt is geared towards SNARKs for large computations, in which prover speed is paramount but one can afford slightly larger proofs. The construction is based on the code-switching paradigm; our core technical contribution is a new "proof-system friendly" error-correcting code with extremely efficient encoding both asymptotically and concretely. Bolt offers a significantly faster prover than prior works, while maintaining a moderately larger, yet still reasonable, proof size.

Theoretically, Bolt achieves a commitment time of approximately $(3+\varepsilon) \cdot N$ field additions plus a Merkle Tree hash computation of size $(1+\varepsilon) \cdot N$ field elements, where $N$ is the size of the multilinear polynomial and $\varepsilon>0$ is arbitrarily small. The prior state-of-the-art, Blaze (Brehm et al., Eurocrypt 2025) used more than $8N$ field ops and a $4N$ size Merkle hash.

Concretely, our implementation demonstrates that these asymptotic gains translate into substantial real-world speedups. Our benchmarks show that for $N=2^{30}$ over a $32$-bit field, Bolt achieves a commitment time roughly $3 \times$ faster than Reed-Solomon based schemes, albeit with a moderately larger proof. Bolt also offers better commitment time and proof size than recent linear-time schemes. For example, its commitment time is about $1.34 \times$ faster than Brakedown (Golovnev et al., Crypto 2023) and with a $2 \times$ shorter proof.

This paper investigates hash-function constructions derived from lightweight block ciphers, that are suitable for evaluation in fully homomorphic encryption (FHE) settings. We focus on PRINCEv2, a 64-bit lightweight block cipher with 128-bit keys and low algebraic complexity, which is particularly amenable to FHE evaluation. However, the small block size of such ciphers limits the applicability of standard hash-function transforms. Indeed, achieving 128-bit collision resistance in the (n, 2n) setting, i.e., with 64-bit blocks, requires a quadruple-block-length (QBL) compression function, for which no generic construction is known. In this work, we propose a concrete QBL compression construction tailored to PRINCEv2 and analyze its collision resistance. Candidate QBL designs inspired from existing double-block-length constructions are also outlined. As a further contribution, we describe a carefully optimized homomorphic circuit design for PRINCEv2. The resulting implementation outperforms previous works in both operation counts and computational depth. Experimental timings demonstrate the practical feasibility of evaluating the corresponding hash constructions under FHE with low latency, while providing cryptographically small failure probability.

Event date: 6 October to 9 October 2026
Submission deadline: 15 May 2026
Notification: 23 June 2026

Event date: 23 November to 25 November 2026
Submission deadline: 10 June 2026
Notification: 10 August 2026

Event date: 9 May to 10 May 2026
Submission deadline: 15 March 2026
Notification: 10 April 2026

Event date: 9 May 2026
Submission deadline: 6 March 2026
Notification: 20 March 2026

Event date: 5 May to 8 May 2026

The Computer Security and Industrial Cryptography (COSIC) group belongs to the Electrical Engineering Department at the KU Leuven. The COSIC team has about 100 researchers, including 9 professors, 6 researcher managers/experts, 20 postdoctoral researchers, 60 PhD students, 8 visitors, and 7 support staff.

We are looking for a motivated candidate for a PhD position on practical fully homomorphic encryption. The student will be a part of the FINAL project team. The research will include the design and implementation of novel techniques and improvements for the FINAL scheme using advanced cryptographic techniques such as MPC, FHE, and Zero Knowledge Proofs with the explicit intention for industrial deployment.

Responsibilities:

Design and implement efficient building blocks and protocols for the FINAL scheme.

Improve and optimize implementations for industrial deployment

Plan, design, and evaluate test cases with industry stakeholders

More info and how to apply
https://www.esat.kuleuven.be/cosic/vacancies/

Closing date for applications:

Contact: [email protected]

More information: https://www.esat.kuleuven.be/cosic/vacancies/

This is an urgent call for interested applicants. A funded Ph.D. student position is available for Fall 2026 to work on different aspects of Cryptographic Engineering in the Bellini College at USF (Tampa, FL) with Dr. Mehran Mozaffari Kermani.

We need an applicant who already does have Master’s in Computer Engineering or Computer Science with hardware background (do not contact if you have not obtained a Master’s degree, this position is not for direct Bachelor’s to Ph.D.)

Please send email me your updated CV (including list of publications, language test marks, and references), transcripts for B.Sc. and M.Sc., and a statement of interest to: mehran2 (at) usf.edu as soon as possible. NOTE: The successful candidate will be asked to apply formally very soon to the college, so all the material has to be ready. We do not require GRE.

Closing date for applications:

Contact: Prof. Mehran Mozaffari Kermani

A position for a postdoctoral researcher in isogeny-based cryptography is available in the research group led by Prof. Lorenz Panny in the Department of Mathematics at TUM, located at the Garching campus.

The group was established in 2023 and primarily focuses on mathematical and algorithmic aspects of post-quantum cryptography, ranging from constructive to cryptanalytic considerations. At this time, the group consists of the group leader and two PhD students (one at TUM, one external).

This position is part of the DFG-funded CRYPTIQ project, a cooperation with Prof. Christophe Petit (Université libre de Bruxelles, Belgium). The position is limited to about 2 years (depending on the start date), with a salary following the German TV-L scale for civil servants (level E13). Funding for attending academic events is available.

Requirements for the position include a doctoral degree in a suitable field (mathematics or computer science), as well as solid English skills in speaking and writing (knowledge of German is not needed). The ideal candidate has previously completed novel research projects on topics in (or related to) isogeny-based cryptography, and has built an excellent academic track record in the process.

Applications should include:

• Detailed academic CV.
• (Link to) applicant's PhD thesis.
• Information about possible/desired start dates.
• Name(s) and email address(es) of one or multiple professors willing to provide a letter of recommendation directly to us upon request. (There is no need to send a letter immediately as part of the application.)

Applications will be reviewed starting March 1 until the position is filled. Please send your application files to [email protected] with a meaningful subject line. Feel free to contact the same address for any questions about the position.

Closing date for applications:

Contact: Lorenz Panny <[email protected]>

The Department of Information Security and Communication Technology invites applications for a PhD Research Fellow position in Post-Quantum Cryptography for Privacy Preserving Protocols. The successful candidate will be offered a 4‑year appointment that includes teaching responsibilities.

The selected candidate will conduct research in Post-Quantum Cryptography with a particular focus on privacy-preserving protocols. The research will cover major Privacy-Enhancing Techniques (PETs), including Fully Homomorphic Encryption (FHE), Secure Multi-party Computation (MPC), and Zero-Knowledge Proofs (ZKPs). The candidate will design, analyze, and implement advanced privacy-preserving cryptographic protocols, with applications to real-world domains such as machine learning, distributed systems, and blockchain technologies.

At NTNU we want to increase the proportion of women in scientific positions. Female students are therefore encouraged to apply.

The application deadline is March 20, 2026

For more information, please check the official job announcement.

Closing date for applications:

Contact: Associate professor Jeongeun Park ([email protected])

More information: https://www.jobbnorge.no/en/available-jobs/job/295226/phd-candidate-in-post-quantum-cryptography-for-privacy-preserving-protocols