International Association
for Cryptologic Research

This paper formally specifies and analyzes the CK hybrid key encapsulation mechanism (KEM) construction from the IRTF CFRG’s recent draft on hybrid (post-quantum/traditional) KEMs CK combines two KEMs using a PRF to produce a hybrid KEM. Unlike the QSF framework of Barbosa et al., which combines an IND-CCA KEM with a nominal group (Diffie-Hellman-style), CK combines a C2PRI-secure post-quantum-secure KEM with an IND-CCA traditionlly-secure KEM constructed from an IND-CCA2 public key encryption (PKE) scheme, such as RSA-OAEP. We additionally show how to securely promote an IND-CCA2 PKE into an IND-CCA KEM. We perform two complementary security analyses of CK in the standard model: the first shows CK is IND-CCA assuming the traditional KEM is IND-CCA, the post-quantum KEM is C2PRI, and the KDF is a secure PRF; the second shows CK is IND-CCA assuming the post-quantum KEM is IND-CCA and the KDF is a secure PRF, even if the traditional KEM is completely broken. Neither proof requires the random oracle model.

The rapid advancement of quantum computing poses significant challenges to the security of existing cryptographic constructions. Several constructions that are provably secure in the classical setting, e.g., the $3$-round Luby–Rackoff, Even–Mansour, Keyed Sum of Permutations, become vulnerable when the adversary is granted quantum oracle access (the Q2 model). In contrast, when the adversary is restricted to classical oracle queries while retaining the ability to perform quantum computations locally (the Q1 model), such attacks no longer apply. In this paper, we investigate the Q1 security of the Keyed Sum of Permutations construction and two closely related variants - one employing identical permutations and another using a single key. We prove that all three constructions achieve $n/3$-bit security in the Q1 model. In addition, for the same-key variant, we exhibit a key-recovery attack with matching complexity, thereby establishing the tightness of our security bound. For the remaining two constructions, we derive key-recovery attacks with complexity $2^{2n/3}$.

Committing security has recently emerged as an essential property for message authentication codes (MACs), driven by applications such as abuse reporting in end-to-end encrypted messaging systems. Traditional notions, such as unforgeability or pseudorandomness, are insufficient in these contexts, prompting the introduction of stronger security notions. Bhaumik et al. (CRYPTO'24) initiated this line of research by formalizing the notions of commitment and context-discovery for MACs and analyzing several standardized birthday-bound secure constructions. We extend this line of work to beyond-birthday-bound (BBB) secure MACs. In particular, we examine the class of constructions identified by Chen et al. (ASIACRYPT'21), which employ two block ciphers and a single block hash function, together with well-studied BBB MACs from the DbHtS paradigm. Our findings depict a heterogeneous picture: while several constructions succumb to simple attacks, others exhibit some resilience, highlighting that committing and context-discovery security for BBB MACs depends strongly on structural design choices.

We are looking for a PhD-student in cryptography at the Department of Informatics at the University of Bergen. The position is for a fixed-term period of 3 years with the possibility of a 4th year with career-promoting work (e.g. teaching).

Algebraic cryptanalysis examines the security of cryptographic algorithms through solving polynomial systems of equations. It is crucial for building confidence in quantum safe cryptography, as well as novel symmetric encryption algorithms designed for use with advanced protocols, such as fully homomorphic encryption, multi-party computation or zero-knowledge protocols. Specific research areas will be discussed with the successful applicant, but may include designing and improving general algorithms for algebraic cryptanalysis, or developing concrete attacks against proposed ciphers. This PhD position is an opportunity to explore and shape your own research project at the very forefront of research in cryptography.

The application deadline is April 6, 2026. For more information see the official job announcement at: https://www.jobbnorge.no/en/available-jobs/job/296272/phd-research-fellow-in-cryptography

Closing date for applications:

Contact: Morten Øygarden ([email protected])

More information: https://www.jobbnorge.no/en/available-jobs/job/296272/phd-research-fellow-in-cryptography

Senior Post-Quantum Cryptography Researcher VRF Construction for Consensus Systems Quantova QVM Research | IACR Community Quantova QVM is assembling a team of senior cryptographic researchers to complete the transition of its consensus architecture to a fully post quantum design. Our live testnet already operates with post quantum primitives embedded across the protocol stack, including CRYSTALS Dilithium, Falcon, SPHINCS+, and SHA 3. Classical ECDSA and BLS signing have been removed from validator authentication. The remaining classical dependency is the EC VRF used for proposer selection and committee sampling. The objective is to replace the existing EC based VRF with a rigorously defined post quantum VRF, aligning the randomness layer with our post quantum signing infrastructure. The role requires formal design and security analysis of a VRF satisfying uniqueness, pseudorandomness, and public verifiability under quantum adversarial models. Constructions may be lattice based, hash based (QROM), or derived from established post quantum signature frameworks. Efficiency, bounded proof size, and consensus level verification constraints must be considered. Candidates should possess advanced research experience in cryptography, strong familiarity with VRF security definitions and reduction techniques, and demonstrated work in post quantum systems. Researchers are invited to submit a CV and relevant publications.

Closing date for applications:

Contact: Dean - Head of Research @ Quantova

More information: https://quantova.org/

PhD Scholarship Opportunity – Homomorphic Encryption (UOW, Australia)

Our group is recruiting one PhD student to work on Homomorphic Encryption at the Institute of Cybersecurity and Cryptology (IC²), School of Computing and Information Technology, University of Wollongong (UOW).

Scholarship package

• Full tuition fee waiver
• Stipend: ~ AUD 35,000 per year
• Duration: 3.5 years

Requirements

• Master’s degree in Computer Science / Mathematics (or a closely related field)
• IELTS 6.5+ (no band below 6.0)
• Research experience (publications preferred)
• Background in Cryptography is a strong advantage

How to apply (Deadline: 31 March 2026)
Please email your CV and academic transcripts to Dr. Steven Duong at [email protected].

Closing date for applications:

Contact: Dr. Steven Duong ([email protected])

The John Hopcroft Center for Computer Science at Shanghai Jiao Tong University (SJTU) invites applications for multiple fully funded PhD and Postdoctoral Research Fellow positions in the areas of post-quantum cryptography, multi-party computation (MPC), and quantum algorithms.

These positions offer an exciting opportunity to conduct cutting-edge research in a dynamic and internationally collaborative environment, working closely with Prof. Yu Yu and Prof. Shi Bai.

Position Details

PhD Candidates: Open to applicants with a Bachelor’s or Master’s degree in a relevant field (students near completion are also encouraged to apply). A solid foundation in cryptography, mathematics, or computer science is required. Strong programming skills are a plus.

Postdoctoral Fellows: Applicants should hold a PhD in a related field (or near completion) and demonstrate a strong research track record, preferably with publications at leading IACR venues or security conferences.

Desired Qualifications

• High motivation and ability to work both independently and collaboratively
• Strong communication skills
• Excellent academic writing and presentation abilities
• For PhD applicants: Please include an updated CV with your transcripts, and names of referees (if any)
• For Postdoctoral applicants: Please include an updated CV with a full list of publications and names of referees in your application

How to Apply

Interested candidates should send their applications (including CV, academic transcripts for PhD positions, and a brief statement of research interests) to one of the following contact.

Closing date for applications:

Contact:

Prof. Yu Yu: [email protected]
Prof. Shi Bai: [email protected]

At IE School of Science and Technology, you contribute to shaping the next generation of applied mathematicians within an international academic community. Our programs combine rigorous mathematical foundations with real-world relevance and remain at the forefront of science and technology education.

As an Adjunct Professor in Cryptography, teaching in the fourth year of the Bachelor of Applied Mathematics (BAM) at our Madrid campus (IE Tower) for the 2026–2027 academic year, you will design and deliver an elective course covering both classical and modern cryptography. Please note that elective courses require a minimum number of students to go forward.

Course Topics

• Encryption, Shannon’s lower bound, and pseudo-randomness
• Symmetric and public-key cryptography (Merkle, Diffie–Hellman, RSA)
• Digital signatures (Lamport, RSA-based schemes)
• Zero-knowledge proofs and proofs for NP
• Lattices, LWE, and Fully Homomorphic Encryption
• Quantum and post-quantum cryptography

Key Requirements

• Ph.D. preferred in Mathematics, Computer Science, or related STEM field
• Master’s degree in STEM with teaching experience will also be considered
• Strong background in mathematics and computing
• Flexibility to accommodate assigned teaching schedules
• Excellent communication skills in English (minimum C1)
• Authorized to work in Spain (visa sponsorship is not available)

Preferred Profile

• Experience teaching advanced undergraduate mathematics or theoretical computer science
• Ability to connect rigorous theory with computational implementation
• Experience supervising student projects or research

Typically, our Adjunct Faculty hold full-time professional or research positions and teach one course with us, bringing valuable real-world and academic expertise directly into the classroom.

Closing date for applications:

Contact: irene.alda(at)ie.edu

More information: https://www.ie.edu/university/studies/academic-programs/bachelor-applied-mathematics/

We are looking for a motivated PhD student to join the Cryptography Group in the Cybersecurity Engineering Section at the Department of Applied Mathematics and Computer Science (DTU Compute), located in the Copenhagen region, Denmark.

This fully funded 3-year PhD position, starting on 1 January 2026, will focus on advancing research in Multi-Party Computation and Zero-Knowledge Proofs. The PhD will be carried out under the supervision of Associate Professor Luisa Siniscalchi.

If you are curious, enthusiastic, and eager to learn, we would love to hear from you, and you can apply at https://lnkd.in/gNTXJwEB, including the following:

1. A letter motivating the application (cover letter)
2. Curriculum vitae
3. Grade transcripts and BSc/MSc diploma (in English), including official description of grading scale

Closing date for applications:

Contact: [email protected]

We are looking for an outstanding individual with a strong track record of excellent research in one of the areas of cybersecurity. The future job holder will have an outstanding PhD and excellent scientific achievements in one of the following areas:

• Theory and Practice of Cryptography
• Security and Privacy in Machine Learning
• Formal Methods in Security
• Secure Protocols and Networks
• Software and Systems Security
• Usable Security and Privacy

Applications with complementary or new thematic focus areas in the field of IT Security that expand the existing expertise at the Institute for IT Security are expressly welcome. The establishment of a separate working group at the Institute for IT Security (www.its.uni-luebeck.de) is expected.

The applicant should have high potential to strengthen the university's research profile in the field of IT Security through excellent publications, have high potential for successfully acquiring third-party funding at national and international level, and have the ability to lead research projects. Scientific participation in the institute's main areas of research and the university's profile areas, such as the trustworthiness of systems and the cross-sectional area of intelligent systems, is expected, especially in the context of self-acquired projects (public funding, industrial cooperation, etc.).

Teaching obligations include participation in the IT Security degree programs (German-language Bachelor's and English-language Master's) and other degree programs in the STEM sections of the university.

Junior professorships are initially filled for a fixed term of three years. Following a positive interim evaluation, the position is extended for a further three years. The position will be converted to a permanent W2 professorship if the tenure evaluation is positive.

Applications with the usual documents must be submitted exclusively electronically via the application portal on the University of Luebeck until 01.04.2026.

Closing date for applications:

Contact: Petra Niehoff (petra.niehoff(at)uni-luebeck.de) Thomas Eisenbarth (thomas.eisenbarth(at)uni-luebeck.de)

More information: https://stellenangebote.uni-luebeck.de/jobposting/301599937bbb518a1054be323d3bc7220610f2270

Event date: 9 May to 10 May 2026
Submission deadline: 20 February 2026
Notification: 14 March 2026

We are inviting applications for a PhD studentship in the Surrey Centre for Cyber Security at the University of Surrey.

This studentship will develop new cryptanalytic techniques for solving post-quantum computational hardness assumptions and will use such analysis to propose secure advanced cryptographic functionality, with a special focus on recent new "spins" on well established lattice-based hardness assumptions.

Eligibility criteria

We seek applicants with a strong background in mathematics and/or computer science. Familiarity with cryptography, number theory, computational algebra or quantum computing will be appreciated, but are not mandatory.

Open to any UK or international candidates. Up to 30% of our UKRI funded studentships can be awarded to candidates paying international rate fees.

How to apply

Applications should be submitted via the University of Surrey Computer Science PhD programme page.

In place of a research proposal, you should upload a document stating the title of the project that you wish to apply for and the name of the relevant supervisor.

More information

More details on the project and answers to FAQs can be found on the University of Surrey website or on FindaPhD advertisement 195082

References

• Surrey Centre for Cyber Security: https://www.surrey.ac.uk/surrey-centre-cyber-security
• Fernando Virdia (supervisor): https://fundamental.domains
• Robert Granger (supervisor): https://www.surrey.ac.uk/people/robert-granger

Closing date for applications:

Contact: Fernando Virdia, f.virdia at surrey.ac.uk

More information: https://www.surrey.ac.uk/fees-and-funding/studentships/cryptanalysis-post-quantum-hardness-assumptions

About the Role We are looking for a dedicated PhD student to strengthen our research in trustworthy and verifiable AI. Example research topics include evaluating the trustworthiness of data collection and pre-processing pipelines, designing verification techniques which ensure that model training procedures are not tampered with, and accountable model deployments. The project is part of the multi-disciplinary center for cyber resilient AI, RESIST, which is a national effort funded by the Swedish Strategic Research Foundation to bring together leading researchers in AI and cybersecurity to develop novel solutions to cyber resilient AI for the benefit of Swedish industry and society. You will be based in the RISE office at Kista, Stockholm for 4 years, and you will be enrolled as a doctoral student at a Swedish University. PhD education also involves participation in relevant university courses.

About RISE RISE Research Institutes of Sweden AB is Sweden's research institute and innovation partner. In international collaboration with companies, academia, and the public sector, we contribute to a competitive business sector and a sustainable society. You will be part of the Cybersecurity unit at the department of Computer Science which conducts cutting-edge research on both fundamental and applied cybersecurity topics arising in AI, 6G, Internet of Things, etc.

Requirements a) completed master’s degree in computer science, information security, mathematics, or an equivalent field, b) background in cryptographic primitives for advancing verifiability in AI/ML pipelines, c) strong programming skills, d) good command of spoken and written English.

Application Submission: https://www.ri.se/en/about-rise/work-with-us/open-job-positions/phd-student-in-trustworthy-and-verifiable-ai

Closing date for applications:

Contact: Dr. Apostolos Pyrgelis (apostolos.pyrgelis[at]ri.se)

More information: https://www.ri.se/en/about-rise/work-with-us/open-job-positions/phd-student-in-trustworthy-and-verifiable-ai

Designing secure embedded systems is a critical challenge due to their inherently complex three-layer architecture: hardware, microarchitecture, and software. Cyber threats often exploit vulnerabilities introduced during the design phase, which remain undetected due to a lack of design tools that integrate a realistic attacker model with a holistic approach. Current tools and methods lack a deep understanding of the global system, particularly the interactions between its layers and with its environment (including attacker actions). Existing modeling tools are not yet capable of effectively predicting an embedded systems' resistance to fault attacks, as their generality leads to excessive simulation complexity. This project proposes a more realistic attacker model to identify microarchitecture-specific vulnerabilities. This approach enables designers to develop countermeasures, integrate them into systems, and verify their effectiveness in significantly reducing—or ideally preventing—the attacker’s ability to exploit vulnerabilities. The objective of this PostDoc is to extend the existing work by leveraging RTL fault models existing in the state of the art and proposed by the TwinSec project, to assess and improve the security of RISC-V microarchitectures (e.g., OpenTitan, CV32, CVA6) and their recent countermeasures (e.g., Mafia, AKHACIA). The aim is to improve existing countermeasures or develop new ones at design level that incorporate both hardware and software protections for embedded code, such as, for example, secure boot mechanisms. This PostDoc will take place in TIMA Laboratory, Grenoble and will last 12 to 24 months. The candidate will strictly cooperate with other partners involved in the project, both local (CEA, LCIS, Verimag) and national. The salary will be defined according to the guidelines defined by Grenoble INP and will depend on the experience of the candidate.

Closing date for applications:

Contact: Paolo Maistri

More information: https://tima.univ-grenoble-alpes.fr/join-tima/postdoc-and-research-engineers/postdoc-enhancing-security-risc-v-microarchitectures-against-laser-fault-injection-countermeasure

We introduce $CRISP (\underline{C}ircuit-p\underline{R}ivate ~Single-\underline{I}mage~ \underline{S}teganography ~with ~\underline{P}ermutations),$ a provably secure homomorphic steganography scheme designed to address key limitations in existing approaches to private computation. Current methods often suffer from excessive image overhead and a complete lack of circuit privacy. Specifically, many techniques require a separate cover image for each wire in a circuit, leading to a large number of images for even moderately sized circuits. This also inadvertently reveals the underlying logical gate structure to an honest-but-curious cloud provider, as wire roles are often fixed to specific images.

CRISP resolves these challenges by embedding all three Fredkin gate inputs directly into the RGB channels of a $single$ cover image at a secret pixel position $(\mathit{row},\mathit{col})$. Similarly, all three outputs are written to a single output image. To ensure robust circuit privacy, CRISP employs two independently sampled permutations: $\pi_{\mathrm{in}}$ assigns input channel roles, and $\pi_{\mathrm{out}}$ reassigns output channel roles. These permutations work in tandem to prevent an adversary from deducing the circuit's structure. Without $\pi_{\mathrm{out}}$ varying per gate, the Fredkin gate's pass-through of the control bit could enable a deterministic channel-matching attack, fully exposing the logical gate structure to the cloud provider. By resampling $\pi_{\mathrm{in}}$ and $\pi_{\mathrm{out}}$ independently for each gate, CRISP effectively prevents cross-gate correlation attacks.

Our security analysis demonstrates that an adversary's advantage in locating the secret pixel and inferring the embedded bits decays as\\ $\Theta\!\left(1/(h{\times}w)\right)$, where $h{\times}w$ is the image resolution. This bound is cryptographically negligible for any practical image size. CRISP significantly reduces image overhead: per gate, it uses just two images (one input cover plus one independent output cover). This represents a substantial reduction compared to other methods that might require multiple images per wire. For an obfuscated benchmark circuit, CRISP further demonstrates a notable reduction in total image count. Crucially, CRISP delivers circuit privacy, a qualitatively new and essential security guarantee.

The correctness, security, and efficiency of CRISP are formally proved and experimentally validated.

The selection of shift polynomials is a pivotal yet challenging step in Coppersmith's method for computing modular roots of multivariate polynomials. We propose a novel, determinant-based strategy for generating these polynomials, thereby presenting an improved variant of Coppersmith's method tailored for certain multivariate modular equations. Our approach is first validated on solving the Modular Inversion Hidden Number Problem (MIHNP) and predicting the Inversive Congruential Generator (ICG), where it is shown to outperform prior methods both in theory and in practice. Furthermore, when applied to the Modular Inversion Double Hidden Numbers Problem (MIDHNP), our analysis reveals that MIDHNP is not harder than MIHNP, thereby disproving a conjecture by Boneh et al. (Asiacrypt 2001).

Recently, Boneh, Partap, and Rotem [Crypto’24] initiated the study of threshold traitor tracing, which aims to enhance threshold decryption with anti-collusion mechanisms through a tracing functionality. In their model, a set of colluders constructs a decryption box, called a decoder, and sells it to an external buyer. Collusion-resilience is guaranteed by a tracing algorithm that, given only black-box access to the decoder, can identify at least one of the colluders. However, in this paper, we argue that the state-of-the-art definition and constructions are not resilient against attacks where the decoder is sold to an insider, i.e., a member of the decryption committee.

Motivated by this gap, we introduce new definitions to model decoder boxes that are sold to insiders. We show that existing threshold traitor tracing techniques are inherently vulnerable to insider attacks. Then, we introduce a novel approach to achieve insider resilience through multi-traitor tracing, i.e., identifying multiple traitors. We present compilers that amplify the number of traitors that can be found, thereby achieving insider-resilience with efficient parameters, in particular, sublinear ciphertext size. These compilers may also be of independent interest.

Lattice-based cryptography (LBC) has emerged as one of the most promising fields supporting post-quantum cryptography (PQC). The Learning With Errors (LWE) problem \cite{Regev}, due to its strong security guarantees, plays a fundamental role in LBC, although it is not very efficient for cryptographic applications. To address this limitation, several variants of LWE have been developed, such as Ring-LWE (RLWE) \cite{LPR2010}, which is suitable for theoretical purposes, and Polynomial-LWE (PLWE) \cite{BV}, which is more practical. This survey provides a systematic review of vulnerable instances of PLWE. These attacks may extend to RLWE in instances where the two problems are equivalent.. This paper serves as a resource for those seeking a structured overview of the state-of-the-art attacks on PLWE.

FALCON (Prest et al. NIST submission) is a lattice-based digital signature scheme that is intended to be standardized by NIST under the name FN-DSA. This scheme has smaller signature and public key sizes than the ``primary'' NIST scheme, ML-DSA, but is more complicated to implement due to floating-point requirements. For this reason, NIST has recommended the scheme be used in special situations where smaller key and signature sizes are particularly important.

There are certain situations, where one can make small modifications to FALCON which results in even shorter outputs, which is particularly interesting for FALCON's intended use cases where smaller outputs are important. In the scenario where one would like to minimize the total public key plus signature length, one could use FALCON in key recovery mode, which is a fairly straight-forward procedure specified in the FALCON document.

In the scenario where one would like to minimize the total signature plus message length, one could use the message recovery mode (which is a somewhat less straight-forward modification) as described in (del Pino et al. SCN 2017). The purpose of this note is to fully specify the details of this latter mode for developers wishing to implement it. The savings of using FALCON in message recovery mode is up to 226 bytes as compared to FALCON-512 and up to 434 bytes compared to FALCON-1024 for the same security levels (i.e. NIST levels 1 and 5, respectively). We also sketch how the same technique can be applied to the ring signature version of FALCON from (Gajland et al. Crypto 2024).

The main algorithmic building blocks of FALCON, such as key generation and trapdoor sampling, remain exactly the same. The only algorithmic changes are in the hashing and parsing of the messages, randomness, and the hash function.

Threshold signatures have regained a strong interest recently, driven by applications in cryptocurrencies and NIST's ongoing call for threshold schemes. Among them, FROST - a classical threshold Schnorr signature scheme already in real-world deployment - stands out. Its appeal lies in three core features: partially non-interactive signing, non-interactive identifiable abort (IA), and proactive security. In contrast, while post-quantum (PQ) threshold signatures have seen significant advances in recent years, no existing scheme simultaneously provides even two of these features. Considering the imminent need to migrate to PQ cryptography, this state-of-the-art remains unsatisfactory.

In this work, we propose Hermine, a lattice-based threshold signature that offers the full feature set of FROST under standard lattice assumptions. Hermine is designed to efficiently support the Medium scale of parties ($N \le 64$) as defined in the NIST threshold call, producing a small \Raccoon signature of size $11$ KB. Our main technical contribution is introducing an everywhere-short secret sharing, which splits a short secret vector $\mathbf{s} \in R_q^\ell$ into short shares and admits a short linear reconstruction algorithm. While the resulting construction appears intuitive, its security proof requires a non-trivial, fine-grained analysis of the information on $\mathbf{s}$ that is inherently leaked by the short shares. Furthermore, we formalize game-based unforgeability and IA definitions with proactive security, which may be of independent interest.