International Association
for Cryptologic Research

Threshold signatures for distributed systems require compact public keys and signatures to reduce communication overhead by avoiding packet fragmentation. However, with existing post-quantum threshold signatures, either the public key or the signature no longer fits within a single unfragmented network packet.

In this work, we present Threshold PRISM, an isogeny-based post-quantum threshold signature scheme whose public keys and signatures both fit within a single unfragmented network packet at every NIST security level. To the best of our knowledge, Threshold PRISM is the first post-quantum threshold signature scheme to do so, with arbitrary number of parties. While isogeny-based signatures such as SQIsign and PRISM are known for exceptionally compact public keys and signatures, their algebraic structure makes thresholdization for general number of parties highly nontrivial. We address this challenge by introducing a novel graph-based threshold access structure tailored to the isogeny setting.

Across our various parameter choices with trade-off between signing speed and size of public key and signature, at NIST security levels I/III/V, our constructions achieve public keys of 65-129/97-193/129-257 bytes and signatures of 159-222/239-335/319-447 bytes, respectively. Among the schemes submitted to the NIST MPTC (Multi-Party Threshold Cryptography) Round-1 call whose public keys fit within a single unfragmented network packet, our constructions achieve the smallest signature sizes. We also provide a proof-of-concept implementation of Threshold PRISM.

Softmax is widely used in deep learning to map some representation to a probability distribution. As it is based on the exponential function, which is relatively expensive in multi-party computation, Mohassel and Zhang (S&P, 2017) proposed a simpler replacement based on ReLU (the maximum of the input and zero) to be used in secure computation. Later works (e.g., Wagh et al., PETS 2019 and 2021) used the softmax replacement not for computing the output probability distribution but for approximating the gradient in backpropagation. In this work, we analyze the two uses of the replacement and compare them to softmax, both in terms of accuracy and cost in multi-party computation. We found that the replacement only provides a significant speed-up for a one-layer network, while it always reduces accuracy, sometimes significantly. Thus, we conclude that its usefulness is limited, and one should use the original softmax function instead. We also present a novel protocol for secure exponentiation that reduces communication up to fourfold while preserving accuracy when used for softmax.

At ASIACRYPT 2023, Devevey, Passelègue and Stehlé proposed the G+G signature, which is designed based on the Fiat-Shamir transform without rejection sampling technique. However, the optimization of the G+G signature have not been studied as extensively as those of Lyubashevsky-type signatures. The contribution of this work is the integration of the Asymmetric Learning with Errors (ALWE) problem into the key generation phase of the G+G signature. We present a more precise estimation method for the largest singular value of the secret key and introduce a new non-spherical Gaussian distribution to characterize the signature distribution. Experimental results demonstrate that, under parameters ensuring the same security level, our optimized G+G variant reduces the signature size by approximately 25%.

In this work, we investigate variants of the discrete logarithm problem (DLP) based on different algebraic group properties. We demonstrate that within abelian groups—particularly cyclic groups—the problems $\text{DLP}^2$ and, more generally, $\text{DLP}^n$ are polynomially reducible to solving multiple instances of the classical DLP. This result confirms that multi-generator variants in abelian settings inherit the vulnerabilities of the conventional DLP and therefore provide no additional resistance against quantum attacks such as Shor’s algorithm. Motivated by this limitation, we propose that $\text{DLP}^n$ should instead be formulated in non-abelian groups. Specifically, let $G$ be a non-abelian group. Given generators $g_1, g_2, \dots , g_n \in G$ of cyclic subgroups $H_1, H_2, \dots, H_n$ of $G$, respectively, and an element $A \in G$, the problem is to find $(\alpha_1, \alpha_2, \dots , \alpha_n)$ such that $A = \prod_{i=1}^n g_i^{\alpha_i}$, where $0 \leq \alpha_i <|H_i|$. This formulation leverages the non-commutative structure of $G$, which may obstruct reductions that trivialize multi-generator variants in abelian groups. Our findings strongly motivate the exploration of quantum-resistant cryptographic primitives in non-commutative algebraic structures, as these settings may evade known quantum attacks and provide new hardness assumptions for post-quantum security.

Shuffle arguments account for the largest part of the audit data of end-to-end verifiable elections when simple homomorphic tallying cannot be applied. The mixnets that have been deployed in government or public elections (e.g., in Australia, Estonia, Israel, Norway, Spain or Switzerland), generate proofs with a size that scales linearly with the number of ciphertexts, and account for GB of data when millions of ciphertexts need to be shuffled.

We present MAYA, a shuffle argument with O(log n) communication complexity and a transparent setup requiring no trusted parameters, making the currently dominant cost of the shuffle argument a small fraction of the audit data size and verification time. Our construction instantiates a commitment-consistent shuffle framework using a succinct argument based on generalized k-ary folding that efficiently supports an arbitrary number of ciphertexts, while preserving the aggregation structure used in operational mixnet deployments.

We implement MAYA in Rust and compare it with Verificatum, the current state-of-the-art and heavily-optimized mixnet implementation. For n = 10^6 ciphertexts, our implementation produces arguments whose length is .002% of those of Verificatum, have a similar computation time, and require only 12% of the Verificatum argument verification time. Overall, MAYA considerably reduces the cost of hosting election verification data and speeds-up the election verification process, supporting effective election verification.

We propose an algorithm based on the partition refinement framework for testing and recovering CCZ and EA equivalence between a pair of vectorial Boolean functions. In contrast to existing approaches, our method can be used for any pair of functions regardless of their algebraic degree, image size and other properties, and it outperforms all currently known algorithms in terms of time and memory. The algorithm can also compute the automorphism group of the functions efficiently. Our implementation is available at https://github.com/zskiley/CCZ-EA-equivalence

Linear error-correcting codes play a crucial role in building practical non-interactive arguments of knowledge (SNARKs) with transparent setup, and plausible post-quantum security. Basically, the key to practical efficiency is a linear code with a concretely fast encoding and a high minimum distance. However, to date, none of the candidate codes achieves the best of the two worlds: codes with provable high minimum distance, e.g., Reed-Solomon codes, suffer from quasi-linear time encoding, while linear-time encodable codes, e.g., Spielman's code, have low provable minimum distance.

In this work, we resolve this problem by explicitly constructing a family of Quasi-Abelian (QA) codes over {\em arbitrarily} large prime fields with concretely high minimum distance and practically efficient encoding algorithms. At the heart of our technical contribution is a fine-grained analysis on the concrete minimum distance of random QA codes of rank $1$ and index $c$ over group ring $\mathbb{F}_p[\mathbb{Z}_2^n]$. We show that in practical regimes it attains the well-known Gilbert-Varshamov bound up to a small constant gap $n/(c\log_2{p})$. Concretely, with probability $\ge1-2^{-127}$, our random QA code over a $128$-bit sized prime field with $n=20$, achieves relative minimum distance at least $0.4142,0.6070,0.7040$ for code rate $1/2,1/3,1/4$, respectively. In comparison, Spielman's code only achieves a minimum distance $0.1$ for code rate $1/2$ in the same setting by the state-of-the-art analyses.

We give practically efficient encoding algorithms for QA code over $\mathbb{F}_p[\mathbb{Z}_2^n]$ by leveraging Walsh-Hadamard Transform. Specifically, for code length $c\cdot 2^n$ and rate $1/c$, our encoding only needs $cn\cdot 2^n$ additions/subtractions and $(c-1)\cdot 2^n$ multiplications over $\Fp$, which turns out to be concretely faster than Spielman's code. For encoding a message of length $2^{20}$ over a $256$-bit prime field, our QA code with rate $1/2$ only takes $250$ ms, while Spielman's code with rate $0.65, 1/2$ needs $410$ ms, $890$ ms, respectively.

We then follow the framework of Brakedown (CRYPTO 2023) to build SNARKs over large prime fields from QA codes. For proving ECDSA verification over the scalar field of Curve25519 ($\approx 2^{16}$ constraints), our SNARK needs only $1.44$ second in proving, $0.08$ second in verification, and a proof size of $3.2$ MB. In comparison, Brakedown needs $1.6$ second, $0.24$ second, and $7.48$ MB, respectively.

In 2022, the National Institute of Standards and Technology (NIST) initiated a second call for post-quantum digital signature proposals to broaden algorithmic diversity beyond the already standardized schemes based on structured lattices and hashes. Among the 14 candidates, five are built on the MPC-in-the-Head paradigm. While theoretically promising, available results on their implementation costs imply a reduced applicability to resource-constrained embedded devices.

In this work we analyze the revised second version of the Syndrome Decoding in the Head (SDitH) signature scheme based on the VOLE-in-the-Head framework and showcase that these issues are not inherent to the family of algorithms. We propose an area-efficient hardware design including highly optimized variants of both Batch Line Commitment (BLC) and Polynomial Interactive Oracle Proof (PIOP) routines. As a result, we manage to reduce memory requirements by an order of magnitude compared to hardware implementations of other MPCitH and code-based signature schemes. Most notably, with respect to the previous hardware implementation of SDitH-v1 we improve SRAM usage by a factor of 82 to 104, while still achieving competitive runtimes. Furthermore, many of our proposed techniques are similarly applicable in order to reduce memory usage of software implementations.

During the design process, we determined nine significant discrepancies between the specification and reference implementation of SDitH-v2, with a subset of them breaking test vector compatibility. In addition to addressing these issues, we suggest a set of possible specification changes which can help to further reduce resource usage on embedded targets without compromising security assumptions.

The EU Whistleblower Directive aims to create a framework where the persons reporting breaches of EU law are protected against retaliation. In contrast to GDPR, it is mainly based on trust assumptions and not on the concept of privacy and security by design. As we are explicitly dealing with problems of unlawful behavior, this is a critical issue. In this paper, we analyze the role of pseudonymization, the main technical tool promoted in the GDPR, within the Whistleblower Directive. To see the real impact of the Directive, we analyze how these issues are reflected in the national law in Germany and Poland. We show that the current law does not take advantage of the opportunities given by pseudonymization and does not create a clear legal framework that can be converted to problem-relevant technical requirements. Even worse, it allows the Member States to ban anonymous reports. On the other hand, we show that so far, no pseudonymization tool developed within official ID management frameworks addresses all threats to reporting systems.

Training machine learning models is computationally intensive, making cloud-based outsourcing an attractive solution to alleviate local resource constraints. However, untrusted cloud environments pose serious privacy risks to both training data and resulting models. Existing works primarily rely on multi-party computation (MPC) or lattice-based Homomorphic Encryption (HE), which often incur high communication or computation overheads. To address these challenges, we propose an efficient privacy-preserving scheme for outsourced decision tree training. Specifically, we leverage Symmetric Homomorphic Encryption (SHE) to achieve faster training speed. However, since SHE only supports integer-based homomorphic operations, we propose a Modified Gini Impurity Index (MGII) to adapt to this restriction and use Single Instruction Multiple Data (SIMD) packing to accelerate processing. Experimental results demonstrate that our scheme significantly reduces overall execution time compared to related works and achieves comparable (and for deeper trees, better) accuracy, while security analysis confirms that data and model confidentiality are preserved.

Although recent surveys on privacy-enhancing technologies concluded that FHE cannot feasibly evaluate non-linear activation functions in modern ML architectures, 20 CKKS-based frameworks have since demonstrated end-to-end private inference of LLMs with up to 8B parameters. However, as the field grows rapidly, the literature has become fragmented. Frameworks differ in ciphertext packing layouts, model fidelity, software and hardware stacks, and reported metrics, which hinder direct comparison and reproducibility. This paper presents the first systematization of knowledge for non-interactive, CKKS-based private LLM inference. We categorize the design space across two axes: a model-level axis (packing layout for linear blocks and model preservation for non-linear blocks) and a system-level axis (covering hardware, compilers, bootstrapping management, and hybrid execution). To standardize reporting framework configurations and results among researchers, we propose a Private LLM Card System (PLCS). Furthermore, we introduce POLARIS, a model-preserving reference framework for CKKS-based private LLM inference and provide it as an open-source proof-of-concept. In its current version, POLARIS supports encrypted inference for BERT-Tiny and BERT-Mini and leverages GPU acceleration for enhanced performance.

Our analysis suggests that only about 20% of surveyed implementations are model-preserving, that is, they evaluate standard, unmodified LLMs without retraining or architectural substitutions. We also show that model-preserving CKKS approximations maintain high downstream task accuracy from BERT-Tiny up to Llama-3-8B. We identify a runtime gap of roughly four orders of magnitude between encrypted and plaintext inference as the primary barrier to practical use. While our analysis confirms that CKKS-based inference is now algorithmically feasible for non-linear functions and large models, we conclude that it remains operationally impractical for many human-facing applications until the efficiency gap is narrowed. We outline promising research directions to close this gap.

n 2020, Ravi et al. [23] published three shuffling variantswith each offering a different performance-security trade-off for protect-ing the Numeric theoretic Transform (NTT). Among them, the fine-shuffling was proposed as the lightweight variant. The idea is to ran-domise the order of loading and storing the operands of the butterflycomputation using conditional swapping based on random control bit.However, as noted by the authors themselves, basic-fine-shuffling imple-mentation suffered from an obvious attack on the conditional swappingmask. So they introduced the bitwise-fine-shuffling to fix this issue. Inthis paper, we break this implementation using a template attack. Theidea is to aggregate the leakage from the 16 bitwise AND operations usedto construct the swap mask. The attack has been performed both onsimulation and on a STM32F303 target. Then, we propose a masked fine-shuffling variant to protect the fine-shuffling operation. The idea is tomask the secret-dependent memory accesses and apply the swap maskover its boolean sharing instead. The implementation is proven secureagainst first-order attacks in the probing model. The implementationhas been benchmarked on an ARM-Cortex-M4 processor and incurs a to-tal overhead of 25% on the entire ML-KEM768 decapsulation algorithm,compared with 51% overhead for the defeated bitwise-fine-shuffling of[23].

Bitcoin bridges, protocols that lock BTC on Bitcoin and represent it on a secondary system, underpin much of Bitcoin's application layer, yet remain poorly secured. Deployed bridges rely on federated custody with honest-majority assumptions, while BitVM2, the state of the art in trust-minimized bridging, incurs worst-case dispute costs of approximately \$16,000, requiring large operator bonds and deposits that restrict participation to well-capitalized parties.

We present BitVM3-BRIDGE, a trust-minimized bridge architecture from Bitcoin to (i) chains with finality certificates, such as Ethereum, and (ii) Bitcoin rollups. Our main contribution is an end-to-end bridge construction that makes trust-minimized Bitcoin bridging practical at scale. The bridge is powered by BitVM3-CORE, a modular abstraction for permissionless off-chain computation on Bitcoin using garbled circuits. In BitVM3-CORE, a challenger evaluates a garbled circuit entirely off-chain and obtains a fraud-proof witness if and only if the operator's claim is incorrect. This paradigm reduces total on-chain costs to approximately \$9, with the challenge transaction itself costing just \$0.20. This nearly 1000× cost reduction enables smaller bonds, broader operator participation, and smaller deposit sizes.

Beyond the bridge itself, we make two additional contributions. First, we formalize BitVM3-CORE as a sound and complete on-chain proof system under standard cryptographic assumptions. Prior GC-based proposals typically provide either informal security arguments or construction-specific formalizations; by contrast, our framework captures existing constructions within a uniform model and gives a generic treatment based on axiomatized security and functional assumptions. Second, we introduce an on-chain Bitcoin light client secure in the variable-difficulty setting, enabling permissionless chain introspection on Bitcoin and thereby the rollup variant of BitVM3-BRIDGE.

Privacy-preserving machine learning (PPML) enables inference over sensitive data without exposing raw inputs, with CKKS being a widely adopted scheme for approximate arithmetic. However, existing CKKS implementations are primarily based on 64-bit residue number system (RNS) representations, creating a mismatch with modern GPUs optimized for 32-bit integer arithmetic. This mismatch introduces substantial computational overhead, limiting the practicality of encrypted transformer inference.

In this work, we present Zephyr, a GPU-efficient framework for homomorphic transformer inference via 32-bit arithmetic and grafting. Zephyr revisits the design of CKKS under GPU constraints and introduces a grafting-based representation that decouples scale management from the modulus chain. By constructing the RNS basis entirely with 30-bit primes and managing scale through auxiliary graft structures, Zephyr enables flexible rescaling while remaining compatible with efficient 32-bit GPU execution.

Compared to Cheddar (Choi et al., ASPLOS’26), a representative GPU-oriented CKKS design based on fixed 25-30 prime systems, our approach simplifies modulus management and enables more flexible operations across different levels, while reducing rescaling overhead at the cost of additional convolution overhead.

We further optimize ciphertext-ciphertext matrix multiplication (CCMM), a major bottleneck in encrypted transformer inference, by eliminating redundant linear transformations and merging overlapping rotation patterns in attention computation. Our theoretical and empirical analysis demonstrates that grafting-based 32-bit CKKS provides a practical and flexible design point for GPU-accelerated PPML inference.

Coin flipping in the presence of a dishonest majority is a fundamental cryptographic primitive whose requirements lack a clean characterization. Recent work (Bonneau et al., Eurocrypt 2025) showed a lower bound that fair dishonest-majority coin-flipping implies delay functions. However, until now known upper bounds exhibited a significant gap: All existing protocols rely on assumptions that we do not know how to instantiate in the plain model.

In this work, we close this gap. Specifically, we show that fair $n$-party coin flipping in the presence of up to $n-1$ malicious corruptions follows from the minimal assumption of delay functions. This completes the equivalence between delay functions and fair dishonest-majority coin-flipping protocols.

The Even-Mansour cipher is a construction of a keyed pseudorandom permutation from a random unkeyed permutation. Its generalization to multiple rounds, known as iterated Even-Mansour or key-alternating cipher, is an important abstraction in block cipher design. Yet, while the security of single-round Even-Mansour is tight in the quantum setting (with attacks matching security proofs), much less is known on multi-round versions.

In this paper we study the quantum security of iterated Even-Mansour ciphers with two keys (the key-schedule alternates between two independent keys), which model concrete block ciphers like LED. We give the first quantum attacks improving asymptotically over exhaustive key search for 4 to 6 rounds.

On 4 rounds, we present three attacks: two using collision search and one using a quantum version of the multibridge attack of Dinur, Dunkelman, Keller and Shamir (ASIACRYPT 2014), which relies on a quantum walk. The latter reaches up to a quantum time $2^{7n/9}$ where $n$ is the block size, compared to $2^n$ of exhaustive key search.

On 6 rounds, we present an attack of quantum time $2^{n} / \sqrt{\log n}$, adapting classical attacks based on multicollisions. In both cases, our new attacks require only classical known-plaintext queries.

The DKLs23 protocol (Doerner, Kondi, Lee and shelat, IEEE S&P '24) is a state-of-the-art multiparty ECDSA signing protocol. Due to its exceptional combination of simplicity, efficiency, and statistical UC security within an elegant hybrid model providing access to standard ideal functionalities, it is rapidly seeing widespread adoption.

We provide a comprehensive security analysis of the DKLs23 protocol, showing that although it is not statistically secure as originally claimed, it is nevertheless computationally secure, and can be made statistically secure via a lightweight refinement. Our contributions are as follows:

-- Statistical insecurity: Within the hybrid model utilized for the original analysis, we construct a computationally-unbounded "split-view" adversary that successfully attacks the protocol by causing two or more honest parties to output different valid signatures on the same message (specifically, signatures with independent nonces). Considering any ideal ECDSA signing functionality that outputs a single signature per session, such an attack cannot be simulated in the ideal model, and thus the protocol is not statistically secure.

-- Computational security: We prove that the protocol is nevertheless computationally secure based on the assumption that ECDSA is strongly unforgeable up to sign (i.e., up to the trivial $(r, \pm s)$ malleability), as defined by Groth and Shoup (EUROCRYPT '22). Specifically, complementing our split-view attack, we show that any adversary for which the protocol's execution is distinguishable from its ideal-model simulation can be efficiently transformed into an algorithm that breaks the strong unforgeability up to sign of ECDSA.

-- A refined statistically-secure protocol: Identifying the root cause of our split-view attack, we present a refined protocol that is statistically secure. Our refinement incorporates a lightweight consistency check, where each party sends a single group element as part of the protocol's third-round message. Our refinement additionally introduces a relaxed zero-sharing functionality that serves as a drop-in replacement for the original protocol's zero-sharing functionality. We show that this relaxed functionality can be unconditionally realized by a simple one-round protocol (executed in parallel with the first round of signing) without a dedicated setup or pre-shared seeds. Consequently, when paired with a compatible (e.g., Paillier-based) VOLE instantiation, this eliminates the need for long-term secure pairwise storage across the entire signing protocol.

A recent work by Hanzlik et al.~(Asiacrypt'25) introduced Tanuki, a family of blind-signature frameworks based on non-commutative cryptographic group actions. Tanuki develops new techniques to obtain concurrently secure blind signatures, and admits compact instantiations in two distinct regimes: (i) an isogeny-based instantiation from the CSI-FiSh group action with signatures of about 4.5 KB, and (ii) a code-based instantiation from LESS and the code-equivalence group action with signatures around 64 KB. To the best of our knowledge, these are the first efficient blind-signature constructions in the isogeny- and code-based settings that support concurrent executions.

Despite this advance, the Tanuki frameworks rely on a non-standard and interactive assumption, namely the so-called ``one more'' vectorization assumption. Given several structural attacks and vulnerabilities discovered in various group action instantiations, relying on non-standard assumptions can raise concerns.

In this work we present a new framework building upon Tanuki's techniques that achieves concurrent security while achieving better performance, and relying only on the standard group action hardness assumption, the vectorization problem (also known as the group action inversion problem). For the LESS instantiation, we apply dedicated code-based techniques to reduce signature sizes by a factor of 14.5. These improvements come with rigorous reductions to the standard problem, do not weaken the security claims, and are directly applicable to the LESS instantiations of Tanuki. As a result, our isogeny-based and code-based instantiations yield signature sizes of 8.89 and 8.84 KB, respectively, and retain concurrent security under the standard group-action inversion assumption.

In Geelen and Vercauteren~(Eurocrypt 2025), a Generalized BFV~(GBFV) fully homomorphic encryption scheme was proposed. Here, a plaintext space of form $\mathbb{Z}[x]/(\Phi(x),t(x))$ was utilized to reduce the number of Single Instruction Multiple Data (SIMD) slots within the initial BFV plaintext space. This lowered its dimension and thus enabled lower latencies as well as greater flexibility in parameter selection. However, to obtain slots of degree $1$, the methods of Geelen and Vercauteren limit the choice of plaintext modulus to that of large primes, which can be unnecessary for various use cases.

To resolve this, we propose a generalized method to perform FHE based on a subring of the plaintext polynomial ring. We utilize the decomposition ring $\mathcal{O}_{\mathbf{K}}$, with which when taking quotient with a rational prime $p$, already factors into residual fields of dimension $1$. From here, we develop methods to perform FHE on subrings of the decomposition ring $\mathcal{O}_{\mathbf{K}}$, which we refer to as the decomposition subring $\mathcal{O}_{\mathbf{M}}$. We introduce novel methods to enable both encoding and decoding maps within the decomposition subring $\mathcal{O}_{\mathbf{M}} \subset \mathcal{O}_{\mathbf{K}}$. By utilizing $\mathcal{O}_{\mathbf{M}}$, we further lower the dimension of the underlying ring, improving upon efficiency while retaining sufficient security. In experiments, we provide a proof-of-concept implementation, demonstrating up to a $5.06 \times$ improvement in the latency of operations for selected parameters. This approach offers enhanced flexibility in the selection of parameters for FHE with the subring dimension being any suitable divisor of $r$. This direction also represents the first generalization of the subring approach for FHE.

We present new frameworks for secure function evaluation (SFE) and private function evaluation (PFE) that support both Boolean and arithmetic circuits. While SFE requires multiple parties to jointly compute a \textit{public} circuit, PFE generalizes SFE by allowing one party to keep the circuit \textit{private}. Our work achieves the first linear-complexity PFE protocol with respect to both the number of parties $n$ and circuit size $m$, significantly improving upon prior PFE constructions that require $O(mn^2)$ complexity and are limited to Boolean circuits.