International Association
for Cryptologic Research

Lattice-based cryptography is one of the most promising candidates for post-quantum cryptography. Decryption Failure Rate (DFR) is a critical metric for the correctness and security of lattice-based public-key encryption (PKE) schemes. At present, most DFR evaluation methods for lattice-based PKE with message encoding rely on oversimplified assumptions, rough approximations, and fail to fully exploit the geometric structure of special encoding lattices, resulting in loose or inaccurate bounds. To address these limitations, this paper proposes a refined DFR evaluation framework for lattice-based PKE with message encoding, focusing on two mainstream decoding paradigms: Maximum Likelihood Decoding (MLD) and Bounded Distance Decoding (BDD). For MLD-based schemes, we precisely characterize the minimal vectors of Barnes-Wall (BW) lattices and derive tighter union bounds by leveraging the encoding lattice structure. For BDD-based schemes, we introduce a noncentral chi-squared distribution based method to model mixed noise composed of Gaussian and discrete components, avoiding the inaccuracy of conventional pure Gaussian approximations. Furthermore, we extend the framework to algebraic-lattice-based PKE by analyzing the variance and correlation of polynomial product coefficients, and propose a weighted chi-squared distribution with saddlepoint approximation to handle correlated coefficients. We validate the proposed methods on representative lattice-based PKEs including CNTR, \scloud, and CNTR-Prime, resulting in the DFR upper bound approximate 15 bits decreasing for CNTR, 1 bit decreasing for \scloud, and at least 84 bits increasing for CNTR-Prime. The experimental results show that our refined analysis yields significantly tighter and more accurate DFR bounds compared with traditional approaches, providing a reliable theoretical basis for parameter selection and security certification of practical lattice-based cryptosystems.

The Large Norm attacks of Ducas-Espitau-Postlethwaite (CRYPTO 2023) on the $\mathsf{ISIS}$ problem have shown that small values of $q$ can be used to recover short solutions. This was applied to Falcon and Mitaka. Two issues are left, however. First, the cost model of the attack oversimplifies the BDGL sieve; it does not account for how long vectors will be distributed and treats two dependent probabilistic events as if they were independent, which results in an overestimation of the attack cost. Secondly, the analysis only deals with the $\ell_2$ norm and has not yet been extended to $\mathsf{ISIS}^\infty$, which underlies Dilithium-type systems. This work addresses both issues. First, we extend the cost model of the Large Norm attack by including the principal sieve length distribution into our estimation of success probabilities. In addition, we use a joint probability rather than an approximate factor where possible. Since all other parts of the original $\theta$ convolution framework are reused, the extension is relatively minor. We reduce the attack cost of Large Norm on Falcon-256 by a $\approx\!11\times$ cheaper model, and successfully forge a Mitaka-512 signature in $\approx\!4.5$ seconds at a higher success rate. We additionally introduce a closed-form $\ell_\infty$ variant as a Z-shape attack against Dilithium-type $\mathsf{ISIS}^{\infty}$ at small-to-moderate modulus, which succeeds in $\le\!1.6$ seconds across three presets.

We introduce the notion of canonical lifting for group actions. This generalises existing techniques for reducing the size of group-action-based signatures, such as the canonical forms used in the LESS signature scheme. Building on this framework, we construct a ring signature scheme and extend it to a linkable variant.

Our approach avoids the key-reuse mechanism for linkability of the framework by Beullens, Katsumata, and Pintore (ASIACRYPT'20), which was shown to be insecure for group actions arising from linear code equivalence (ASIACRYPT'24) and lattice isomorphism (CiC'25). The resulting signatures have size logarithmic in the ring size. We provide security proofs at the level of the abstract canonical-lifting framework, which are then inherited by concrete instantiations satisfying the required assumptions. Finally, we instantiate our approach using the linear code equivalence group action, obtaining a ring signature scheme, $\mathsf{CERES}$, and a linkable ring signature scheme, $\mathsf{CELERES}$. Both schemes achieve signature sizes that compare favourably with the state of the art, and our AVX2-optimised C implementation supports their practical applicability.

The quantum indifferentiability of the Merkle-Damgård (MD) domain extender is a foundational problem in post-quantum cryptography. Recently, Gorjan et al. identified critical flaws in existing consistency proofs for this construction, invalidating prior security guarantees.

Quantum indifferentiability proofs typically reduce to two oracle-indistinguishability games: the indistinguishability game and the consistency game. To analyze the systems arising in these games, we formalize and generalize Zhandry's compressed oracle proof technique into a modular quantum game-playing framework for systems constructed from random functions.

On the positive side, we develop an error-propagation technique within our framework to track coherence penalties and bad sampling branches for the consistency game. This yields a tight consistency bound of $O(q_s^{3/2}/2^{n/2})$, matching the optimal complexity of generic quantum collision attacks.

Benefiting from the same formalization, we also identify a fundamental obstruction in the indistinguishability game---a gap also present in Zhandry's original proof. Specifically, under sequential adaptive queries, the simulated quantum state inevitably leaks into the ``bad database'' subspace and yields a lower bound on the corresponding oracle deviation. This clarifies why completing the full quantum indifferentiability proof requires additional ideas.

An adaptor signature (AS) scheme extends a digital signature by tying together message authentication with the exchange of a secret. Such atomic exchange of a secret for a signature has key applications in blockchain protocols, e.g., payment channels, atomic swaps or coin-mixing. To ensure compatibility with the environments, AS schemes should be scriptless -- that is, their signatures should be verifiable using the same procedure used to validate transactions' signatures, without auxiliary logic or scripts.

As shown by Erwig et al. (PKC'21), it is impossible to construct scriptless AS for standard signature schemes with unique signatures. In contrast, Liu et al. (ASIACRYPT'24) demonstrated that dropping the scriptless requirement entirely makes AS construction for any EUF-CMA secure signature scheme straightforward.This raises a fundamental question: must we abandon scriptlessness entirely to construct AS for any signature scheme?

We answer this question in the negative by introducing the notion of almost scriptless AS. Here, the only relaxation is that the signature is applied to an extended message -- specifically, the concatenation of the original message and a random string (i.e., signing $m \| r$ instead of $m$). We argue that this mild extension preserves the core benefits of scriptlessness in blockchain applications.

We present a generic compiler that transforms any functional signature scheme into an AS, almost preserving the signature verification. In turn, show how indistinguishability obfuscation (in the CRS model) or witness encryption (in the ROM) allow turning any signature into a functional signature in a scriptless fashion. Both constructions ultimately yield almost scriptless AS for unique-witness (hard) relations and for any base signature.

The shortest vector problem (SVP) is central in lattice-based cryptography. In this paper, we focus on one of recent classes of algorithms for solving SVP: genetic algorithms (GAs) for lattice. In this paper, we propose the fastest GA to date for solving the SVP. From a search strategy perspective, our algorithm can be seen as an improved version of Fukase's algorithm. On the other hand, from a structure perspective, our algorithm is more than just an improved version of Fukase's algorithm. It is double-structured consisting of: (i) the inner GA, which inherits the basic structure from Fukase’s algorithm, and (ii) the outer GA, which optimizes the parameters used in the inner GA. The inner and outer GAs use mutually distinct objective functions. In our algorithm, we use two types of chromosomes and split the criterion for evaluation of chromosomes into two objective functions: the squared Euclidean norm for the inner GA and the evolution velocity of a lattice basis for the outer GA. The latter measures the velocity of the changes of the G-S sum, which is the sum of the squared lengths of the Gram-Schmidt orthogonalized vectors of a lattice basis, and is our novel criterion.

With the standardization of post-quantum digital signature schemes and their increasing deployment in security critical applications such as firmware authentication and software distribution, implementations are expected to operate in physically accessible and potentially hostile environments. Consequently, considerable effort has been devoted to protecting these schemes against a variety of attacks, including timing sidechannel attacks. However, evaluating their resilience against fault injection attacks remains equally important. Previous differential fault analysis (DFA) attacks on lattice-based signatures have primarily targeted intermediate values during signing and often relied on assumptions regarding rejection sampling or multiple fault injections.

In this work, we demonstrate that the challenge sampling procedure itself constitutes a practical attack surface. Specifically, We present fault attacks against the challenge sampling procedures of deterministic ML-DSA, a NIST-standardized signature scheme, and HAETAE, a KpqC-selected signature scheme, showing that a single faulted signature is sufficient to recover the secret key required for signature forgery. To the best of our knowledge, this is the first fault attack on HAETAE achieving secret-key recovery that enables the generation of valid forged signatures. Our attack model of ML-DSA does not require direct access to faulted challenges. Using only public information, we identify intended fault injections and distinguish them from unintended fault outcomes. We evaluate the method through simulation and practical fault injection, achieving a 100% identification rate for intended faults. We further propose a countermeasure for the identified vulnerability

Semantic search over vector databases is a fundamental problem in both theory and practice, with large-scale systems relying on approximate nearest-neighbor (ANN) algorithms to retrieve semantically similar results efficiently. Achieving this capability securely while keeping both data and queries hidden remains a major challenge. Existing secure semantic search systems incur high latency and fail to scale to realistic database sizes.

We present $\mathsf{BiSON}$, the first secure nearest-neighbor search protocol capable of supporting billion-scale encrypted vector databases. Even at this scale, $\mathsf{BiSON}$ answers queries in mere milliseconds and maintains search accuracy comparable to state-of-the-art insecure ANN algorithms, demonstrating that secure semantic search can be both private and truly high-performance. Compared to Compass, the prior state-of-the-art system, $\mathsf{BiSON}$ reduces communication up to $28\times$, improves end-to-end latency by up to $23.5\times$, and scales to datasets that are two orders of magnitude larger.

A central contribution of $\mathsf{BiSON}$ is a new disk-compatible Oblivious RAM (ORAM) architecture that enables seamless scaling to billion-point datasets without compromising latency or privacy. Together, these innovations make $\mathsf{BiSON}$ the first practical and scalable solution for secure semantic search at cloud scale.

Cross-chain atomic swaps enable decentralized asset exchange across independent ledgers, but their public transcripts may expose transaction flows, signer identities, and business relationships. Existing scriptless swap mechanisms based on adaptor signatures provide witness-coupled execution, yet the signer is public. Linkable ring adaptor signatures further hide the signer within a ring, but they do not support controlled opening when a completed swap becomes disputed. In this paper, we put forward ALRAS, an accountable anonymous cross-chain atomic-swap mechanism based on Pair-Consistent Threshold-Openable Linkable Ring Adaptor Signatures. We design a pair-consistent opening mechanism that binds a ring-adaptor pre-signature, an opening ciphertext, a scoped link tag, and the completed full signature to the same hidden signer. This mechanism prevents false-opening, ciphertext-substitution, and transcript-splicing attacks while requiring a threshold-governed and publicly verifiable opening in the dispute path. We construct a generic compiler from a NIZK-compatible, index-hiding LRAS using threshold ElGamal opening, consistency proofs, and public pair verification. We further formalize the signing-layer interface and security goals and analyze signer anonymity, scoped linkability, witness extractability, non-frameability, and pair-consistent opening soundness. A reproducible Python artifact provides reference modules, attack-oriented sanity tests, and operation-count benchmarks. The results show the expected linear scaling with ring size and isolate the accountability overhead introduced by threshold opening and transcript binding.

This paper presents RiskService, a modular risk assessment module integrated into the Q-OPSEC adaptive AI middleware for quantum cryptography. A synthetic dataset covering 58 features across nine groups, including behavioral, device, network, authentication, and LLM-derived signals, feeds a training pipeline evaluating six model families under class-imbalanced conditions. LightGBM achieves the best performance, with AUC-ROC of 0.9895, average precision of 0.9344, and Brier score of 0.0421 at threshold 0.60, with inference latency of 1.8ms. Deployment benchmarks across three hardware tiers confirm feasibility under constrained resources: quantized XGBoost runs in 54.2ms on the ESP32 with AUC-ROC of 0.9112, enabling a two-tier architecture where edge nodes perform preliminary screening and forward ambiguous events for full-precision regime determination. Calibrated risk scores govern the selection among classical TLS1.3, post-quantum, and hybrid key derivation paths in the Q-OPSEC cryptographic layer.

A basic property of lattice-based homomorphic encryption schemes is that ciphertexts carry an inherent noise that accumulates as computation advances. The key-switching procedure of these schemes allows the homomorphic re-encryption of a ciphertext under a new secret key, but it is a major source of noise growth. Several strategies have been proposed to reduce the amount of noise introduced by key-switching in the CKKS scheme. In this work, we generalize the RNS-based decomposition technique to an arbitrary number of input polynomials and secret keys. Performing multiple relinearizations and rotations in batch enables one to hoist the modulus lowering and decomposition steps of key-switching, respectively, which restricts noise growth and avoids redundant computation. We prove the security and correctness of all the proposed algorithms, and derive explicit noise bounds for them. Practical examples illustrate the impact of these optimizations on applications like private deep neural network inference. In addition, we provide—to the best of our knowledge—the first noise analysis of the double-hoisted BSGS matrix-vector multiplication algorithm of Bossuat et al. 2021, which is a building block of state-of-the-art CKKS bootstrapping circuits. Our analysis additionally reveals an optimization concerning the automorphism applications during its giant steps.

We present a new key recovery attack against the McEliece cryptosystem with binary Goppa codes that applies to a wide range of parameter sets. Earlier work already observed that homogeneous polynomials vanishing of higher order at the columns of the parity check matrix of a given code could be used to distinguish binary Goppa codes from random linear codes. This work now exploits the structure of these polynomials for key recovery. We illustrate the effectiveness of our approach by breaking a number of previously unbroken McEliece key recovery challenges published by the Technology Innovation Institute (TII). We conjecture that our approach also applies to Classic McEliece parameter sets and yields a key recovery algorithm with roughly the same complexity as the higher-order vanishing distinguisher. While this complexity is still significantly higher than the targeted security level of Classic McEliece parameter sets, this improves on currently known key recovery attacks.

The AEGIS family of authenticated encryption algorithms is built on a large state whose update function is a cascade of dependent AES rounds. For bitslicing, this looks like the worst possible case.

Yet the parallelism is already inside a single update: for example, an AEGIS-128L update applies one AES round to all eight state blocks at once, filling an eight-block bitsliced data path by itself.

We describe a sliced representation that keeps the rest of the cipher cheap too and lets AEGIS-128L run $2.5 times$ fewer parallel AES rounds per byte than bitsliced AES-128-CTR.

On ARM, RISC-V, and WebAssembly, the resulting constant-time implementations are faster than side-channel-hardened AES-GCM on every platform measured, the X2 variants by factors of two to six. In pure JavaScript, where bitwise operators are exactly 32 bits wide, the same layout is faster than the widely used pure-JavaScript implementations of AES-GCM and ChaCha20-Poly1305.

Higher-dimensional SQIsign variants use product and Kani-style isogeny representations to make response isogenies compact, checkable, or compatible with non-smooth degrees. These representations raise a foundations question: do they introduce genuinely higher-dimensional hardness, or do they preserve elliptic extraction while moving the additional assumptions into simulation? This paper gives a proof-theoretic separation between these two layers. We identify a recoverability condition under which an accepted higher-dimensional response publicly induces an elliptic Hom element; under the usual challenge-separation hypotheses, special soundness then extracts an elliptic \OneEnd witness. The remaining higher-dimensional assumptions are simulation assumptions, and we formulate them as non-interactive hint distributions.

The separation yields two concrete theorem packages. First, SQIsign2D--West admits an exact Fiat--Shamir-with-hints EUF-CMA theorem: the security loss is expressed through a simulation-hint \OneEnd assumption, the statistical simulator loss, the challenge-space term, and the commitment min-entropy term; a pushable uniform-hint corollary gives the EndRing-compatible interpretation under a named hint-indistinguishability assumption. Second, for SQIPrime2D we do not claim a proof for the published auxiliary sampler. We define and analyze \(\mathsf{SQIPrime2D\text{-}UAux}\), a foundations variant that replaces the published Algorithm-context AIO layer by a context-independent uniform auxiliary hint distribution. UAux is an ideal proof-model distribution unless an efficient represented sampler is separately supplied; an approximate sampler instantiates the theorems with an explicit additive sampling loss.

For this SQIPrime2D-UAux foundations variant, UAux gives a context-independent and exactly pushable replacement for the auxiliary AIO layer. We then introduce challenge-carrying uniform hints that additionally reveal the non-smooth challenge isogeny, the residual response isogeny, and the UAux auxiliary isogeny. These hints are stronger than ordinary SQIPrime auxiliary information, but they are fully pushable through the smooth self-reduction isogenies used in EndRing-style reductions. Consequently SQIPrime2D-UAux admits a fully pushable EndRing-compatible challenge-carrying hint layer, with a q-HintDist assumption separating simulation-shaped hints from the pushable distribution. None of these SQIPrime-side statements is a claim of plain EndRing security or a claim that the published SQIPrime2D AIO sampler itself is pushable.

Single-server PIR is a powerful cryptographic primitive that allows a client to retrieve public data from a remote server without revealing which item it accessed. Its privacy guarantee, however, inherently forces the server to do work linear in the database size, which is impractical at a large scale. Client-Preprocessing PIR (CP-PIR)~[Patel et al., CCS 2018] suggests to push linear computation to an offline preprocessing phase, enabling online queries with sublinear server computation and communication. While CP-PIR has since attracted considerable attention, designing an efficient preprocessing phase remains challenging. The original construction, along with much subsequent work~(e.g.,~[Zhou et al., S\&P 2024]), streams the entire database, which incurs linear communication that scales only to moderately sized data. A different approach consists of implementing the preprocessing using Fully Homomorphic Encryption (FHE) (e.g.,~[Corrigan-Gibbs et al., Eurocrypt 2022]), but the current best proposal (ThorPIR [Fisch et al., CCS 2024]) still imposes prohibitively expensive homomorphic computation on the server.

In this paper, we tackle the problem of designing a practical preprocessing phase for CP-PIR. We introduce RotPIR, a novel CP-PIR with a preprocessing that is simultaneously sublinear-communication (i.e., no database streaming) and computation-efficient, while keeping online communication and computation sublinear. RotPIR is obtained by co-designing our PIR protocol with the underlying FHE operations. Specifically, we propose an innovative preprocessing framework with an advanced homomorphic operator, {\em oblivious homomorphic rotation}, which enables the database to be rotated according to an encrypted offset, and significantly accelerates the offline server-side computation. Our experimental results show that RotPIR can achieve up to $1000\times$ speedup in offline server-side computation when compared to the state-of-the-art CP-PIR protocols that do not stream the entire database during the preprocessing.

We introduce Falafel, a modular scheme for Fast, Authenticated, Locally Attested FEderated Learning, with which parties can create a zero-knowledge proof of training (zkPoT) for Federated Learning (FL). The proof guarantees active security during the federated training process as well as publicly verifiable correctness of the final, trained model. All without revealing any additional information about the local datasets or intermediate local model states.

Specifically, our approach targets FL of (deep) neural networks with a centralized server for weight updates. Our zkPoT not only offers attestation for local training steps, but also for the centralized weight update, as well as taking into account input authenticity by introducing a trusted auditor. This way an external verifier can check the entire training process, from dataset to final model.

In contrast to prior work on zkPoTs, our construction solely relies on well-understood cryptographic assumptions and primitives, is highly parallelizable, and takes a modular approach. This modular (commit-and-prove) approach uses several novel core proof components, that could be swapped for other building blocks if desired. We show that, for LeNet, we generate a zkPoT of 70 kB in roughly 150 seconds for a single training round. Falafel’s prover time is in line with prior work, and its proof size is significantly smaller (10–15×), without relying on less-understood assumptions or instantiating Fiat–Shamir using arithmetic hash functions.

The EasyCrypt proof assistant has been used to successfully formalize security proofs for a wide variety of crypto- graphic primitives. However, attempts at formalizing objects with interactivity, such as protocols, have fared much worse. In this paper, we investigate (some of) the reasons for this difficulty by formalizing a simple interactive key agreement protocol. From a first complete but exploratory proof, to a failed attempt at a structured proof, and to what we believe is an “essential” proof, we identify which proof features contribute most to the complexity of formalization in pRHL. In particular, we argue that difficulties in formalizing the security of interactive protocols in the computational model arise from the fact that such proofs rely on both state and temporal invariants—the former to support cryptographic reasoning, and the latter to support reasoning about the protocol’s structure. We believe that this observation can help build new reasoning tools that can bridge the gap that currently exists between primitive-focused tools and protocol- focused tools.

Cryptographic migration, particularly in the post-quantum setting, poses significant practical challenges and requires reliable performance data to support sound engineering decisions. For ML-DSA, however, existing benchmarking practices often produce misleading or non-comparable results, complicating migration and cryptographic agility efforts. This paper analyzes common pitfalls in benchmarking ML-DSA signature operations, including subtle inconsistencies when comparing security levels. We show that execution-time variability of the ML-DSA signing algorithm - an inherent property due to rejection sampling and other data-dependent components - makes commonly used straightforward metrics, e.g., min/average/max, unsuitable for migration planning. To address this gap, we propose a robust benchmarking methodology based on standardized input data sets and clearly qualified reporting metrics. The proposed approach enables fair comparison across hardware and software implementations and supports designers of real-time systems to assess the worst-case execution time.

Post-quantum signature algorithms pose significant challenges for DNSSEC migration: their larger keys and signatures exceed DNS over UDP transport limits, making TCP fallback unavoidable even for the most compact schemes. We propose a differentiated algorithm selection, assigning distinct signature algorithms to the Zone Signing Key (ZSK) and Key Signing Key (KSK) roles. This approach expands the space of deployable post-quantum configurations beyond what undifferentiated selection permits, enabling algorithms that would otherwise be impossible to deploy: UOV, with 128-byte signatures but 43~KB keys, produces DNSKEY responses exceeding the 64~KB DNS limit under undifferentiated constraints, yet becomes viable when paired with a compact-key KSK. We also evaluate hybrid PQ/T schemes through signature concatenation, combining classical P256 with post-quantum algorithms in a single RRSIG record to provide dual security during the transition period.

Using a containerized testbed validated against AFNIC's .fr TLD structure (4.2 million domains), we systematically measure response sizes, resolution latency, TCP fallback rates, and signing performance across 18 configurations. Differentiated configurations achieve 1.28-1.52× latency overhead relative to classical ECDSA while enabling algorithms that undifferentiated constraints prohibit. Hybrid PQ/T concatenation introduces acceptable overhead (7--19%) for backward-compatible quantum resistance.

A Password-Authenticated Key Exchange (PAKE) protocol allows two parties to jointly establish a cryptographic session key, in the "password-only" setting where the only information shared in advance is a low-entropy password. In recent years, the One-encryption EKE with 2-round Feistel cipher (OEKE-2F) protocol, a compiler from Key Encapsulation Mechanism (KEM) to PAKE, has received much attention, for the following reasons: (1) When instantiated with the Diffie–Hellman KEM, it is the most computationally efficient PAKE protocol to date that is secure in the Universal Composability (UC) framework; and (2) When instantiated with a post-quantum KEM, it provides a generic way to construct efficient PAKE protocols based on post-quantum assumptions.

Unfortunately, the community cannot agree upon what the OEKE-2F protocol exactly is: part of the second protocol message is an RO hash of the KEM key, together with any number of the following:

- The password, - The KEM public key, - The first protocol message, and - The KEM ciphertext.

This yields 16 potential variants of OEKE-2F; only two of them have been studied in the literature, and their pros and cons are poorly understood.

In this work, we present a comprehensive analysis of *all 16 variants* of OEKE-2F, proving the UC-security of each of them. The general takeaway is that the "hash everything" version requires the fewest security properties of the underlying KEM scheme, and the more items we remove from the hash, the more security requirements the KEM scheme has to satisfy — although all of the additional KEM properties are still mild. We pinpoint the exact KEM properties each version of OEKE-2F needs, and thoroughly explain the rationales.

The significance of this work lies in that it helps the community converge upon the "right" version of OEKE-2F, and perhaps also in that this is the first paper by the author that is over 100 pages.