International Association
for Cryptologic Research

Worst-case to average-case reductions from lattice problems such as GapSVP and Bounded Distance Decoding (BDD) to the Learning with Errors (LWE) problem form the backbone of the security guarantees for lattice-based cryptography. However, these classic reductions are notoriously lossy: even assuming exponential hardness for worst-case lattice problems, they yield only subexponential lower bounds on the hardness of LWE. Recent work by Aggarwal, Leong, and Veliche (AMV, TCC'24) proposed a new perspective, quantifying hardness in terms of the \emph{maximum success probability} achievable by any efficient (PPT) algorithm, and provided nearly tight reductions for LWE in the polynomial-time regime. Nevertheless, their framework is inherently limited to polynomial-time adversaries, leaving open the question of how the tradeoff between running time and success probability for lattice problems governs the concrete security of LWE and SIS against powerful, time-rich adversaries.

In this work, we address this gap by systematically analyzing and tightly characterizing the time-success probability tradeoff for SVP and BDD, focusing on algorithms that exploit the fine-grained structure of slide-reduced bases. We present new blockwise guessing algorithms for SVP and BDD that utilize small-dimension SVP and CVP oracles; by leveraging the consecutive-product properties of Slide Reduction, we obtain the tightest known lower bounds on the success probability as a function of time. Assuming that we cannot do much better than this, we conjecture that no algorithm can outperform this tradeoff---for any subexponential time bound $T(n)=2^{o(n)}$, the success probability of solving worst-case SVP or BDD cannot exceed $2^{-\frac{n^2\log\log T(n)}{c\log T(n)}}$ for some constant $c>1$, up to polynomial factors.

Applying this conjecture, we derive sharply improved, modular worst-case to average-case reductions for LWE and SIS that are robust against all time-bounded adversaries, not just those restricted to polynomial time. Our results provide the first fine-grained, quantitative foundation for the bit-security of lattice-based cryptography across the full spectrum of adversarial resources, closing a key gap in both the theory and practice of cryptographic security reductions.

FrodoKEM, a key encapsulation mechanism based on the standard (unstructured) LWE assumption, is recommended as a conservative choice for post-quantum key exchange by agencies like BSI and ANSSI. As such, it has garnered substantial attention from an implementation security standpoint. In particular, several papers have looked into masking FrodoKEM, and, like for various other lattice-based cryptosystems, identified the Gaussian sampling operation as a major bottleneck. In FrodoKEM, it is carried out using a CDT-based sampler, which compares a uniformly random value in [0,1) (with fixed precision) to each of the probabilities in the cumulative distribution table of the target distribution.

Two recent works proposed masked gadgets at arbitrary order for that operation: one by Gérard and Guerreau (CASCADE 2026), which simply masks each of the comparisons with the table elements (using a ripple carry adder as the Boolean comparison circuit), and another by Eid et al. (TCHES 2026), that uses a novel approach based on a binary search tree, significantly reducing the number of masked comparisons for larger tables. Eid et al. also choose the Kogge-Stone adder as the basis for their comparison circuit.

In this paper, we provide an extensive analysis of the choices and trade-offs involved in masked CDT-based sampling, and propose several optimizations that further improve upon these previous works by a considerable margin. In particular, since FrodoKEM, like almost all the schemes that rely Gaussian sampling, generates hundreds of samples at a time, we find it beneficial to utilize approaches that lend themselves to a high degree of parallelization. This includes bitslicing (with which, importantly, the ripple carry adder has been proved optimal for comparisons), as well as techniques such as the use of algebraic normal form in masked multiplexers.

As a result, on an ARM Cortex-M4 STM32F4 target board, our companion implementation in pure C outperforms the hand-crafted assembly of Eid et al. (resp. Gérard-Guerreau) by a factor of around 2 (resp. 7 to 9) at masking order 1. The gap is even larger at higher order: we outperform the higher-order code of Eid et al. (in C with assembly for expensive gadgets) by a factor ranging from 5 at masking order 2 to 9 as masking order 8.

Multivariate interpolation arises in a wide range, including computer graphics, multi-secret sharing and secure multiparty computation. But its general representation is rarely discussed. In this note, a general representation for univariate interpolation and multivariate interpolation is formulated, which is helpful for multi-secret sharing illustrations and security arguments. The finding offers a new glimpse into the relation between Cramer rule and Lagrange interpolation formula.

Idempotent functions are an important class of Boolean functions, related to cryptography and coding theory.} This paper investigates $k$-idempotent functions, a natural generalization of {idempotent} functions. Based on two classes of Dillon-type bent functions proposed in {the paper ``New characterizations of Dillon-like hyperbent functions via Dickson polynomials", by Z. Tu, C. Li, X. Zeng, T. Helleseth and N. Li, 02 October 2025, Volume 38, article number 35, in Journal of Cryptology}, we establish the existence of $k$-idempotent bent functions {(that are not $l$-idempotents for $l

Exchanging data, assets and messages across various blockchain networks remains a challenge due to siloed blockchain ecosystems. Many interoperability solutions have addressed this challenge through bridges and relay chains. However, these solutions often reduce trust and privacy to achieve lower computational cost and delay. To address this gap, this paper prioritises trust and privacy while accepting increased computational cost and delay as a trade-off. We present the design and implementation of a Zero-Knowledge Proof (ZKP)-based prototype for privacy-preserving cross-chain verification in a Polkadot/Substrate-style environment. Circom and SnarkJS are used to generate Groth16 proofs off-chain, while a Rust verifier based on arkworks BN254 checks the proof in a Rust-based environment. After verification, the result is sent to a Substrate-style adapter. The prototype then records it, evaluates it through an interoperability decision layer, and tests it using an XCM-style simulation. The prototype demonstrates correct accept/reject behaviour: a valid proof is accepted, while a deliberately modified public input is rejected. Timing tests showed proof generation at 199 ms, SnarkJS valid-proof verification at 161 ms, tampered-proof rejection at 160 ms, and Rust Groth16 verification at 340 ms. The prototype successfully verified a SnarkJS-generated Groth16 proof in Rust, demonstrating a practical path from private proof generation to Polkadot-style interoperability control. A repeatability package containing selected proof artefacts, scripts, timing results, documentation, and demo commands supports independent review. The current XCM component remains a simulation; future work will extend the design into a full FRAME pallet and test live XCM dispatch.

The main objective of this paper is to acceler ate the post-processing of Quantum Key Distribution (QKD) using an energy-efficient pipelined architecture implemented on a Field-Programmable Gate Array (FPGA). The proposed architecture aims to improve processing speed while efficiently utilizing hardware resources. In addition, this work compares the proposed approach with existing approaches to demonstrate its performance and resource efficiency.

Private set operations (PSOs) let two parties compute set-theoretic functionalities on private inputs while revealing nothing beyond the prescribed output. While private set intersection (PSI) has become highly efficient, many other PSOs remain significantly more expensive. The most effective general framework for such tasks is based on reverse private membership test (RPMT), but even state-of-the-art RPMT constructions rely on heavy elliptic-curve-based primitives.

In this work, we propose a substantially faster RPMT protocol by replacing the elliptic-curve core with RLWE-based one. Our starting point is the Oblivious Key-Value Store (OKVS) based RPMT framework, whose direct adaptation to RLWE is obstructed by the batching structure of RLWE encryption. To address this, we introduce a batching-friendly variant of OKVS together with a homomorphic batched decoding procedure. We believe that this batching-friendly OKVS and its homomorphic decoding process may be of independent interest.

For a set size $2^{20}$, our RPMT-based PSO protocols take only about $3$ seconds over LAN network and $120$-$138$MB communication, whose running time is comparable to state-of-the-art PSI. Compared to state-of-the-art PSI-Cardinality and PSI-Card-SUM, this is up to \(13.0\times\) speedups. Compared to state-of-the-art PSU, this is up to \(3.0\times\) smaller communication while achieving comparable computational cost, which results in up to $3.9\times$ faster running time over WAN.

The Post-Quantum Cryptography Migration Interdisciplinary Lab (PQC-X) is a newly founded lab at XJTLU, led by Prof. Jintai DING, a globally recognized leader in Post-quantum Cryptography.

PQC-X invites applications for multiple fully funded PhD and Postdoctoral Research Fellow positions in the areas of post-quantum cryptography, advancing key technologies in post-quantum migration and facilitating their industry transfer.

Position Details

PhD Candidates: Open to applicants with a Bachelor’s or Master’s degree in a relevant field (students near completion are also encouraged to apply). A solid foundation in cryptography, mathematics, or computer science is required. Strong programming skills are a plus.
Postdoctoral Fellows: Applicants should hold a PhD in a related field (or near completion) and demonstrate a strong research track record, preferably with publications at leading IACR venues or security conferences.

Research topics include, but are not limited to:

Fundamental theoretical research covering multivariate-based, code-based, hash-based, isogeny-based and lattice-based cryptography.

Design new advanced post-quantum protocols.

AI-assisted post-quantum migration applications.

Efficient implementation technologies for autonomous and controllable post-quantum cryptographic hardware, software, and cloud services

Post-quantum cryptographic security protocol migration technologies for various industry information systems

Desired Qualifications

High motivation and ability to work both independently and collaboratively

Strong communication skills

Excellent academic writing and presentation abilities

How to Apply
Interested candidates should send their applications (including CV, academic transcripts and a brief statement of research interests) to [email protected]

Closing date for applications:

Contact: [email protected]

We are hiring three (3) researchers (post-doc or equivalent) for a project at the intersection of cryptography, agentic systems, and automated verifiable design.

Project: We are building an end-to-end framework that automates the specification, verification, and deployment of cryptographic protocols for multi-agent systems. LLM-driven agents explore the design space, synthesise protocols for specific security needs, and formally verify them (e.g. ProVerif, Lean) with machine-checkable proofs, exposed through the Verified Agentic Interaction Substrate (VAIS).

Details: School of Informatics, University of Edinburgh, UK. Salary: UoE Grade 7 (£41,064-48,822). Start: as soon as possible. Duration: 1 year, extension possible.

Essential

• Doctorate (or nearing completion) in Cryptography, Computer Science, Mathematics or related, specialising in applied/theoretical cryptography.
• Strong foundations in provable security (game- and simulation-based definitions).
• Familiarity with core cryptographic primitives and their security models (signatures, encryption, key exchange).
• Ability to reason formally about protocol composition.
• Track record of publications at recognised venues.

Desirable

• Hands-on experience with secure multi-party computation (MPC), including familiarity with function-to-protocol compilers such as SPDZ.
• Experience with zero-knowledge proof systems, including the design or use of ZK circuits and compatible compilers.
• Exposure to formal verification tools (e.g. ProVerif, CryptoVerif, Tamarin) or proof assistants (e.g. Lean), and an interest in bridging pen-and-paper proofs with machine-checkable ones.
• Programming skills for prototyping cryptographic tooling.
• Interest in AI/agentic systems and LLMs.

Closing date for applications:

Contact: Michele Ciampi ([email protected])

We now offer a new postdoctoral position in the field of Applied Cryptography and Privacy. The research is devoted to the broader area of privacy-preserving storage and computation outsourcing. Privacy-preserving computation outsourcing allows users to outsource computation tasks to a cloud server without revealing to the server anything about the user data or even what kind of computations the user is performing. The project will explore the applications of FHE (Fully Homomorphic Encryption) towards realizing such privacy-preserving systems. The position is funded through the Wallenberg AI, Autonomous Systems and Software Program (WASP). WASP is Sweden’s largest individual research program ever, a major national initiative for strategically motivated basic research, education, and faculty recruitment.

How to apply: Applications are to be submitted via the University’s recruitment system. Application link: https://lu.varbi.com/en/what:job/jobID:942295/

The application should include:

1. a CV including your educational qualifications, work experience, and a list of publications. The publications should mention all the co-authors (following the same author order as in the published version) and include DOIs or links to publicly accessible versions.
2. a personal letter justifying your interest in the position and how it matches your qualifications.
3. a research statement (no more than two pages).
4. The application should also include a degree certificate or equivalent and any other document to which you would like to draw attention (copies of grade transcripts, details of referees, letters of recommendation, etc.).
5. Contact details of at least two referees.

Application deadline: July 31, 2026.

Closing date for applications:

Contact: Debajyoti Das ([email protected])

More information: https://lu.varbi.com/en/what:job/jobID:942295/

The Foundational Cryptography group at IBM Research Zurich has an opening for a PhD position for research on cryptographic proof systems.

Position Details

-Funded for 4 years
-Possibility of joint supervision at EPFL
-Ideal start date late 2026 or early 2027

Research Project Overview

Cryptographic proof systems allow a prover to convince a verifier that a computation was performed correctly. These systems have applications in secure cloud computing, verifiable machine learning, and privacy-preserving technologies.

However, many proof systems require the prover to use significantly more time and memory than the original computation. The research will develop new proof systems with reduced time and memory overheads, making it practical to verify the integrity of large-scale computations efficiently.

Requirements

-MSc (or equivalent) in Computer Science or Mathematics (or another relevant field)

The ideal candidate would enjoy using a mixture of algebra, combinatorics, and probability to analyze and optimize algorithms. Strong background in one or more of the following areas is valuable:
-Cryptographic proof systems (zero-knowledge proofs, succinct arguments)
-Error-correcting codes and coding theory
-Streaming algorithms and memory-efficient computation
-Lightweight cryptography

Diversity & Work Environment

IBM is committed to fostering diversity and inclusion in the workplace. You will join an open, multicultural research environment that values different perspectives and supports flexible working arrangements. Our goal is to help all genders and backgrounds thrive professionally while maintaining a healthy work–life balance.

Closing date for applications:

Contact:

Please apply via https://www.zurich.ibm.com/careers/2026_022.html

If you have questions, please contact Jonathan Bootle at [email protected]

More information: https://www.zurich.ibm.com/careers/2026_022.html

The University of Oldenburg invites applications for a PhD student position in the Safety-Security-Interaction group, under the supervision of Prof. Dr. Andreas Peter and Dr. Federico Mazzone.

• Full-time position
• Start date: flexible, to be discussed with the applicant
• End date: 30 September 2030
• Research area: cryptography, privacy-enhancing technologies, and trustworthy AI, with a focus on applications to healthcare systems
• Possible research topics: homomorphic encryption, secure multi-party computation, differential privacy, secure collaborative machine learning, robustness, explainability, fairness, and auditability
• Position highlights:
• Goal of publishing at leading international conferences and journals in security, privacy, cryptography, and machine learning
• Full support for conference travel and international networking
• Young and growing research environment with close supervision
• Room to shape the PhD project according to the candidate’s interests
• Opportunities to collaborate with our many academic and non-academic partners
• Requirements:
• Master’s degree or equivalent in Computer Science, Mathematics, or a related field
• Strong background in cybersecurity and machine learning
• Good programming skills
• Excellent English level
• Application deadline: 31 July 2026

https://uol.de/en/job/wissenschaftlicher-mitarbeiterin-promotionsstelle-trustworthy-ai-1137

Closing date for applications:

Contact: Dr. Federico Mazzone ([email protected])

More information: https://uol.de/en/job/wissenschaftlicher-mitarbeiterin-promotionsstelle-trustworthy-ai-1137

FutureChips is a new postdoctoral program at Tampere University offering excellent researchers a 36-month fellowship in the field of next-generation semiconductor technologies. The fellows are given the opportunity to design their own research project addressing the program’s four interconnected semiconductor research areas: 1. Advanced materials, 2. Novel architectures, 3. Chip design, 4. Advanced packaging. Note: Hardware cryptography, secure processor architectures, chip security (attacks and countermeasures), and any novel security-related semiconductor research direction are within the scope of the program. The first call for applications (12 fellowships out of 20 total) will be open from July 1 to August 31, 2026. Fellows are expected to relocate to Tampere and to start their fellowship in July 2027. For more information: https://projects.tuni.fi/futurechips/

Closing date for applications:

Contact: For questions related to the security area, you may contact Markku-Juhani O. Saarinen: [email protected]

More information: https://projects.tuni.fi/futurechips/

In 2022, Cotan and Te{\c{s}}eleanu proposed an alternative RSA construction in which the modulus takes the form $N = pq$ and the exponents $(e,d)$ are linked through $ ed -1\equiv 0 \pmod{\psi_n(N)},\ n \geq 2, $ where $ \psi_n(N) = \frac{(p^n-1)(q^n-1)}{(p-1)(q-1)}. $ Their scheme was subsequently examined by Nitaj et al. at Africacrypt 2024, who demonstrated that the system becomes vulnerable when the secret exponent $d$ is less than $N^{0.292(n-1)}$. In the present work, we extend this line of cryptanalysis by developing a lattice-based technique targeting the same key congruence. Our approach succeeds in recovering the private parameters even for secret exponents greater than $N^{0.292(n-1)}$, thereby surpassing the previously known boundary. The factorization of $N$ is achieved in polynomial time, provided that its divisors $p$ and $q$ share a suitably portion of their least significant bits.

In a succinct proof protocol, a verifier gets assurance that an untrusted prover executed an agreed computation, without requiring the verifier to re-execute the computation itself. In little more than a decade, this area has undergone a remarkable transformation from theory to implemented systems. This activity is extremely exciting. But there is a catch. To apply succinct proofs, one needs to translate one's computation to a set of equations, or constraints. The required translation has so far completely blocked systematic support for numerical computations, namely those for which the bulk of the computation uses approximations of real numbers. This paper fills that void with the design, implementation, and evaluation of a system called Spain. The starting insight of Spain is that since numerical computations inherently have approximation error, the constraint formalism should likewise allow for approximate satisfiability. Based on this insight, Spain introduces a new proof protocol and new ways to translate computations to constraints. Spain's implementation improves over natural baselines by multiple orders of magnitude.

We revisit the question of securely compressing multiparty correlations using only symmetric cryptography. A *linear correlation* ${\cal C}$, defined by a linear subspace $C\subseteq \mathbb F^n$, samples a secret random ${\bf c}\in C$ and assigns to each party a fixed subset of the entries of ${\bf c}$. Gilboa and Ishai (Crypto 1999) and Cramer, Damgård and Ishai (TCC 2005) provide a general technique for securely compressing many independent samples from $\cal C$ by replicating independent keys of a pseudorandom function (PRF) among the parties. This implies a *pseudorandom correlation function* (PCF) for $\cal C$ from any PRF, where the PCF key size scales with the number of minimal-support codewords in $C$.

We observe that the above generalizes to other types of useful target correlations ${\cal C}_T$ by using a *secret* replication pattern obtained via a random secret assignment of parties in $\cal C$ to parties in ${\cal C}_T$.

We present several corollaries of this general blueprint. These include a re-derivation of two-party PCF constructions for VOLE and subfield-VOLE over small domains (Roy, Crypto 2022) as well as new multiparty PCFs for small-domain VOLE-style correlations, including scalar-vector multiplication triples and their authenticated variants. Finally, we discuss applications to secure computation.

The Internet of Medical Things (IoMT) is revolutionizing healthcare through real-time monitoring and personalized care, yet existing security solutions for resource-constrained IoMT devices often compromise between robust protection and computational efficiency. Additionally, various IoMT systems utilize different sets of encryption schemes, ranging from classical to post-quantum algorithms, tailored to their computational resources, operational constraints, and specific privacy challenges. This diversity highlights an urgent need for an adaptive and efficient, quantum-resistant security protocol applicable to these systems. We propose the Privacy-Preserving Hybrid Data Sharing ($P^2HDS$) framework, which integrates multiple classical and post-quantum encryption schemes to achieve strong security with enhanced efficiency. $P^2HDS$ formalizes a generalized hybrid encryption protocol that enables adaptive configuration based on security requirements and computational constraints. We employ game-theoretic analysis to model interactions between data owners and adversaries, determining the optimal combination of encryption schemes for data outsourcing to mitigate adversarial threats. Rigorous security analysis proves that $P^2HDS$ achieves indistinguishability under chosen-plaintext attack (IND-CPA) security in the random oracle model, provided at least one constituent scheme is IND-CPA-secure. Experimental results demonstrate that $P^2HDS$ delivers performance approximating the average of its constituent schemes while maintaining security comparable to the most secure component, making it a scalable, quantum-resistant, and adaptive solution for privacy-preserving IoMT edge applications.

Post-Compromise Security (PCS) expresses that even after a party has been compromised, it may be able to recover (or "heal") security afterwards. PCS has been extensively studied, and many end-to-end secure messaging applications include mechanisms, such as the double ratchet, to achieve it.

However, current approaches only work partially, and their healing effects are extremely limited. For example, recent work showed that due to real-world constraints such as resilience against state loss, even highly secure messengers such as Signal may not achieve it in practice. Moreover, since healing is session-specific, healing effects do not carry over to newly spawned sessions, different groups, or different services that use the same identity.

In this work, we tackle these issues by designing the first protocol that can provide PCS as a Service for identities through a third party. The major challenge is privacy: achieving PCS requires regular updates among participants, and involving a third party can lead to significant privacy concerns. Moreover, the type of update that PCS requires (updating a user's secret, but only once) seems to require servers to verify the users' identities in a way that contradicts the unlinkability required for privacy: the server should not learn anything about the users' activities.

We develop the 3PaaS protocol, including the first efficient zero-knowledge proofs for blind signatures, to achieve our goals, and even allow for revocation, without revealing the identity to the server. We formally analyze our protocol for high assurance, provide an implementation of our novel ZK building blocks, and show how our protocol could be used with a messaging application.

We initiate the formal study of "dead man switch cryptography" — the problem of cryptographically enforcing the fate of a long-lived secret upon the death of its sole keeper — either by releasing it exclusively to designated nominees or by provably destroying it. Despite the natural practical demand, no prior work formalizes this primitive.

We identify Dead Man's Switch (DMS) as a standalone cryptographic primitive with two modes: release and delete, capturing these dual functionalities. Our abstraction isolates the core conceptual properties of this primitive, and gives its first rigorous treatment in the UC framework. To realize the notion, we introduce Dealer-Controlled Evolving-Committee Proactive Secret Sharing (DC-EPSS), an extension of the Evolving-Committee Proactive Secret Sharing by Benhamouda et al. (TCC '20). We provide the UC formalization of DC-EPSS and instantiate it generically using the nested YOSO framework of Abraham, Chouatt, Damgard, Gilad, Stern, and Yakoubov.

Building on DC-EPSS, we realize DMS-release by coupling it with a multi-recipient authorized recovery mechanism based on a PKI infrastructure, a multi-recipient PKE, a key committing SKE, and NIZK proof systems, while DMS-delete directly follows from DC-EPSS instantiated in the delete mode. We prove the security of both constructions in the UC framework under standard assumptions.

Cryptographic hardware implementations often leak secret information through side channels. This can allow attackers to learn secret data, such as a cryptographic key, without any vulnerability in the cryptographic algorithm itself. A popular countermeasure to such attacks is masking, which ensures that processed data is independent of the secrets by splitting them into multiple independent shares, often at the cost of significant overhead in terms of required area, latency, and randomness. The composable PINI notion in the glitch-extended probing model ensures some degree of security against such side-channel analysis attacks, and guarantees that the circuit may be arbitrarily composed with other PINI circuits while maintaining the same security level. This allows for the secure implementation of arbitrary circuits using trivial composition, replacing elementary gates with "gadgets" realizing the same functionality in a PINI-secure manner. Up to now, PINI gadgets at arbitrary security order are limited to quadratic functions, i.e., 2-input gates, with the best known as HPC3.X realizing a 2-input multiplier in one clock cycle.

In this work, we present HPCC, the first low-latency 3-input multiplication gadget for arbitrary fields that maintains a constant latency of one cycle, independent of the number of shares. HPCC additionally allows for the computation of any number of multiplications in a single cycle with relatively little overhead when two of the three operands are identical. When instantiated with two shares and for $\mathbb{F}_2$, HPCC halves the previous record for lowest number of fresh masks required at comparable area cost. With more shares, HPCC is the only single-cycle gadget realizing 3-input multiplications in arbitrary fields. We leverage HPCC to implement the first composable AES S-Box with two cycles of latency with an arbitrary number of shares. This S-Box design significantly outperforms the previous record in terms of area and randomness when instantiated with three shares and stands as the only two-cycle solution for more shares.