International Association
for Cryptologic Research

A Proof of Space, PoS, as introduced by Dziembowski et al. [CRYPTO'15], is a two-phase protocol that enables a Prover to convince an efficient Verifier that it has allocated a large amount of persistent memory to storing some information.

To our knowledge, all existing PoS protocols are only known to be secure in the random oracle model (or under ad hoc assumptions about cryptographic assumptions). We provide an elementary framework for constructing PoS from a combination of derandomization assumptions and cryptographic assumptions.

We provide a few simple instantiations of the framework. We show that non-trivial PoS follow from (a) $\mathsf{E}=\mathsf{DTIME[2^{O(n)}]}$ is hard for exponential-size nondeterministic circuits (an assumption introduced to show $\mathsf{AM}=\mathsf{NP}$), and (b) collision-resistant hash functions. We also show that PoS with nearly optimal parameters and interaction pattern follows from assumption (a) above and (c) SNARGs for $\mathsf{P}$.

The Sumcheck protocol is a cornerstone of modern proof systems, yet its prover remains a performance bottleneck. Even in the multilinear case, the repeated construction of round polynomials leads to significant overhead, limiting scalability in practice. We take a different approach: instead of modifying the protocol, we rethink the representation of multilinear polynomials. We show that any multilinear polynomial admits a simple and structured binary-tree circuit representation, where each node follows a clean recursive rule. This perspective is not merely conceptual; it directly translates into faster algorithms. Our circuit view unifies three core operations: evaluation, summation over the Boolean hypercube, and Sumcheck round generation within a single framework. Construction from the coefficient vector costs exactly nN field operations, and evaluation via bottom-up folding requires exactly N − 1 multiplications — optimal for this class of algorithms. A key structural property of the circuit is its regularity: fixed depth, local recurrences, and no data-dependent branching. This is not incidental — it is a direct consequence of the recursive decomposition, and it is precisely what makes the representation amenable to parallel execution and hardware acceleration. We implement our approach in Rust on the BN254 scalar field and benchmark it against ark-poly with parallelism enabled on both sides. At n = 20, our parallel evaluation kernel achieves a 3.4× speedup over ark-poly (14 ms vs 48 ms). The verifier completes in under 1 μs across all tested dimensions, yielding a prover-to-verifier ratio exceeding 105 at n = 20. Our results suggest that revisiting polynomial representations is a promising direction for accelerating fundamental primitives in proof systems.

Side-channel analysis (SCA) attacks rely on leakage from a target device. It is common to assume that linear operations implemented by XOR gates produce symmetric leakage and carry negligible side-channel information. In practice, leakage from XOR gates produces complex, non-independent, and time-varying asymmetric behavior.

The paper introduces Feature Estimation based Attacks (FEbA) -- a dedicated profiling attack that exploits these asymmetries. The attack is versatile; it was demonstrated to be successful against the sharing and refreshing phases in masking-based implementations by greatly narrowing the guessing key space, with no access to intermediate values.

Such attacks have implications for designs such as ASCON, GIBBON, and ACE, where XORs that utilize the key are vulnerable to attacks regardless of the inherent SCA protection levels used in them (e.g., sponge $rate$, the leak-free components for re-keying, and masking order $d$).

Experimental results indicate that the entropy of a $32$-bit key can be reduced below $1$ bit using (up to) $20,000$ traces from a standalone XOR without any access to intermediate values, or below $500$ traces with access to intermediate values.

Post-quantum cryptography (PQC) standardisation reached a pivotal milestone in August 2024 with the release of NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA), yet the vast majority of deployed public-key infrastructure continues to rely on RSA-2048 and Elliptic Curve Diffie-Hellman (ECDH), both vulnerable to Shor's algorithm on a cryptographically relevant quantum computer. The Harvest Now, Decrypt Later (HNDL) threat renders this risk operationally present: adversaries may archive ciphertext today for future decryption once a Cryptographically Relevant Quantum Computer (CRQC) becomes available.

This paper proposes the Crypto-Agility Readiness Score (CARS), a five-dimension weighted composite index for assessing PQC migration readiness in legacy systems across PKI, TLS, and HSM environments. CARS operationalises five dimensions -- Inventory Completeness, Algorithm Compliance, Architectural Decoupling, Toolchain Readiness, and Governance & Compliance Alignment -- with weights derived via a two-round Delphi process with 12 senior migration engineers.

In an empirical evaluation of 43 open-source cryptographic software repositories, mean CARS values were 24.9 +/- 9.5 (Legacy Crypto Libraries), 25.8 +/- 8.2 (PKI/Certificate Management), 39.7 +/- 15.2 (HSM/PKCS11 Middleware), 47.2 +/- 16.5 (TLS 1.3 Hybrid), and 47.5 +/- 11.1 (PQC Native; overall 34.1 +/- 15.0, n=43). A notable result is that PQC reference implementations score in the At-Risk range despite high Algorithm Compliance (d2 >= 0.61), because Architectural Decoupling (d3) is near zero, confirming that algorithmic presence alone does not imply organisational migration readiness.

Category differences are statistically significant (Kruskal-Wallis H(4) = 17.55, p = 0.0015, epsilon^2 = 0.357, large effect). Construct validity is supported by a moderate convergent Spearman correlation between Algorithm Compliance and Toolchain Readiness (rho = 0.558, p < 0.001, n = 43) and discriminant independence from Architectural Decoupling (rho = -0.031, p = 0.843). A longitudinal case study on oqs-provider (v0.3.0 to v0.6.0) demonstrates that CARS tracks real migration progress (Delta CARS = +21 pts). Microbenchmarks show ML-KEM-768 completes a full KEM cycle in 0.28 ms versus 2.87 ms for RSA-2048 (10.2x faster); authors' own measurements on Apple M1 Pro ARM64 (liboqs-python v0.15.0, n=10,000) confirm the ratio is preserved (M1 Pro: 0.051 ms full KEM cycle). A hybrid TLS 1.3 handshake (X25519MLKEM768) adds approximately 1.29 ms incremental overhead over ECDHE-only. CARS may support structured prioritisation of migration efforts; external predictive validation against migration outcomes remains future work.

SMAC is a recently proposed by Wang et al.~stand-alone Message Authentication Code (MAC) constructed from repeated applications of the AES round function and featuring an aggregation mode, SMAC-1$\times n$, for scalable parallel processing. Although originally designed for high-throughput CPU implementations leveraging AES-NI instructions, its structural properties suggest strong compatibility with hardware parallelism. However, no systematic FPGA-oriented architectural study of SMAC has been reported. This paper presents a scalable FPGA architecture of SMAC implemented on a Xilinx Kintex UltraScale+ KCU116 platform. The $\Pi$ transformation is evaluated in a single clock cycle using fully combinational AES rounds, and throughput scaling is achieved through physical replication of aggregation lanes. All SMAC-1$\times n$ configurations up to $n=16$ are implemented and evaluated. Post-implementation results achieve maximum operating frequencies up to 526\,MHz and peak throughput of 731\,Gbps for SMAC-1$\times 16$. The design exhibits near-linear throughput scaling up to eight lanes and reaches a maximum efficiency of 24.5\,Mbps/slice. These results demonstrate that SMAC’s round-based construction is well suited for FPGA parallelism and enables competitive high-throughput hardware MAC acceleration.

In lattice sieving, the sphere model assumes that sieving elements are distributed close to or on a sphere with uniformly distributed direction. It is extensively used to predict how lattice sieving behaves. In the sphere model the probability that a random pair of vectors reduces is asymptotically $p_n={(3/4)}^{n/2}/\sqrt{3\pi n/8}$. In practice sieving algorithms have been observed to perform better than predicted by the sphere model. It is an open question how this gap behaves asymptotically: does the gap vanish or grow as the dimension grows?

Our work answers this question by showing that it is asymptotically constant. We generalise the sphere model to uniform ball and non-uniform ball models and analyse reduction probability distributions. We find that asymptotically the input distribution only affects the total reduction probability, not the shape of the output length distribution. We show that the reduction probability advantages of our models over the sphere model range from $\times 1.5$ up to $\times 8$.

Distributed cryptography is a new cryptographic paradigm that enables fine-grained decryption capabilities in a trustless setting. In a distributed monotone-policy encryption scheme, users generate their own public and private keys. Thereafter, one can encrypt a message with respect to an arbitrary set of public keys together with an access policy. Any group of users that satisfies the access policy can recover the message; conversely, the message is computationally hidden from any group of users that does not satisfy the policy. The key requirement is succinctness: the size of the ciphertext should be sublinear in the size of the access policy. Distributed monotone-policy encryption generalizes related notions like distributed broadcast encryption (where the access policy is set membership) and silent threshold encryption (where the access policy is a threshold policy). In this work, we achieve the following:

- First, we give the first optimal distributed monotone-policy encryption scheme for the class of DNF policies from the decomposed LWE assumption in the random oracle model. Here, optimal means that the size of the public parameters, the user public keys, and the size of the ciphertext are independent of the size of the policy. As a corollary, we also obtain a (reusable) succinct computational secret sharing scheme for DNFs from decomposed LWE in the random oracle model.

- Next, we show how to adapt our techniques to obtain a distributed monotone-policy encryption scheme for $k$-DNFs in the plain model where the size of the ciphertext is $k \cdot L^{1/2}$, $k$ is the maximum size of each min-term, and $L$ is the number of min-terms in the DNF. This is the first scheme from the decomposed LWE assumption in the plain model. If we settle for a much weaker notion of selective security, then we also achieve full succinctness in the plain model (i.e., where the ciphertext size is independent of the size of the DNF).

- By specializing our results to the setting of broadcast encryption, we obtain an adaptively-secure distributed broadcast encryption scheme with ciphertext size $|S|^{2/3}$, where $|S|$ is the size of the broadcast set. Security relies on decomposed LWE (with a polynomial modulus-to-noise ratio) in the plain model. This scheme is the first lattice-based scheme with adaptive security that supports an a priori unbounded number of users in the plain model. Previous lattice-based distributed broadcast encryption schemes with adaptive security in the plain model assumed an a priori bound on the number of users (but achieved optimal-size ciphertexts that are independent of the size of the broadcast set).

We derive an explicit exponent \(\Psi_\rho\) that bounds the Reed--Solomon MCA bad-slope numerator at every fixed relative radius between Johnson and capacity. The resulting positive-relative-radius exponential-budget safe-frontier certificate strictly improves the smallest-test MDS exponent and gives a constant post-Johnson radius for every positive usable budget exponent. An all-test-size MDS circuit-incidence envelope gives exact large-field capacity plateaux, improved adjacent thresholds, and four explicit length-\(512\), \(2^{-128}\)-secure smooth multiplicative certificates beyond Johnson. An exact CA--MCA decomposition gives challenge-restricted, endpoint-exact linear-budget thresholds through asymptotically half the minimum distance, and monomial equivalence transfers the applicable bounds to circle presentations. A Gowers--cube argument proves primitive max-fiber flatness from an image-normalized Sidon payment at an accessible moment order. The unrestricted subexponential-budget smooth/circle frontier remains open because shortening has positive exponential cost and the analytic payment, residual ray compiler, profile add-back, and matching attacks are not yet available.

Fixed‑weight sampling is a core primitive in many post‑quantum schemes, including the HQC key encapsulation mechanism. An early implementation of fixed-weight vector sampling in HQC was shown by Guo et al. (CHES 2022) to suffer from a timing side-channel vulnerability, leading to complete key recovery. This timing side-channel was fixed in the current HQC version, however, power side-channel leakage is not addressed. In this work, we demonstrate that fixed-weight vector sampling in HQC is vulnerable to power side-channel attacks and present two practical attacks.

First, we construct a power-based distinguisher targeting the support-vector generation and employ the strategy developed by Guo et al. (CHES 2022) to recover the shared key. Our attack recovers the key with a 100% success rate using 900,000 distinguisher calls. On these grounds, we evaluate hiding countermeasures based on dummy operations and find that they linearly increase the trace requirement for a successful distinguishing attack by the number of dummy operations.

Second, we target a masked software implementation of the fixed-weight vector sampling in HQC and demonstrate a single‑trace attack on the support conversion that recovers the secret key, again with a success rate of 100%. We then discuss leakage attribution, specifically how shares are unintentionally recombined. Finally, we investigate how hiding techniques such as bitslicing, shuffling, and dummy operations can enhance the security of the implementation. In particular, the use of shuffling can lead to a complete prevention of our attack.

Our results show that fixed-weight vector sampling of HQC is highly susceptible to power side-channel analysis. In particular, our results highlight that a combination of masking and hiding is required to effectively protect the implementations.

EME is a parallelizable encrypt-mix-encrypt wide-block construction proved secure for m-block messages only in the range m <= n, where n is the block length of the underlying block cipher. Halevi and Rogaway justified this restriction by giving a splicing distinguisher for m >= n + 2, but left open the first excluded length, m = n + 1. We resolve that boundary for the direct, unrefreshed EME-core extension beyond its specified m <= n domain: the original formulas are applied to m = n + 1 blocks while continuing to use the same global mask. Under one fixed tweak, two encryption queries and one decryption query distinguish this extension from a random permutation. The result applies to this unrefreshed extension; refreshed variants such as EME* and IEEE EME2-AES are outside the scope of the distinguisher. The boundary attack is not a shortened form of the known zero-sum attack. At m = n + 1, the non-first coefficients have no nonempty zero-sum; instead, they form a basis and therefore uniquely represent the coefficient 1. Combining this representation with the special equation for the first mixed block gives the cancellation needed for a ciphertext splice. The same mechanism applies to Sarkar's EMME framework: when multiplication by the field element x is replaced by a linear operator psi with degree-n minimal polynomial, the minimal-polynomial relation supplies the corresponding operator identity. EME* and IEEE EME2-AES avoid this setting by refreshing the mask at chunk boundaries. The attack identifies the algebraic obstruction that such refresh steps avoid.

GRAFHEN is a group-based fully homomorphic encryption scheme in which public rewriting rules hide a permutation representation used for decryption. We give a framework for equivalent-key recovery for GRAFHEN instances based on symmetric groups, together with a practical attack that succeeds on every released challenge, including the recommended semidirect construction based on $S_{11}$ with five generators per copy. The recovered generators are determined only up to simultaneous conjugation, which is the natural isomorphism ambiguity of the public presentation. Known-zero ciphertexts transport the decryption subgroup under this conjugation, so the recovered representation suffices to decrypt the challenge ciphertexts. Our attack, HEnbane, first derives short consequences by two complementary procedures: bounded congruence closure and direct cancellation between public rules with a common right-hand side. The closure also supplies generator-order multiples. It then reconstructs one generator tuple by conflict-driven search over partial permutation tables and recovers the second tuple from the public mixed relations in semidirect instances. The reduction and reconstruction problems are parameterized by the permutation degree and generator count rather than by a particular challenge key. The experiments establish practical success for all released instances, while the analysis makes no distributional running-time claim for larger parameter choices in general. The attack shows that the published count of approximately $2^{101}$ equivalence classes is not an attack-cost estimate at the recommended parameters.

This short note discusses in detail a folklore but little-known hybrid hash function grounded on both the discrete logarithm and short integer solution problems. In particular, specific satisfactory parameters are provided to ensure the standard $128$-bit security level for the lattice problem with $256$-bit module, which may be useful in its own right. The hash function is a natural generalization of the classical Pedersen and Ajtai ones. Nevertheless, to the authors' knowledge, no one has previously explicitly analysed their hybrid version. Besides, the obtained result is probably prone to significant further optimizations by applying many tricks from elliptic curve and lattice cryptographies. Hashing is known to be a basic operation for constructing more complex and important hybrid cryptographic schemes. The authors intend to explore this in future articles. However, the hash function under consideration may be precious by itself due to its double provable security. Thus, this introductory work represents a kind of reincarnation of curve-based cryptography whose development has been severely and unfairly undermined by the potential but still vague quantum threat.

This paper proposes a high-speed hardware accelerator for QR-UOV, a multivariate scheme, that executes all three operations: key generation, signature generation, and signature verification. QR-UOV utilizes a quotient polynomial ring structure to reduce the public-key size of the original UOV scheme; however, this introduces functional requirements distinct from other multivariate schemes, such as polynomial-matrix operations over $\mathbb{F}_{q^\ell}$, coefficient expansion for the Mersenne prime field $\mathbb{F}_{q}$, and the expansion of symmetric matrices generated in a compressed form. To accelerate polynomial-matrix multiplication over $\mathbb{F}_{q^\ell}$, the proposed architecture employs a $D \times D$ systolic array ($D$ is the parallelization factor), in which each PE internally contains a polynomial multiply-accumulate unit. For signature verification, the architecture also incorporates a quadratic-form operation unit without explicitly storing the intermediate vector--matrix products. In addition, to ensure a regular data supply from key expansion to matrix operations, the architecture incorporates on-the-fly rejection sampling, which exploits the property that AES-CTR output blocks can be generated independently, as well as an expansion process for the symmetric matrices in compressed form. Furthermore, the architecture enables pipelined processing, overlapping the $i$-th polynomial-matrix operation with the $(i+1)$-th public-key expansion. FPGA evaluation shows that the proposed hardware executes key generation, signature generation, and signature verification in 0.74 ms, 0.28 ms, and 0.19 ms, respectively, at security level I. Furthermore, we confirm that the proposed hardware exhibits a lower LUT-time product than that of existing UOV hardware.

We provide the first construction of identity-based encryption from isogeny-based assumptions. Security of our construction relies on a novel assumption called the "CDH with Mismatched Torsion” (CD-HwMT) assumption, which we introduce. At a high level, the assumption posits the hardness of solving a CDH-like problem even when the adversary is given some additional “safe” leakage. We justify our assumption by showing that, in the Algebraic Isogeny Model, our assumption reduces to well-known assumptions from the literature.

As a bonus feature, our identity-based encryption enjoys anonymity, which means that the ciphertexts hide not only the message but also the target identity. We additionally obtain the first isogeny based constructions of laconic oblivious transfer, as well as public-key encryption that simultaneously satisfies security against high-rate key leakage and key-dependent message/circular security from the CDHwMT assumption. All our constructions can be conjectured to be post-quantum secure.

At the heart of our results lie several new techniques, which we believe will help in building even more advanced cryptography in isogeny-land.

Event date: 24 August to 26 August 2026
Submission deadline: 31 July 2026
Notification: 7 August 2026

Event date: 13 December to 15 December 2026
Submission deadline: 15 September 2026

Event date: to
Submission deadline: 30 November 2026

Event date: 12 November to 13 November 2026
Submission deadline: 7 September 2026
Notification: 5 October 2026

Classical deep learning for differential cryptanalysis requires millions of ciphertext pairs, rendering attacks infeasible or easily detectable. This work overcomes this data limitation by introducing quantum differential distinguishers, enabling a practical attacker model where executing few queries is feasible. We design these distinguishers via quantum machine learning based on variational quantum circuits. To address circuit design challenges, we propose QuantumScouter, a reinforcement learning method that discovers compact quantum circuits. Unlike prior work, QuantumScouter explicitly targets metrics like gate count and circuit depth, producing circuits suitable for noisy intermediate-scale quantum hardware. We apply QuantumScouter to the SPECK32/64 and SIMON32/64 ciphers. The models are trained to distinguish ciphertext pairs possessing a meaningful differential from completely random pairs. For SPECK, our approach achieves $0.80$ accuracy, outperforming the $0.53$ of prior work while reducing required qubits from $16$ to $6$. For SIMON, we establish a novel quantum baseline with $0.75$ accuracy. Notably, under a restricted regime of merely $400$ training samples, classical deep learning models struggle. A simple MLP with $361$ parameters fails to capture differential characteristics, resulting in an accuracy of $0.51$, while a deep ResNet with $64{,}737$ parameters overfits to yield an accuracy of $0.55$. In stark contrast, our data-efficient quantum distinguisher extracts meaningful features using only $49$ gates, maintaining $0.80$ accuracy.

We present Trout++, a complete threshold signing suite for ECDSA signatures. Trout++ descends from the recent Trout protocol (Dahari-Garbian, Nof, and Parker, ACM CCS 2025) and inherits its transparent setup, two-round structure, and strong security guarantees, while introducing several significant improvements.

Unlike Trout, Trout++ offers pre-signing, where the first round is key-, signing-set-, and message- independent. This property is not only important in its own right but also enables us to apply the ROAST transformation (Ruffing, Ronge, Jin, Schneider-Bensch, and Schröder, ACM CCS 2022) to our protocol, yielding the \textit{first} arbitrary-threshold (including with a dishonest majority), robust, asynchronous signing protocol for ECDSA signatures.

Furthermore, we introduce several optimizations to the building blocks in Trout that reduce both bandwidth and computation. Our benchmark results show that our implementation of Trout++ is approximately twice as fast \emph{and} twice as small compared to the prior implementation of Trout. We also present a constant-time implementation with running time that is \textit{ten times faster} than Trout's constant-time implementation.

Finally, we show how Trout++ can be composed with an account derivation scheme that does not require additional setups per derivation, enabling more practical solutions for managing key material.

In total, we achieve complexities and functionality comparable to, and closing the gap with, leading solutions for Schnorr signatures (such as FROST).