International Association
for Cryptologic Research

Recently, Shark (S\&P'25) considered the problem of actively two-party secure machine learning inference using an authenticated distributed comparison function (DCF). This is the state-of-the-art work in this setting. On the other hand, Grotto (CCS'23) built a variant DCF with the key size half that of classic DCF. Unfortunately, as Shark states, \textit{it is not known how to extend Grotto to the malicious setting}. In this paper, we present the first actively secure Grotto-style DCF scheme. Our authenticated DCF is deliberately designed on the correlated GGM tree and maintains the key-size advantage of semi-honest Grotto. We further implement an actively secure ML inference framework, named LightShark, which supports efficient primitives (e.g., ReLU, spline, and truncation) and ML models (e.g., VGG-16, GPT, BERT). Compared with Shark, our LightShark outperforms by $1.49 \times \sim 2.69\times$ and reduces communication costs by $66.7\%$ for Bert-base inference. Surprisingly, for larger LLM models, the experimental evaluation demonstrates that our framework works vastly well.

We prove that under a plausible heuristic assumption (on the smoothness of certain random integers), the supersingular isogeny problem can be solved in time and memory $p^{1/3 + o(1)}$. This improves upon the previous best complexity of $p^{1/2} \cdot(\log p)^{O(1)}$. This problem is arguably the central hard problem underlying isogeny-based cryptography, and the cost of its resolution is a major (and often the only) factor in the choice of secure parameters. The impact on concrete parameter sets remains to be clarified, as the asymptotic advantage of the new algorithm is mitigated by a superpolynomial overhead hiding in the $o(1)$ exponent, and by its high memory requirement.

Hybrid homomorphic encryption (HHE) lets a constrained client send compact symmetric ciphertexts while a server transciphers them into homomorphic ciphertexts, making HE-friendly ciphers such as PASTA a practical choice. Efficient and side-channel-secure execution of PASTA on embedded devices, however, remains challenging, since existing hardware relies on dedicated cipher cores and provides no side-channel protection. We present a hardware/software co-design of PASTA on RISQrypt, an existing post-quantum cryptography (PQC) platform, without adding any cipher-specific RTL. The affine layers, S-boxes, and SHAKE128 sampling are executed by the platform's arithmetic and Keccak accelerators under software control. We further integrate first-order arithmetic masking by reusing the masking accelerator for share refreshing and masked-multiplication randomness, requiring no additional hardware while keeping arithmetic on secret shares off the processor datapath. The masked multiplication shows no first-order leakage in a TVLA evaluation with $100\,000$ traces on an Artix-7 FPGA. Compared with a software-only baseline on the same core, the co-design achieves speed-ups of $9.68\times$ and $9.85\times$ in the unmasked and masked configurations, respectively. To the best of our knowledge, this is the first side-channel-protected, hardware-accelerated implementation of PASTA.

Confidential sources are vital for investigative journalism and thus for holding those in power to account. However, sources often face great risks to their privacy and safety. SecureDrop is a system that enables sources to anonymously contact journalists, including at major news organisations around the world. Despite its widespread use, the current design requires physical servers hosted on premises. While cloud-based deployment would alleviate this burdensome requirement and improve SecureDrop's usability and accessibility, it would also introduce new threats to security that are not addressed by the current design. In particular, a lack of end-to-end encryption presents serious risks in the event that a cloud service provider is coerced into revealing information.

In this work, we present and formally analyse a new protocol for SecureDrop which addresses the challenges of off-premises deployment. Our protocol composes an encryption scheme with hybrid post-quantum guarantees and an identity-hiding message-fetching mechanism to provide strong anonymity guarantees. In contrast to existing systems, we minimise incriminating evidence against whistleblowers by providing message-level deniability and by having sources remain stateless. Our formal security analysis combines the Tamarin prover for symbolic analysis and game-based proofs for computational analysis. Finally, our benchmarks demonstrate that the protocol achieves practical levels of performance in a browser context. The Freedom of the Press Foundation plans to deploy the new protocol, with integration efforts beginning in 2026.

Recent algorithmic advancements in the Multi-Party Computation-in-the-Head (MPCitH) paradigm have resulted in more efficient post-quantum digital signature schemes. MQOM is a MPCitH-based digital signature scheme and candidate in the ongoing NIST Post-Quantum Cryptography (PQC) standardization effort, offering performance competitive with lattice- and multivariate-based schemes in software. In this work, we develop a dedicated hardware accelerator for MQOM and analyze the impact of recent algorithmic modifications on hardware performance. This is achieved through the careful co-design of high-throughput symmetric primitive engines and highly-optimized polynomial arithmetic cores, minimizing stalling and supporting entirely on-the-fly computations of all polynomial arithmetic. As a result, no intermediate buffers are required and re-computation or sampling is avoided. Secondly, we analyze MQOM's use of correlated GGM trees for generating MPC party shares, which reduce computational cost at the cost of increased signature size. We observe that this choice leads to increased design flexibility and significantly reduces on-chip memory requirements for hardware designs. Furthermore, MQOM proposes several parameter sets per security level. We analyze the impact of different MQOM parameter sets on hardware cost and performance. Our design with NIST L1 parameters only requires 15 812/9 384 LUTs/FFs and 4.5 BRAMs on FPGA, while performing the signature generation in 0.46 ms and signature verification in 0.38 ms. Compared to state-of-the-art hardware implementations of other MPCitH-based DSAs, we improve the area-time-product (ATP) by a factor $3.5\times$ up to $66.4\times$. Compared to the lattice-based ML-DSA scheme, our MQOM hardware design is only outperformed by a factor $1.5\times$. Our results show that MQOM and the correlated GGM tree structure are hardware-friendly designs, leading to one of the highest HW-vs-SW speedup ratios among similar PQC DSAs, while also attaining the smallest on-chip memory footprint among high-performance hardware implementations.

Adaptor signatures allow a signer to publish a pre‑signature that can be transformed into a valid signature by anyone once a secret witness is learned. Poelstra first suggested this primitive to bypass the limited scripting capabilities of Bitcoin. These schemes were later formalized by Aumayr et al. (ASIACRYPT 2021) and refined by Dai et al. (INDOCRYPT 2022) and Gerhart et al. (EUROCRYPT 2024). In this work, we revisit the constructions of adaptor signatures deployed in practice without any formal proof of security.

First, we demonstrate that the current security model does not capture the ECDSA adaptor signature that underlies most real‑world systems. Second, we propose a relaxed definition and prove that it is satisfied by the ECDSA adaptor construction under the strong unforgeability of ECDSA. Finally, focusing on oracle‑based conditional payments, we formulate the first security model for adaptor‑based Discreet Log Contracts (DLCs) and show that our relaxed notion suffices for their security.

We give in this short note a circuit implementing the matrix-vector product with the 32x32 binary matrix of the AES MixColumns using 88 XOR gates. Previously known circuits minimizing this metric have been published in the past years and achieved 94 XOR, 92 XOR, 91 XOR, and 89 XOR. As far as we can tell, a circuit with 88 XOR was previously unknown.

In secret-key private information retrieval, a client with a short secret key retrieves a database item while hiding the requested index, and possibly also the database, from the server. The server answers using an encoded version of the database, generated via one-time preprocessing. Secret-key PIR provides an attractive "stateless" alternative to stateful PIR and oblivious RAM, and can be viewed as strengthening the standard notion of searchable symmetric encryption by not allowing any access pattern leakage.

We give the first candidate doubly-efficient secret-key PIR schemes that achieve a constant multiplicative storage overhead, asymptotically approaching 1 in natural regimes, together with $k^{o(1)}$ communication and online server work for a database of size $k$. The best previous online server work with constant storage overhead was $k/\textrm{polylog}(k)$.

Our constructions follow the permuted-code blueprint for doubly efficient sk-PIR (Boyle-Ishai-Pass-Wootters and Canetti-Holmgren-Richelson, TCC 2017), and are based on similar assumptions. The main novelty is that we instantiate this blueprint using new families of "$t$-smooth" locally decodable codes with improved tradeoffs between rate, locality, and smoothness. This includes a new $t$-smooth local decoder for Reed-Muller codes using concatenated curves, as well as a construction based on curve-lifted codes that has attractive concrete efficiency features.

We perform extensive cryptanalysis of the underlying assumptions and benchmark performance under realistic parameters, demonstrating the practicality of our schemes. A representative instantiation encodes a $37$ GB database of $18$-bit records with only $4.2$× storage overhead, while requiring the server to read less than $600$ KB from the encoded database per query.

As a companion to the proved bounds in "Shortening Bounds for Reed-Solomon MCA", we formulate the complete finite Reed-Solomon mutual correlated agreement (MCA) problem and a pole-aware conjectural positive-density profile envelope. An exact first-match compiler and realized-image moment and incidence inequalities isolate the payments required for a safe certificate without confusing supports, pairs, rays, and affine slopes. We prove a ceiling-normalized moment obstruction, a projective incidence theorem and benchmark dimension diagnostic, and a moving-scale consequence of the previously proved implication from a Sidon payment through the Balog-Szemer\'edi-Gowers theorem and Boolean-cube growth. Exact unsafe edges, repository audits, and numerical margins lead to four direct adjacent conjectures - two MCA and two auxiliary list inequalities - whose safe sides still require primitive-fiber, residual-projection, algebraic-routing, and add-back payments. In a collision-nonbinding, subexponential-budget identity-candidate branch, we conjecture a non-oracular exhaustive atlas whose exact unsafe--safe bracket, through a proved crossing reduction, yields \(\delta^*_{C_n,\mathrm{off,sup}}=1-\rho_n-g^*(\rho_n,\log_2 |{\mathbb B_n}|)+o(g_n^*)\); the general identity lower route instead uses an exact pole-adjusted target, and no matching bracket is claimed for the unrestricted smooth or circle problem.

Wiener's continued-fraction attack gives the classical provable bound \(d0\), balanced RSA with \(e=\Theta(N)\) can be factored deterministically in polynomial time whenever \(d\leq N^{11/42-\varepsilon}\).

Numerous real-world systems in the FinTech space rely on zero-knowledge proof (ZKP) to verify information without revealing it. For example, range verification is an essential component of transaction systems to ensure that a payment amount does not exceed the payer's wallet balance. However, this verification requires to access the payer's account balance and transferred amount, which they may want to keep confidential. This drives the need for private range verification. In its simplest form, private range verification can be achieved with a zero-knowledge range proof (ZKRP) to verify that a secret value lies within public bounds. When the bounds are also private, ZKRP can still be used, but multiple ZKRPs are needed for each private range verification. This causes a considerable slowdown in the transaction system, which can not only delay transactions but also cause system failures when delays build up beyond control. To address this limitation, we consider the problem of Sequential Private Range Verification, which involves verifying in a sequence that a series of values fall within sequentially-linked private bounds, rather than verifying each private range independently. We propose a novel ZKP, which we call zero-knowledge multiplicative non-negative proof (ZK-MultNNP), and use it in our proposed framework PERSEPHONE to address this problem. We demonstrate experimentally that PERSEPHONE outperforms a ZKRP-based solution by 3x. Furthermore, we observe in a realistic digital payment system that transaction requests are always processed within the Doherty threshold of 400ms with the PERSEPHONE-based system, against only 9% for the ZKRP-based solution.

In this paper, we propose several classes of permutation polynomials having the form $\sum\limits_i(x^{2^m}+x+\delta)^{s_i}+ax$ for $i=1$ or $i=2$, where the exponent $s_i$ satisfies $s_i\equiv 2^j\pmod{2^m+1}$ or $s_i \equiv 2^j\pmod{2^m-1}$ for some different integers $j$, $a\in\mathbb{F}_{2^m}^*$ and $\delta\in \mathbb{F}_{2^{2m}}$. More precisely, by applying the AGW criterion and determining the number of solutions to certain equations over $\mathbb{F}_{2^{2m}}$, several classes of permutation polynomials of the form $(x^{2^m}+x+\delta)^s+ax$ over $\mathbb{F}_{2^{2m}}$ are presented. In addition, we construct some classes of permutation polynomials of the form $(x^{2^m}+x+\delta)^{s_1}+(x^{2^m}+x+\delta)^{s_2}+ax$ over $\mathbb{F}_{2^{2m}}$. Our results generalize some known constructions of permutation polynomials. Finally, we demonstrate that the permutation polynomials proposed in this paper are not quasi-multiplicative equivalent to known ones.

Event date: 26 October to 27 October 2026
Submission deadline: 1 August 2026
Notification: 1 September 2026

Event date: 15 December to 17 December 2026
Submission deadline: 20 September 2026
Notification: 20 October 2026

We are looking for a PhD student, focusing on provable security. You will be part of a multidisciplinary team developing practical cryptographic standards for the post-quantum era, with implementation security in mind from the outset. Your research will combine cryptographic design with formal security analysis, helping to bridge the gap between theoretical security and secure real-world implementations.

You will be supervised by K. Hövelmanns, co-supervised by A. Hülsing.

What you can expect from us:

• The opportunity to work at the intersection of post-quantum, provable security, and implementation security.
• Weekly supervision meetings to help you stay on track.
• Guidance on writing, presentation, and career development.
• Flexible working hours.
• A shared interest in producing high-quality research results.

What we expect from you:

• An interest in cryptographic design and formal security analysis.
• A master's degree in computer science, mathematics, or related subjects.
• A solid background in cryptography, algorithms, discrete mathematics, or a related area.
• Strong analytical and problem-solving skills demonstrated in previous projects. Motivation to lead the projects.
• Research experience in the related areas is a plus but not required.

What you will like about Eindhoven:

• Being part of an internationally recognized research environment with strong expertise in cryptography and cybersecurity.
• The energy of an international technology hub (“Brainport”), combined with the convenience of a compact, easy-to-cycle-around city.
• A large international community—fortunately also reflected in the city’s food scene.
• Living in one of the Netherlands’ leading design hubs, home to Dutch Design Week and a lively creative scene.

Application deadline: August 12th

Closing date for applications:

Contact: Please apply via https://www.tue.nl/en/working-at-tue/vacancy-overview/phd-in-post-quantum-cryptography

More information: https://www.tue.nl/en/working-at-tue/vacancy-overview/phd-in-post-quantum-cryptography

We make progress on the question of constructing explicit evaluation places for leakage-resilient Shamir's secret sharing, over composite order fields. Previously, Maji et al. (EUROCRYPT 2024) showed that random evaluation places yield Shamir's secret sharing over the composite order field $\mathbb{F}_{p^d}$ that is statistically secure against physical-bit leakage. Later, Nguyen (EUROCRYPT 2025) established a "dichotomy" that linear code-based secret-sharing scheme over the field $\mathbb{F}_{p^d}$ is either statistically secure or completely insecure against such leakage.

Building upon Nguyen's dichotomy, we present a partial derandomization of evaluation places, improving upon the Maji et al. result for a restricted regime of parameters. We replace the random choice of $n$ independent evaluation places by the iterates $x_j = \Phi^j(x_0)$ of a simple fixed rational function $\Phi$, where the initial point $x_0 \in \mathbb{F}_{p^d}^*$ is randomly chosen. The randomness in the evaluation places thus drops from $nd \log p$ bits to $d\log p$ bits. Our construction is valid for the regime $n = O(d/\log_p d)$, and any reconstruction threshold $k \ge 2$; in fact, the scheme attains perfect security (statistical distance exactly zero) against single-block leakage. Our technique is a partial fraction nondegeneracy argument that exploits the distinct poles of the rational iterates.

We present Mu-qt-PEGASIS, a mathematically precise con- ditional compiler for interactive aggregate signatures built from the qt-PEGASIS effective class-group action. Our central observation is that the torsor structure of the public-key space blocks the standard Schnorr- or BLS-style verification equations used in conventional aggregate sig- natures. We resolve this by separating verification into two layers: a proof-authentication layer that certifies public-key registration and round- robin key aggregation, and a transcript-consistency layer that verifies the final aggregate signature relative to an authenticated aggregate key. The resulting framework is formulated in the programmable random-oracle model. Public-key registration and linked aggregation are authenticated via Fiat–Shamir compilations of explicit public-coin Σ-protocols for the relations Rreg and Rlink . Under the hardness of the Group Action Inverse Problem (GAIP), together with the random-oracle assumptions for Hnizk and Hsig , we prove MU-EUF-CMA security against static corruptions. At the protocol level, for a fixed Fiat–Shamir repetition parameter t, the aggregate signature has size O(t) and is independent of the number of signers n, while the authenticated registration and aggregation transcript remain linear in n.

Boomerang cryptanalysis is inherently a four-point phenomenon, yet its recent geometric formulation relies on a 3-wise representation imposed by a quartet-sum-zero assumption. This simplification makes the transition matrices tractable, but it also removes boomerangs with unequal paired differences and prevents the framework from modeling impossible boomerang distinguishers.

We propose an exact 4-wise geometric framework for boomerang cryptanalysis that is a \emph{strict generalization} of the 3-wise framework: it recovers the 3-wise framework as the equal-difference $a=a',\,b=b'$ specialization, and at the same computational cost additionally covers the unequal-difference boomerangs and impossible boomerang distinguishers that the 3-wise representation cannot reach. By choosing bases adapted to the two value coordinates and two difference coordinates of a boomerang quartet, our framework removes the 3-wise assumption and gives a unified transition-matrix description for both impossible boomerang distinguishers and fixed-key boomerang probabilities.

The framework has two concrete applications. First, it yields a positive (satisfiability) model for searching for impossible boomerang distinguishers from the difference coordinates in the 4-wise representation. Using this model, we find new impossible boomerang distinguishers for \present, \ascon, \skinny, and \gift. Second, it computes fixed-key boomerang probabilities as sums of \emph{quasi-boomerang quartet characteristic} correlations. For the 13- and 17-round boomerang distinguishers of \skinny-64-128 and \skinny-64-192, respectively, the resulting probabilities match the experimental results and explain the gap left by the 3-wise framework through contributions from unequal-difference boomerangs.

Confidential virtual machines (CVMs) provide hardware-rooted attestation and isolation, protecting data in use from untrusted cloud infrastructure. However, current CVM attestation frameworks are limited to a two-party trust model between the cloud provider and the CVM owner, and primarily guarantee only the boot-time state. As CVMs increasingly host public-facing workloads (e.g., LLM inference APIs, web applications) that process end-user data, this creates a three-party trust mismatch among the cloud provider, the CVM owner, and end users. Once a workload is deployed, end-users lack cryptographic assurance of runtime integrity and must implicitly trust the CVM owner for any post-launch modifications. Furthermore, extending continuous runtime attestation to a large number of end users introduces severe scalability bottlenecks and is vulnerable to co-location-based attacks. Existing methods either enforce static post-launch lockdown or rely on CVM owner-maintained software logs that are not hardware-anchored.

We present Vordr, a framework that removes the CVM owners from the end-user's trust domain across the full CVM lifecycle while still allowing workload-level updates/installations with auditability. We introduce a novel architecture that establishes an exclusive administrative binding between a process-based TEE (Warden Enclave (WEN)) and the CVM. This binding strictly blocks the CVM owners (or cloud) from directly manipulating the CVM. Vordr continuously tracks runtime integrity via a hardware-rooted Linux IMA event log anchored to PCR 10, serving time-bounded, platform-unlinkable cached or audit-ready quotes for independent end-user auditing. We optimize the costly IMA-log extraction via a novel incremental attestation design leveraging the IMA log's append-only structure and the WEN's sealed state. We implement Vordr, validate it across several workloads, and show that it provides up to 60.8x speedup for runtime monitoring with huge communication reductions in steady-state incremental rounds compared to prior methods. Vordr delivers highly scalable and verifiable runtime attestation, providing substantially stronger guarantees for runtime integrity and platform unlinkability.

Searchable Symmetric Encryption (SSE) enables data owners to securely store encrypted data on untrusted cloud servers while retaining the ability to perform secure searches and retrieve relevant documents. However, standard SSE schemes expose search patterns (whether two queries are identical), and result patterns (which documents are returned), making them susceptible to leakage-abuse attacks that can infer sensitive information such as the queried keywords and/or document contents. While Oblivious RAM (ORAM) and Private Information Retrieval (PIR) can hide these patterns, their high computation and communication overhead often render them impractical for real-world search workloads. A more efficient alternative is to obfuscate search and result patterns using Differential Privacy (DP). Unfortunately, existing DP-based SSE schemes either provide insufficient query privacy protection, or still incur substantial performance overhead. In this paper, we propose FROST, a novel differentially private SSE scheme that efficiently obfuscates both search and result patterns, while providing strong resilience against all known statistical leakage-abuse attacks. The core component of FROST is our new rerandomized PIR (RePIR) scheme designed for private databases, which allows server-side rerandomization of encrypted PIR query responses. In FROST, we also introduce a novel method for applying DP noises to SSE for search result obfuscation using only simple arithmetic operations. An important property of FROST is that it requires only a single round of communication, with small user-side storage as an additional benefit. We fully implemented FROST and conducted extensive experiments over real-world datasets to rigorously assess its practical performance and resilience. Our experiments showed that FROST not only effectively mitigates pattern-leakage attacks while maintaining reasonable utility, but also achieves up to four orders of magnitude faster keyword search and three orders of magnitude lower bandwidth overhead than prior DP-based SSE schemes.