International Association
for Cryptologic Research

Shuffle arguments are a fundamental building block in mix-nets and related privacy-preserving systems, where they are used to prove that a set of ciphertexts or commitments is a permutation and rerandomization of another set without changing the underlying messages. Existing communication-efficient shuffle arguments rely on classical assumptions, whereas known lattice-based constructions are still significantly less efficient. In this paper, we present a lattice-based shuffle argument with short proofs by using the subset-checking approach of Abdolmaleki et al. (SCN 2024) in the lattice setting. Our main construction proves correct shuffles of Ajtai commitments and is built on the ABDLOP commitments and lattice-based zero-knowledge framework of Lyubashevsky et al. (Crypto 2022). The protocol is secure under the Module-SIS and Module-LWE assumptions in the random oracle model. A key technical ingredient is a rerandomization method for the derived commitment key, which restores the distributional properties needed for soundness even when the input commitments may depend on the prover. We further extend our approach to obtain shuffle arguments for ciphertexts and public keys, yielding applications to lattice-based mix-nets and single secret leader election. Finally, we implement our construction and compare it with prior lattice-based shuffle protocols, obtaining substantial improvements in communication, proving time, and verification time.

The Princeton DeCenter invites applications for Postdoctoral Fellows, (including more senior researchers) with academic or industry experience expected to begin in Feb. 2027 through Feb. 2028. They will be appointed at the rank of Postdoctoral Research Associate or at a more senior rank, as appropriate. The Term of appointment is based on rank. Positions at the postdoctoral rank are for one year with the possibility of renewal pending satisfactory performance and continued funding; those hired at more senior ranks may have multi-year appointments. Fellows must have their Ph.D. in hand by the start of the appointment. Fellows will join a vibrant intellectual community dedicated to advancing research on blockchain, decentralized technologies, and their applications, across computer science, economics, law, political science, philosophy, and related fields. The DeCenter is a newly established interdisciplinary hub at Princeton University devoted to exploring the decentralization of power and trust through blockchain (and similar) technology.

Closing date for applications:

Contact: [email protected]

More information: https://apply.interfolio.com/185365

The Frontier AI Security Residency is an eight-week, fully funded programme in Cambridge, UK, running from 12 October to 4 December 2026. Residents work full time on a single project. Projects range from tamper-evident enclosures for AI accelerators, side-channel workload verification, and TEE and attestation security to zero-knowledge proofs of inference, formal verification of security-critical hardware, threat modelling, and founding new organisations in the space. We are looking for people with experience in areas such as hardware security, chip design and verification, firmware, applied cryptography, formal methods, ML systems and networking. No prior AI safety background is required. Mentors include professors at Oxford, USC, WPI and NC State, as well as engineers from Arm, Intel, Google DeepMind and the OpenTitan project. The programme includes a stipend. Applications close on 2 August 2026 and are reviewed on a rolling basis. Apply: securefrontier.ai Know someone who would be a strong fit? Refer them here: https://airtable.com/appXP6Vad759fSHQE/pag0Pf82Rmjcz1228/form

Closing date for applications:

Contact: [email protected]

More information: https://www.securefrontier.ai/

The Amazon Cryptographic Libraries (ACL) team builds the cryptography that AWS services and a growing open-source community depend on, including AWS-LC, our FIPS-validated open-source libcrypto. As an Applied Scientist on the team, your primary focus will be formal verification: building machine-checked proofs that cryptographic implementations are correct. You will also contribute to algorithm implementation, assembly-level optimization, and the adoption of post-quantum cryptography (ML-KEM, ML-DSA, SLH-DSA). You will work alongside researchers, scientists and partner with Amazon's Automated Reasoning Group, building deep expertise in an environment where your proofs and code ship across AWS.

See link for application.

Closing date for applications:

Contact: Jake Massimo

More information: https://www.amazon.jobs/en/jobs/10476858/applied-scientist-amazon-cryptographic-libraries

Applications are invited for the post of Lecturer in Information and Cyber Security (Teaching and Research) in the Department of Computing, Security, and Mathematics.

Royal Holloway’s Faculty of Science is home to the world-renowned Information Security Group (ISG). The group is placed within the Faculty’s Department of Computing, Security, and Mathematics. The ISG has a record of outstanding research and hosts established research groups under the themes of: Cryptography, People and Society, Smart Card and IoT Security, Systems and Software Security. The ISG is now recruiting for a research and teaching lectureship in information and cyber security.

The ISG is committed to delivering excellent teaching at both undergraduate and postgraduate level. Our MSc in Information Security, the first of its kind anywhere in the world when it was launched in 1992, is accredited by The National Cyber Security Centre (NCSC) and has over 4,000 alumni worldwide. The Department has received an ACE-CSE Gold Award recognising excellence in cyber security education from the NCSC.

We welcome applications from individuals with a strong academic track record whose work relates to one or more of the ISG’s themes. We particularly welcome applications from those with industry and practice experience as a complement to their academic track record. Applicants will have, or show the potential for, a track record of excellence in both teaching and research and will demonstrate a strong trajectory in academic research that has the potential for significant impact. The successful applicant will demonstrate expertise in undergraduate and postgraduate teaching and the supervision of both undergraduate and postgraduate students.

The post is based in Egham, Surrey where the University is situated in a beautiful, leafy campus near to Windsor Great Park and within commuting distance from London. There will be also the opportunity to develop and deliver postgraduate programmes at our Central London campus, located in Bloomsbury.

Closing Date: 11 September 2026

Interview Date: 28 September to 9 October 2026

Closing date for applications:

Contact: Christian Weinert ([email protected])

More information: https://jobs.royalholloway.ac.uk/Vacancy.aspx?ref=0726-245

We present a fast implementation of Falcon (FN-DSA) signature verification with AVX-512. On a modern AMD Zen5 core, it completes a Falcon-512 verification in 3.6 microseconds, 2.6 times faster than an already optimized baseline, with comparable gains on Zen4, and consistent results across clang 21 and gcc 15.

The speedup comes from rewriting the Number-Theoretic Transform (NTT) and from vectorising all other stages of the verification algorithm. The novelty is to use a 32-bit Barrett-style representation, instead of the reference 16-bit Montgomery, and adopt Shoup-Harvey precomputed multipliers for twiddle reduction.

With all optimizations applied, hash-to-point (and specifically Keccak) is the dominant cost. We therefore propose a non-standard Falcon variant that replaces SHAKE256 with KTP256, an XOF based on KangarooTwelve with parallel squeeze. It cuts verification to 2.2 microseconds on Zen5, yielding 4.2 times over the baseline, and is of independent interest for any post-quantum scheme that uses a Keccak sponge to sample large amounts of data from a fixed seed. All code is open source.

Due to the insecurity of McEliece cryptosystems instantiated with Generalized Reed-Solomon codes, there have been several proposals of McEliece type systems that replace the permutation matrix by a matrix $M$ with larger row and column weight. In many of them, the secret key is still a GRS code. There have been successful attacks on some of those schemes with row and column weight between $1$ and $1 + R$, where $R$ is the rate of the code. The case of weight two and larger has been left open in these works. Subsequently, several authors proposed schemes with weight exactly two and with even higher weight. We provide distinguishers for the public codes appearing in these cryptosystems in the high rate regime. In addition, we give a framework to turn a good enough distinguisher into a key-recovery attack. In the case where the matrix $M$ has row and column weight $2$, we can successfully attack the scheme in the high rate regime using a cube code distinguisher.

Private Set Operations (PSO) enable mutually untrusted parties to securely compute arbitrary functions (e.g., union, intersection, and cardinality) over their private input sets, which have wide applications in many real-world scenarios. Existing PSO protocols fall short of practical deployment for several reasons. (1) \textit{Function-specific}. Real-world privacy-preserving applications often require multiple set operations within the same task, while existing solutions typically address individual functionalities (e.g., intersection or union) in isolation, making it difficult and costly to support diverse set operations in a unified and efficient manner. (2) \textit{Lacking malicious security}. As PSO is commonly employed in highly sensitive applications, it is often necessary to provide strong adversarial guarantees with malicious security. Unfortunately, most of existing works only achieve semi-honest security, which limits their practical applicability. (3) \textit{Restricted settings}. Majority of existing works focus exclusively on the two-party setting. How to extend them to the multi-party setting with malicious majority securely and efficiently is unclear. To date, designing a maliciously secure multi-party PSO (mPSO) framework that efficiently supports diverse set operations remains an open challenge.

This paper presents the \textit{first} maliciously secure mPSO framework, named UM-PSO, that supports a broad range of set operations with practical efficiency. At the core of our framework is a function-independent preprocessing phase that prepares a reusable pool of secret-shared items, which can then be leveraged to securely compute diverse set functionalities in the online phase. To achieve malicious security efficiently, we design verification mechanisms on top of SPDZ-based authenticated secret sharing, along with tailored techniques and optimizations to further improve practical performance. We implement our protocols and report concrete performance results. For a representative setting with 5 parties and a total of $2^{12}$ 128-bit items, our framework achieves an online running time of $0.627$ seconds and incurs $3.35$ MB of communication. Compared to the baselines, our framework achieves up to $51\times$ speedup and $76\times$ lower communication cost.

PRIVIDEMA project (Privacy-Preserving Identity Management for Digital Wallets and Secure Data Sharing and Processing for Cyber Threat Intelligence Data) advances the state of the art in cryptographic and Privacy-Enhancing Technologies (PETs) to enable secure, interoperable, and trustworthy data exchange across sectors, with a focus on the domains of Cyber Threat Intelligence and Digital Identity Management. This paper presents two representative real-world use-cases: (1) privacy-preserving digital identity management based on the European Digital Identity (EUDI) Wallet, and (2) privacy-preserving Cyber Threat Intelligence (CTI) sharing for Software Bill of Materials (SBOMs) and vulnerability datasets. Both use cases showcase how advanced PETs, including Fully Homomorphic Encryption (FHE), Federated Learning (FL), and Differential Privacy (DP), can be composed to protect sensitive data throughout its lifecycle while maintaining analytical and operational utility. Together, these use cases chart a practical course toward more scalable, standards-compliant, and privacy-preserving data ecosystems that align with Europe’s vision for secure and trustworthy digital services.

Internet shutdowns are used authoritarian regimes to suppress communication that end up crippling essential Internet-driven services, besides the obvious silencing of dissent. Traditional tools like VPNs and Tor, dependent on active Internet connections, falter during these blackouts. Earlier solutions, such as Dolphin, delivered meagre bandwidth and weak privacy safeguards, exposing a glaring weakness in the battle against digital oppression.

ViNET, a system that cleverly repurposes Video over LTE (ViLTE) calls, often operational during shutdowns, into a stealthy conduit for real-time Internet access. By ingeniously embedding network traffic in ViLTE packets, ViNET achieves robust 60 to 400 Kbps transmission rates, matching 2G speeds and surpassing previous solutions like Dolphin by 1500x–4000x, while ensuring end-to-end TLSbased confidentiality and integrity. This performance enables text-based web browsing with page loads in seconds to minutes, 1 MByte file downloads in ≈30s, and seamless messaging over Telegram.

ViNET also outsmarts machine learning-based traffic classifiers, achieving a remarkable false positive rate, at times as high as 40%, when attempting to detect ViNET using SOTA models. With such standout metrics, ViNET emerges as a formidable ally, offering a performant, reliable and privacy-first lifeline, in the face of Internet shutdowns.

Post-Quantum Cryptography is now in its deployment phase. Amongst the threats encountered in real-world applications is Side Channel Analysis, a cryptanalysis branch relying on the study of physical leakages from unsecured implementations. However, the FALCON post-quantum signature includes non-linear functions on real numbers, and applying the generic masking countermeasure to these functions has only been recently studied. In this work, we use convergent sequences to approximate the function and a minimax polynomial to compute the first term of the sequence. The method is applied to the computation of the inverse, the inverse square root and the square root in FALCON. A theoretical analysis of the security in the t-probing model using the NI criterion and its variants is proposed. Compared to the existing state-of-the-art which only covers the inversion for floating-point implementation, this paper is generic and works with any representation and precision for real numbers.

Torus Fully Homomorphic Encryption (TFHE) enables the homomorphic evaluation of arbitrary functions via Programmable Bootstrapping (PBS). However, the modulus switching step inherent to bootstrapping introduces a rounding error that forces the discretization of the input space, limiting the achievable precision on real-valued inputs. We propose a correction algorithm based on a first-order Taylor expansion, applied after bootstrapping, that directly mitigates this rounding error. Our method leverages the many-LUT technique to simultaneously recover encryptions of the function and its derivative within a single PBS, making the correction essentially free in terms of bootstrapping latency. We support our construction with a heuristic average-case noise analysis, validated by empirical measurements, and demonstrate a tenfold reduction in bootstrapping noise standard deviation. As a proof of concept, we apply our method to the numerical integration of ordinary differential equations under encryption.

This paper gives a modular and unified framework within which to derive fast protocols for Private Set Intersection (PSI). At the core of this is a new primitive, that we define, and that we call a Just-In-Time OPRF (JIT-OPRF). We show how to obtain PSI generically from any JIT-OPRF, and then how to obtain JIT-OPRFs from Oblivious Transfer (OT) and Vector Oblivious Linear Evaluation (VOLE). We recover as special cases PSI protocols in the literature based on these two assumptions. Our results and proofs throughout are concrete rather than asymptotic, with explicit bounds that allow one to determine security parameters to achieve a desired level (e.g.~128 bits) of proven security in practice. Our results show interesting differences in the concrete security of OT and VOLE based PSI. Beyond the practical contribution of concrete-security, our work adds conceptual simplicity to this area, and opens the door to new PSI protocols via the construction of new JIT-OPRFs.

Falcon was selected by NIST in 2022 for standardization as a post-quantum digital signature scheme. Among all standardized signature schemes, Falcon achieves the smallest signature size. Its main drawback, however, is its reliance on floating-point arithmetic, which plays a critical role in the security analysis. This reliance poses significant challenges for practical implementations: some platforms lack floating-point units, floating-point division is not constant time on many processors, and protecting floating-point computations against side-channel attacks using masking techniques is particularly difficult on embedded devices.

To address portability issues, Pornin (ePrint 2019/893) proposed an implementation of \falcon that emulates floating-point arithmetic using integer operations. While it enables deployment on a wider range of platforms, this approach incurs a substantial performance penalty compared to the native floating-point implementation.

This work studies the theory and practice of implementing Falcon's signing procedure in fixed-point arithmetic. This requires a specific analysis of the boundedness and precision of intermediate variables.

1. Our boundedness analysis revolves around a key fact: almost every intermediate variable arising during key expansion and signing is bounded by a function of four quantities that can be computed at key generation time. Our modified key generation enforces thresholds on these quantities through a light rejection step that rejects less than 50% of initial Falcon keys. This then yields sharp, unconditional bounds on all fixed-point variables. Establishing these bounds is highly nontrivial, and relies on Gaussian concentration arguments as well as on symplectic pairs, a generalization of symplecticity.

2. Our precision analysis remains, for now, partly empirical. Following a Rényi divergence argument, our main theorem proves the security of fixed-point Falcon conditioned on error bounds of certain intermediate values. These error bounds are derived empirically based on extensive experiments.

We provide a C fixed-point implementation. It is approximately a factor of two slower than the original floating-point \falcon implementation, but achieves a speedup of an order of magnitude compared to emulated floating-point implementations.

Neural differential distinguishers have become an active research direction in​ symmetric-key cryptanalysis since the introduction of deep-learning-based attacks on​ round-reduced SPECK. Early neural distinguishers typically used a single ciphertext pair​ or ciphertext difference as input. Recent studies, however, show that richer input​ representations can substantially affect the information available to the classifier, the data​ cost of each labeled sample, and the relevance of the distinguisher to practical attacks.​ Examples include multi-pair, multi-difference, matrix-style, multi-round,​ structured-encoding, and score-aggregation based inputs.​ This paper provides a taxonomy and survey of rich input representations in neural​ differential cryptanalysis. We introduce a representation-centric framework that describes​ an input representation by its difference set, number of observations per sample, sharing​ structure, encoding function, and ciphertext cost. Using this framework, we organize​ existing works into representation families and compare their motivations, benefits, and​ limitations. We also argue that representation-rich distinguishers require cost-aware​ evaluation: fixed-sample comparisons and fixed-ciphertext comparisons answer different​ questions and may lead to different conclusions. Finally, we identify open problems related​ to automated representation search, theoretical explanation of representation gain,​ cipher-family transferability, interpretability, reproducibility, and key-recovery integration.​ The survey highlights that rich input representations should be treated as first-class​ cryptanalytic design choices rather than secondary implementation details.

In AfricaCrypt 2025, Seck et al. proposed a new generalized Wiener-type attack on an RSA-like cryptosystem proposed by Cotan and Teseleanu (NordSec 2023). In their attack, they studied the generalized key equation $eu - (p^4 - 1)(q^4 - 1)v = w$ and showed that a private exponent $d$ which is too large or too small can be recovered in polynomial time. Another RSA variant based on cubic Pell curves with key equation $ed - (p - 1)^2(q - 1)^2 k = 1$, was examined by Rahmani and Nitaj in AfricaCrypt 2025. Note that these two attacks are valid for a balanced modulus $N = pq$ ($q < p < 2 q$).

In this paper, we extend these two attacks by showing that for a modulus $N=pq$ product of arbitrary primes $p$, $q$, one can efficiently factor $N$ by studying the two key equations $ex - (p^4 - 1)(q^4 - 1)y = \omega$ and $ex - (p - 1)^2(q - 1)^2 y = \omega$ under certain conditions on $x,y$ and $\omega$. Our new attacks are based on Coppersmith method and continued fractions.

Simon's algorithm can detect hidden XOR periods in functions derived from symmetric ciphers. Finding such functions becomes difficult when nonlinear layers and diffusion spread the relevant expressions across many branches, so recent work has used symbolic search to automate the construction. We refine the algebraic SMT model of Liu et al. in two ways. Prefix realization checks whether a symbolic starting state can be reached through preceding rounds and records the round-key nibbles needed to produce it. DDT Filtering restricts a local S-box input to a DDT bucket so that the symbolic path can cross an additional nonlinear layer. The latter condition is key-dependent: the target period need not lie in the translation space of the selected bucket, and our results state this condition explicitly. We report the maximum round counts found for GFS-2F, GFS-4F, Skipjack-B, LBlock, TWINE, CRAFT, and SKINNY, with Liu et al.'s automated model as the main comparison. We also combine selected witnesses with partial round-key guesses in the Grover–meet–Simon setting, yielding reduced-round key-recovery candidates below the corresponding comparison budgets.

Hybrid fully homomorphic encryption (FHE) inference improves the practicality of private inference by letting the server evaluate linear layers homomorphically while the client decrypts and applies nonlinearities. Recent schemes attempt to protect model confidentiality by returning noisy, output-permuted responses and appealing to shuffle-model differential privacy (DP). We show that this protection fails in the correctness regime required by hybrid FHE systems. For a $d$-input linear layer, $d+1$ admissible queries suffice for exact recovery of a permutation-invariant layer summary, hence for perfect model distinguishability. We further show that input DP is orthogonal to model confidentiality and that the local-DP premise required for shuffle amplification cannot hold under correctness-bounded noise. We recover all linear layers of a SAFHIRE-style ResNet-20 end-to-end from TFHE transcripts with zero error, using $d+1$ queries per layer for a total of $5{,}712$ direct queries. Under the same query model, we also confirm exact per-layer recovery on pretrained ImageNet-scale CNNs and ViT-B/16. The leaked spectra enable fingerprinting, lineage attribution, and improved logit-based extraction, while suppressing them destroys inference utility.

Proof-of-work (PoW) remains a fundamental mechanism for achieving decentralized consensus, most commonly instantiated using cryptographic hash functions. In such constructions, mining takes the form of an unstructured search problem over a large input space, where miners repeatedly evaluate candidate solutions until a valid one is found. While this design has proven effective in practice, it admits a quadratic quantum speedup via Grover’s algorithm, raising concerns about the long-term security of hash-based mining. Motivated by this limitation, we investigate the use of code-based cryptographic problems as an al- ternative foundation for proof-of-work. In particular, we focus on the syndrome decoding problem and examine its classical and quantum com- plexity based on current state-of-the-art information-set decoding (ISD) algorithms and their quantum variants, comparing the resulting quantum advantage with that of hash-based and lattice-based constructions. Building on this analysis, we propose a proof-of-work construction based on the Syndrome Decoding Problem (SDP) with a structured profile constraint, which enables controlled variation of solution density and difficulty. Under the standard random-instance heuristic, we derive ex- pressions for the expected number of solutions and the probability of successful mining, providing a principled basis for parameter selection.

We propose NAIBI-Full, a lattice-based key encapsulation mechanism (KEM) together with its forward-secure ephemeral key-agreement protocols, built on the regular representation ? of the non-split commutative algebra \cA? =\Rq⁢[?]/(?? −?) over \Rq =\Z?⁢[?]/(?? +1), ? ∈{2,3}, ? a non-? -th power. Each party publishes the full matrix \bft =?⁢?⁡(\bfs) +\bfe ∈\Rq?×? ; because ?⁡(\cA?) is commutative, the cross-product collapses to small noise and a Peikerthint closes the gap to exact agreement, even though the public matrix ? is fully generic in ??⁡(\Rq). Hardness rests on a single, well-localised assumption: structured-secret Module-LWE \MLWErho, which we identify exactly with a ?⁡(?)-linked ?-sample MLWE problem via column decomposition, placing it inside the well-cryptanalysed MLWE landscape of ML-KEM. NAIBI-Full is the conservative member of the family: a clean account in terms of a standard lattice assumption, at the cost of ?2-element public keys and ciphertexts. We obtain an IND-CCA2 KEM (FO⊥, ROM and QROM) plus two forward-secure ephemeral protocols (ephemeral-static and ephemeral-ephemeral) sharing the same algebraic core, and a statistical, decapsulation-level binding correctness guarantee with collision probability ≤(2/3+13⁢?)⌈?/2⌉ +(8/?)?/2 +2−256 (below 2−148 at every parameter set). Crucially this binding holds in the malicious-key model on the ciphertext axis (???-????-?-??), with no distributional assumption on the adversarial keys --- the property ML-KEM is known to lack. We deliberately do not offer a static-static mode, which would inherit the active key-mismatch attacks of the Ding/Peikert/NewHope family; NAIBI-Full is confined to its key-mismatch-resistant deployments. Parameter sets cover NIST security Categories~1, 3 and~5, all with ? ≤2−128 .