International Association
for Cryptologic Research

The Multi-Party Computation (MPC)-in-the-Head (MPCitH) framework enables the construction of post-quantum Digital Signature Algorithms (DSAs), offering competitive public key sizes. However, this comes at a cost of high computational complexity, resulting in high signature generation and verification times.

In this work, we propose a compact and efficient hardware accelerator for Mirath, an MPCitH-based DSA and candidate in the ongoing NIST PQC standardization effort. We propose a series of algorithmic and hardware-level optimizations, focusing on Mirath's most critical operations: GGM tree-based polynomial commitments and MPC arithmetic. Firstly, we observe Mirath greatly relies on symmetric primitives (SHA3 & AES) during the GGM tree expansion and typically requires a large amount of memory to store the derived tree nodes. We propose an on-the-fly scheduling for generating and computing the GGM tree, such that a minimal amount of GGM tree nodes are stored in memory and their computations can be performed in parallel. Our methodology enables temporarily storing a minimal (and configurable) set of parent nodes in local buffers, from which the low-level tree nodes can be efficiently derived instead of repeatedly doing so from the root seed. This is achieved through a novel, hardware-friendly tree node indexing scheme, which enables efficient traversal through GGM tree nodes using only left and right shifts to find their closest previously computed ancestor. Secondly, we analyze the MPC arithmetic in Mirath and propose massively parallel and yet area-efficient arithmetic units, capable of exploiting algorithm-level parallelism in the MPCith operations. This is achieved by analyzing Mirath's proposed parameter sets and identifying the most hardware-friendly parameters, for which we design highly fine-tuned modules. Finally, we implement our unified design, which supports all Mirath operations, on FPGA and compare its performance against state-of-the-art PQC DSA hardware implementations. Compared to an implementation of the MPCitH-based SDitH scheme (TCHES 2024), we reduce on-chip BRAM by up to $81.6\%$ and improve the area-time-product by a factor $52.7\times$ up to $64.8\times$. Overall, we demonstrate that modern MPCitH constructions can be significantly accelerated in hardware through a combination of algorithmic, architectural and low-level hardware optimizations, in line with real-world performance requirements.

Differential-linear distinguishers have been introduced by Langford and Hellman in 1994. They consist in combining, first, a differential distinguisher and second, a linear distinguisher and then study the bias between plaintexts with a difference and linear approximations of the two ciphertexts to create a differential-linear distinguisher. The original method has been improved by Bar-On et al. in 2019 where the table called the DLCT (Differential Linear Connectivity Table) has been introduced and more recently, in 2024 by Hadipour et al. where, as for the case of boomerang distinguishers, several intermediate tables are used to tune the computation of the middle part of the distinguisher. From a distinguisher, it is thus natural to try to mount some dedicated attacks. This step has been done by Broll et al. in 2021 and in 2022 for the case of SERPENT.

In this paper, we propose a tool that directly searches for the best differential-linear attacks automating the work of Broll et al. using the differential-linear distinguishers proposed by Hadipour et al. More precisely, both searches (distinguishers and attacks) are done in the same step to improve the overall complexity of the differential-linear attack. We apply this tool to the case of SERPENT and PRESENT. The attack against SERPENT reaches 12 rounds with a time complexity equal to $2^{220.9}$ for a data/memory complexity equal to $2^{125.01}$. The attack against PRESENT-80 (PRESENT-128 respectively) reaches 16 (18 respectively) rounds with a time complexity equal to $2^{73.88}$ ($2^{124}$ respectively) for a data/memory complexity equal to $2^{57.88}$ ($2^{63.25}$ respectively).

Private Set Union (PSU) allows two parties to compute the union of their private sets without revealing any additional information---in particular, it hides their common elements (the intersection). Although recent years have seen significant progress under the semi-honest model, resulting in several efficient two-party PSU protocols, notable gaps remain: (1) some prior works model the semi-honest PSU functionality inaccurately, and (2) practical and scalable maliciously secure protocols are still lacking, except when relying on heavy generic techniques (e.g., FHE, GMW, or general purpose NIZK).

In this paper, we address these issues directly and summarize our contributions as follows: 1. We revisit the formal definition of PSU, covering both the standard one-sided functionality (where only one party receives the output) and the two-sided variant (where both parties receive the output), refuting several flawed claims from prior work, and show that the notion of ``during-execution leakage'' was not well-defined in the literature, since the ``enhanced'' functionality is actually equivalent to the standard one. 2. We show how one of the fastest semi-honest protocols can be strengthened against malicious senders with a simple ad-hoc modification, while preserving its efficiency and simplicity. 3. As our main result, we present the first practical, concretely efficient, and maliciously secure two-sided PSU protocol, achieving at least a quadratic improvement over prior work. Along the way, we also resolve the challenge of assuring honest behavior for the hash-to-curve function in the PSU context---a task generally regarded as impractical due to the non-algebraic nature of the hash function. 4. We implement both protocols and compare them with existing schemes. Our experiments demonstrate that our maliciously secure protocols are only ${1.1\!-\!2.4}\times$ slower than the most efficient semi-honest protocols in the literature.

In this paper, we focus on the class of at least linearly homomorphic schemes such that their homomorphic addition operator is itself a linear operator over the ciphertext domain. This class of schemes, which we refer to as HELLHO schemes, notably encompasses the basic variant of most practically used FHE schemes such as BFV, BGV, CKKS and TFHE, as long as their mode of operation allows for homomorphic additions not immediately followed by bootstrapping, but also several extensions of them as well as other less mainstream proposals based on other assumptions. Although the aforementioned specific FHE are known to be CPAD insecure due to the existence of concrete attacks against them in that model, we first show by a simple argument that no HELLHO scheme can achieve CPAD security. Moving one step further, we also establish several counter-intuitive facts for the class of HELLHO schemes: for example that any CCA2 attack can be turned into a CPAD one or that, still only for this class of schemes, CCA1 security is equivalent to CPAD1 security (a strictly weaker ``CCA1-style'' variant of CPAD). Among other practical consequences, the results in this paper notably allow to show that instantiating the Dynamic Error Estimation (DEE) heuristic of Li et al. (Crypto'22) from any ``natural'' (R)LWE-based schemes cannot yield a CPAD secure scheme. As another notable consequence, we further exhibit a practical KRD attack on the DE-CKKS scheme, which is presently supported in OpenFHE. We conclude the paper by experimental results showing that this attack is able to perform a full key recovery on DE-CKKS in a matter of hours on an average laptop PC.

Gradient boosted decision trees, particularly XGBoost, are among the most effective methods for tabular data. As deployment in sensitive settings increases, cryptographic guarantees of model integrity become essential. We present ZKBoost, the first zero-knowledge proof of training (zkPoT) protocol for XGBoost, enabling model owners to prove correct training on a committed dataset without revealing data or parameters. We make three key contributions: (1) a fixed-point XGBoost implementation compatible with arithmetic circuits, enabling instantiation of efficient zkPoT, (2) a generic template of zkPoT for XGBoost, which can be instantiated with any general-purpose ZKP backend, and (3) vector oblivious linear evaluation (VOLE)-based instantiation resolving challenges in proving nonlinear fixed-point operations. Our fixed-point implementation matches standard XGBoost accuracy within 1% while enabling practical zkPoT on real-world datasets.

Idealized models such as the Random Oracle Model and the Generic Group Model underpin much of modern provable security. The Algebraic Group Model (AGM) of Fuchsbauer, Kiltz, and Loss (CRYPTO 2018) attempts to bridge the gap to the standard model by forcing adversaries to justify every new group element via a linear representation in its inputs, and it was leveraged in many follow-up works. Lipmaa, Parisella, and Siim (TCC 2023) strengthened this framework to the AGM with Oblivious Sampling (AGMOS), which additionally lets attackers obtain random group elements without the knowledge of their discrete logarithms, reflecting the practical availability of hashing to the group via admissible encodings. Although several works already rely on AGMOS, the security arguments are still ad hoc, and it is unclear whether an AGM proof automatically extends to this richer setting. We initiate a systematic study of this question. Our main result is a generic lifting theorem: For any assumption whose verification predicate satisfies a simple structural lifting condition, every AGM reduction remains sound in AGMOS under the Find Polynomial Representation (FPR) and Tensor Oracle Find Representation (TOFR) assumptions.

The lifting condition is met by a broad class of algebraic protocols. As illustrations, we lift from the AGM to the AGMOS (i) the knowledge soundness of KZG-like polynomial commitments and (ii) the security of the multivariate Adaptive Rational Strong Diffie–Hellman (ARSDH). Our results clarify the precise relationship between AGM and AGMOS and provide a black-box recipe for future work: once a proof is obtained in the AGM, one can often inherit AGMOS security with negligible additional effort. This both streamlines the use of AGMOS in forthcoming work and reinforces the confidence that schemes proven secure in the AGM remain robust when oblivious sampling is available.

Plonk is one of the most influential and widely used zk-SNARKs, with proofs of constant size (0.5 kB), sublinear verification time, and circuit-independent setup. All prior security analyses of Plonk—of both knowledge soundness and zero knowledge (ZK)—are in the random-oracle model (ROM), which recent work has shown to be especially problematic in the context of proof systems. Moreover, a security proof in the ROM does not justify using a system recursively, a powerful technique currently used e.g. in "zk-rollups."

We show that for analyzing Plonk, the ROM can be avoided when making the "zero-testing" (ZT) assumption on the used hash function (and the commitment scheme). ZT is a non-interactive, falsifiable hardness assumption. Assuming ZT, we prove Plonk knowledge-sound in the algebraic group model (AGM) and computationally ZK in the standard model. Using Plonk recursively can now be justified in the recursive AGM.

To increase confidence in ZT, we prove that it holds in the ROM assuming the used commitment scheme is binding. Moreover, when using KZG commitments in the generic group model we show that collision resistance of the hash function implies ZT.

Recent advances in large language models have enabled LLM-based agents to move beyond text generation toward long-term execution involving tool use, multi-step interactions, and autonomous decision-making. However, the agent provider may be compromised and return malicious outputs. As agents increasingly manage sensitive data and financial assets, such misbehavior can cause severe real-world harm. Recent work leverages zero-knowledge proofs to verify the correctness of LLM inference, ensuring that the provider can only return outputs consistent with the claimed model. Nevertheless, these approaches are limited to standalone transformer computations and fail to support agent executions.

We present zkAgent, an efficient SNARK system for agent execution. Beyond prior Transformer-only proofs, zkAgent proves the entire agent execution, including end-to-end LLM inference and tool interactions. Furthermore, zkAgent achieves scalable proof generation by proving multi-step agent interactions through a single, one-shot inference proof, eliminating the need to prove each intermediate token generation. To our knowledge, zkAgent is the first system to provide practical verifiable agent execution that simultaneously attests to complete LLM inference and tool interactions.

Our evaluation shows that, for a 512-token agent inference with GPT-2, zkAgent achieves an amortized proving time of 1.05s/token, a $294\times$ speedup over the state of the art, zkGPT (USENIX Security~’25) which requires $309$s/token with step-by-step generation. zkAgent also reduces verification time by $9{,}690\times$ (0.45s vs. 4361.09s). Moreover, for end-to-end agent executions, such as a weather agent and a coding assistant, zkAgent completes proving in 240s and verification in about 0.5s, with proof size of $42$MB, making verifiable agent execution practical in real-world deployments.

Cloud-based Large Language Model (LLM) inference processes sensitive user inputs, yet current deployments offer limited confidentiality guarantees. Fully Homomorphic Encryption (FHE) can provide strong privacy, but it clashes with transformer architectures, where rigid ciphertext packing demands expensive rotations, and deep polynomial circuits for nonlinearities necessitate costly bootstrapping. Although recent work has reported promising speed-ups, maintaining model accuracy is a challenge. We address these issues with ELLMo, a packing- and depth-aware encrypted transformer design. ELLMo introduces a novel matrix multiplication algorithm to reduce the ciphertext rotations. Further, head-split and merge steps are fused into this new algorithm at no additional cost. To reduce the depth of nonlinear layers, our contributions, Statistical-max Softmax and DelayNorm, help bypass deep comparison trees and homomorphic divisions to reduce bootstrapping by up to 46%. On encrypted BERT-Tiny, ELLMo achieves a $1.4\times$ speedup over state-of-the-art baselines with 0-1.5% accuracy loss across SST-2, MRPC, and RTE downstream tasks.

Efficient evaluation of multivariate polynomials over finite spaces is a central primitive in algebraic cryptanalysis, particularly in exhaustive search attacks against multivariate public key cryptosystems (MPKCs). For the Boolean space $\mathbb F_2^n$, Bouillaguet et al. introduced the fast exhaustive search (FES) algorithm at CHES 2010. This line of work was further developed by Dinur at EUROCRYPT 2021 and Bouillaguet at TOMS 2024. Extending beyond the Boolean setting, Furue and Takagi proposed an algorithm at PQCrypto 2023 that generalizes FES to the finite-field space $\mathbb F_q^n$ where $q$ is a prime number, achieving time complexity $\mathcal O\big(d\cdot q^n\big)$ and memory complexity $\mathcal O\big(\log(q\cdot n)\cdot n \cdot \binom{n+d}{d}\big)$. However, all these algorithms operate over the full space $\mathbb F_q^n$, which limits their applicability in many cryptanalytic scenarios where polynomial evaluation is required only over specific subsets of $\mathbb F_q^n$, such as those arising in the Syndrome Decoding Problem. Recently, Liu et al. proposed a memory-efficient algorithm for evaluating polynomials over structured spaces $P_{n_s}^{w_s} \times \cdots \times P_{n_1}^{w_1} \subseteq \mathbb F_2^n$, where $\sum_{i=1}^{s} n_i = n$ and $P_{n_i}^{w_i} \subseteq \mathbb F_2^{n_i}$ denotes the set of vectors of length $n_i$ with Hamming weight at most $w_i$. In this work, we extend the structured-space evaluation paradigm from the Boolean setting to arbitrary finite fields $\mathbb F_q$. Building on the abstraction of evaluation rules and evaluation orders introduced by Liu et al., and combining it with higher-order derivative techniques over finite fields, we develop a unified theoretical framework for evaluating multivariate polynomials over structured spaces $S \subseteq \mathbb F_q^n$. After an initialization phase with cost $\mathcal{O} \big(\binom{n+d}{d}^2 \big)$, our method evaluates a degree-$d$ polynomial over $S$ using $\mathcal O\big(d \cdot |S|\big)$ operations and requires $\mathcal O\big(\log(q)\cdot \binom{n+d}{d}\big)$ memory.

The past few years have witnessed the growing importance of pseudorandom correlation generators (PCGs) for generating correlated randomness with sublinear communication. To date, quasi-linear time PCGs for oblivious linear evaluation (OLE) over arbitrary finite fields have been constructed under either Ring-LPN or Quasi-Abelian syndrome decoding (QA-SD) assumptions, with a throughput of millions of OLEs per second demonstrated, in particular, for binary field. However, many modern MPC protocols deal with large prime fields, in which existing PCGs suffer from a significant efficiency gap due to a quasi-linear number of {\em multiplications} involved in FFT (Fast Fourier Transform) algorithms. Moreover, FFT typically relies on FFT-friendly fields that contain large smooth multiplicative subgroups, and therefore are not well suited to popular fields, such as Mersenne prime fields.

In this work, we close the gap by leveraging the well-known Walsh-Hadamard transform (WHT) in the context of QA-SD based PCGs. Although WHT is still a quasi-linear time algorithm as normal FFTs, no multiplication is needed — addition and subtraction suffice. Since multiplications over a prime field $\Fp$ typically incur an $O(\log{p})$ overhead over additions, our scheme that avoids a large number of multiplications perfectly fits the large prime field setting. Experimental results show that WHT is at least one magnitude faster than FFT over a $64$-bit smooth prime field. Consequently, our PCG achieves $27,000$ OLE per second over a $64$-bit prime field. This is the first full implementation of PCG for OLE over arbitrary large prime fields that we are aware of.

We then build PCG for vector-OLE over arbitrary large prime fields from QA-SD assumptions, and fully implement it using the $\mathsf{libOTe}$ library. We achieve a throughput of over $5$ million vector-OLEs per second over a $64$-bit prime field, roughly four times faster than state-of-the-art PCGs from either expand-accumulate (EA) codes (Boyle et al., CRYPTO 2022), or expand-convolute (EC) codes (Raghuraman et al., CRYPTO 2023).

We present HyperFrog, a lattice-based Key Encapsulation Mechanism (KEM) targeting post-quantum security levels. The construction instantiates a variant of the Learning With Errors (LWE) problem in which the secret vector is derived from high-genus topological structures embedded in a three-dimensional grid. Unlike standard LWE schemes that draw secrets from uniform or Gaussian distributions, HyperFrog uses a topology-mining procedure to generate sparse binary secret keys corresponding to connected subgraphs with cyclomatic number (genus) >= 8, introducing geometric constraints while preserving combinatorial hardness.

To achieve practical robustness, the scheme applies the Fujisaki-Okamoto (FO) transform, attaining IND-CCA2 security under standard assumptions. The reference implementation, internally codenamed "Topological Obsidian", includes a constant-time decoding routine based on branchless arithmetic to eliminate secret-dependent control flow during decryption and re-encryption. We provide benchmark results on an AMD Ryzen 9 5950X implementation using AVX2 vectorization for polynomial arithmetic, and demonstrate the integration of the KEM into a high-performance AES-256-GCM hybrid encryption pipeline.

Event date: 10 May 2026
Submission deadline: 25 February 2026
Notification: 20 March 2026

Event date: 1 September to 4 September 2026
Submission deadline: 15 April 2026
Notification: 1 June 2026

The Applied Crypto Group of the University of Luxembourg is offering a post-doc position in cryptography. Possible topics of interests are fully homomorphic encryption, public-key cryptanalysis, and side-channel attacks and countermeasures. We offer a competitive salary (about 85,000 euro/year gross). The duration of the position is 2.5 years. Deadline of application is March 15th.

Closing date for applications:

Contact: Jean-Sebastien Coron - jean-sebastien.coron at uni dot lu

More information: http://www.crypto-uni.lu/vacancies.html

At IN Groupe, you contribute to a safer world by working with an international community. Our pioneering technologies meet the highest standards, and we continue to adapt quickly to stay ahead in an ever-changing world.

As a Senior Engineer in Cryptography and Embedded Security, within the R&D team, you will be a key point of reference for security-related aspects. You will design high-security cryptographic algorithms for embedded systems. You will analyse and evaluate the security of these implementations against physical and software attacks to ensure a high level of protection for our embedded solutions. You will work on state-of-the-art technologies and the latest generations of cryptographic primitives.

Key skills :

Experience with physical attacks, such as:

- Side-channel attacks (power, EM, timing)

- Fault injection attacks (laser, EM)

- Knowledge of defensive countermeasures at software and/or hardware level

- Excellent analytical and synthesis skills, high responsiveness

Preferred Skills : Experience with smart cards or similar technologies (e.g., Hardware Security Modules – HSM)

- Background in vulnerability research, reverse engineering, or binary analysis

- Knowledge of basic communication standards such as ISO7816, ISO14443

- Knowledge of post-quantum cryptography (PQC) and cryptographic protocols

Closing date for applications:

Contact: Alexandre Gonzalvez (alexandre.gonzalvez(at)ingroupe.com)

More information: https://www.linkedin.com/jobs/view/4359537260/

With E-STEEM – empowering women in STEM and Economics, the University of Vienna awards at least 20 four-year and full-time (40h/week) postdoctoral positions to outstanding female scientists in natural sciences, life sciences, and economics.

At the Faculty of Computer Science, the research group "Security and Privacy", led by Prof. Edgar Weippl, offers an excellent environment to deepen your research in applied IT/software/AI security. The research group "Theory and Applications of Algorithms" offers the opportunity to explore foundational questions in cryptography under the supervision of Ass.-Prof. Karen Azari.

Applications must contain all required documents and be done exclusively through the linked job portal of University of Vienna.

University of Vienna is located centrally and public transport is extraordinarily good. Vienna is internationally very well connected by train, plane and bus. There are several security and cryptography research groups in and around Vienna with whom we have regular exchange.

Closing date for applications:

Contact: for a postdoc in Applied Security: Edgar Weippl (edgar.weippl(at)univie.ac.at)

for a postdoc in Foundations of Cryptography: Karen Azari (karen.azari(at)univie.ac.at)

More information: https://careers.univie.ac.at/en/postdoc/e-steem

The Safety-Security-Interaction Group at the Computer Science Department of the University of Oldenburg invites applications for a Ph.D. position in IoT Security in the context of medical applications (full-time).

Excellent command of the English language is required; German language skills are not required.

Application deadline: 8 March 2026

Complete job announcement and application procedure: https://uol.de/job936en

Closing date for applications:

Contact: Prof. Dr. Andreas Peter ([email protected])

More information: https://uol.de/job936en

As a key member of the project, you will be responsible for a range of critical tasks that will shape the project’s success: (1) Adversarial attack development: you will design and implement problem-space adversarial attacks against LLM-based vulnerability detection systems. (2) Robustness evaluation framework: you will develop comprehensive assessment methodologies to quantify the weaknesses and limitations of LLMs in software vulnerability detection. (3) Explainable detection pipeline: you will investigate and document the mechanisms through which LLMs identify software vulnerabilities, creating an interpretable detection framework that provides insights into model decision-making processes. (4) Human-in-the-loop system design: you will develop innovative approaches for integrating human expertise with LLM capabilities, including alignment techniques for human-to-LLM reasoning transfer and interactive training methodologies to enhance detection robustness. (5) Leader board development and validation: you will design and implement a dynamic evaluation platform that tracks and ranks state-of-the-art LLMs for vulnerability detection, conducting rigorous testing to ensure accurate assessment of model robustness against adversarial attacks.

Closing date for applications:

Contact: Qiang Tang ([email protected])

More information: https://app.skeeled.com/offer/c/691c3d2e6442c61b9ca4dd22?lang=en&show_description=true

Fortanix is a leader in data-centric cybersecurity for hybrid multicloud environments, delivering advanced cryptography, encryption, and confidential AI solutions. As data breaches increase and traditional perimeter-based security falls short, Fortanix helps organizations discover, assess, and remediate data exposure risks—protecting sensitive data wherever it lives. Our unified platform supports Zero Trust strategies and prepares enterprises for the post-quantum era. Recognized with multiple Cybersecurity Excellence and Innovation Awards and trusted by partners such as NVIDIA, Microsoft, Intel, ServiceNow, and Snowflake, Fortanix brings together cryptography experts and industry leaders in a collaborative, high-integrity culture. We’re proud to be recognized as a Great Place to Work and are building the future of data security. Role Overview Fortanix is seeking a Cryptography Software Engineer based in Eindhoven, Netherlands, with 3+ years of experience building cryptographic systems. You’ll work on production-grade cryptography in Rust, C/C++, and/or Golang, contributing to secure, high-performance platforms used globally. What You’ll Do Design, implement, and maintain cryptographic software and APIs Integrate new cryptographic algorithms and analyze existing designs Research state-of-the-art attacks and implement side-channel mitigations Participate in code reviews and technical design discussions Deploy, monitor, and optimize software performance Document and share knowledge on cryptographic techniques What You’ll Bring 3+ years of backend engineering experience with cryptography exposure Proficiency in Rust, C/C++, and/or Golang Experience working in Linux environments Master’s degree in Cryptography or a related field (or equivalent experience) EU residency with a valid work permit Nice to Have Experience with security domains such as key management or PKI Familiarity with Git, containers, orchestration tools, and NoSQL databases

Closing date for applications:

Contact: Shannon Mrosko Sr. Talent Acquisition Partner [email protected]

More information: https://apply.workable.com/fortanix/j/A122E95976/