International Association
for Cryptologic Research

This paper introduces a novel set of code-based protocols to demonstrate algebraic relationships in zero knowledge. Specifically, we present a comprehensive collection of secure arguments of knowledge for verifying additive and multiplicative relationships between syndrome-committed secrets, including matrix products, which enable us to construct a generic arithmetic circuit framework. We leverage these primitives to formulate a rich variety of privacy-oriented primitives, such as a post-quantum range proof, lookup argument, and verifiable shuffle protocols. These contributions provide the necessary ingredients to transition advanced confidential designs, such as cryptocurrencies, into the post-quantum code-based setting.

We present multi-query attacks on key-then-hash (KTH) functions in the blinded keyed hash model that achieve an advantage growing quadratically in the number of queries up to a small constant factor from the information-theoretic upper bound. We introduce three families of attacks. Catch attacks exploit the group structure of the digest space and achieve deterministic success with $2\sqrt{\varepsilon^{-1}}$ queries. Group attacks embed high-probability differentials into subgroups of the message space of quadratic advantage. Translation attacks exploit offset-invariance to linearly scale any existing attack. Our attacks apply in two concrete settings: with $\Delta$ fixed to $0$, they target the compression phase of farfalle-based primitives such as Xoofff, and with $\Delta$ as a free parameter, they target deck-based wide block cipher constructions such as the double-decker. We connect optimal query set construction to results in additive combinatorics and generalize our results to concatenated KTH functions. Experiments on NH and Xoodoo[3] show our attacks reach an advantage within a factor $2^{4}$ of the theoretical bound. Our analysis reveals that for bit-sliced permutations with degree-2 round functions, solution set overlap is inherent, limiting but not preventing the attacker from approaching the bound. Our experiments highlight that trail cores with a large number of active columns in the last round are particularly dangerous for KTH functions, introducing a new criterion for the design of permutations used in such constructions.

For any key-then-hash function, there is no security gap between key recovery and forgery. The expected cost of recovering the key given differential-based forgery, in the information-theoretic setting, is logarithmic in the number of solutions to the underlying differential equation. The notion of weak-key classes as defined by Handschuh and Preneel in their CRYPTO 2008 paper does not apply to key-then-hash functions. Every key is equally vulnerable, and the attack complexity is entirely determined by the universality bound. This applies to four out of six keyed hash function families studied in their paper, namely, NH, NMH, WH and Square Hash. In this paper, we revisit the analysis done in 2008 to NH through the lens of the key-then-hash framework. We are able to prove that the properties attributed to the class of weak keys in NH are actually intrinsic to the whole key space. Furthermore, this result can be generalized to any key-then-hash function. We demonstrate this generality by applying our framework to key-then-hash constructions instantiated with Xoodoo[3] and Square Hash, and show that an efficient key recovery is possible.

In this paper, we present RISQrypt, the first unified architecture in the literature that implements Kyber (ML-KEM) and Dilithium (ML-DSA), standardized lattice-based Post-Quantum Cryptography (PQC) algorithms, with masking. RISQrypt is a hardware–software co-design framework that integrates dedicated cryptographic accelerators to speed up polynomial arithmetic, hashing, and mask-conversion operations, the latter being one of the primary bottlenecks in masked implementations of lattice-based PQC. Our design achieves low latency while providing both theoretical and practical side-channel security, as validated through experimental evaluation. Specifically, the masked decapsulation of Kyber768 requires 109K clock cycles, while masked signing of Dilithium3 requires 1230K clock cycles on average. These results demonstrate 11.3x time-performance improvement over existing masked implementations. Our performance results for unprotected functions also outperform the existing work by up to an order of magnitude. In addition, prior designs are more limited in scope, generally supporting only a single scheme and lacking the unified, crypto-agile framework that enables support for both Kyber and Dilithium as in our architecture. Leveraging the HW/SW co-design approach, our proposed architecture can be readily extended to other PQC standards such as Falcon and SPHINCS+, as well as to algorithms sharing similar computational building blocks, through firmware reprogramming.

The Fischlin transform yields non-interactive zero-knowledge proofs with straight-line extractability in the classical random oracle model. This is done by forcing a prover to generate multiple accepting transcripts through a proof-of-work mechanism. Whether the Fischlin transform is straight-line extractable against quantum adversaries has remained open due to the difficulty of reasoning about the likelihood of query transcripts in the quantum-accessible random oracle model (QROM), even when using the compressed oracle methodology. In this work, we prove that the Fischlin transform remains straight-line extractable in the QROM, via an extractor based on the compressed oracle. This establishes the post-quantum security of the Fischlin transform, providing a post-quantum straight-line extractable NIZK alternative to Pass’ transform with smaller proof size. Our techniques include tail bounds for sums of independent random variables and for martingales as well as symmetrization, query amplitude and quantum union bound arguments.

We introduce Bolt, a new Multilinear Polynomial Commitment Scheme (MLPCS) designed for high-performance SNARKs over binary fields. Bolt is geared towards SNARKs for large computations, in which prover speed is paramount but one can afford slightly larger proofs. The construction is based on the code-switching paradigm; our core technical contribution is a new "proof-system friendly" error-correcting code with extremely efficient encoding both asymptotically and concretely. Bolt offers a significantly faster prover than prior works, while maintaining a moderately larger, yet still reasonable, proof size.

Theoretically, Bolt achieves a commitment time of approximately $(3+\varepsilon) \cdot N$ field additions plus a Merkle Tree hash computation of size $(1+\varepsilon) \cdot N$ field elements, where $N$ is the size of the multilinear polynomial and $\varepsilon>0$ is arbitrarily small. The prior state-of-the-art, Blaze (Brehm et al., Eurocrypt 2025) used more than $8N$ field ops and a $4N$ size Merkle hash.

Concretely, our implementation demonstrates that these asymptotic gains translate into substantial real-world speedups. Our benchmarks show that for $N=2^{30}$ over a $32$-bit field, Bolt achieves a commitment time roughly $3 \times$ faster than Reed-Solomon based schemes, albeit with a moderately larger proof. Bolt also offers better commitment time and proof size than recent linear-time schemes. For example, its commitment time is about $1.34 \times$ faster than Brakedown (Golovnev et al., Crypto 2023) and with a $2 \times$ shorter proof.

This paper investigates hash-function constructions derived from lightweight block ciphers, that are suitable for evaluation in fully homomorphic encryption (FHE) settings. We focus on PRINCEv2, a 64-bit lightweight block cipher with 128-bit keys and low algebraic complexity, which is particularly amenable to FHE evaluation. However, the small block size of such ciphers limits the applicability of standard hash-function transforms. Indeed, achieving 128-bit collision resistance in the (n, 2n) setting, i.e., with 64-bit blocks, requires a quadruple-block-length (QBL) compression function, for which no generic construction is known. In this work, we propose a concrete QBL compression construction tailored to PRINCEv2 and analyze its collision resistance. Candidate QBL designs inspired from existing double-block-length constructions are also outlined. As a further contribution, we describe a carefully optimized homomorphic circuit design for PRINCEv2. The resulting implementation outperforms previous works in both operation counts and computational depth. Experimental timings demonstrate the practical feasibility of evaluating the corresponding hash constructions under FHE with low latency, while providing cryptographically small failure probability.

Event date: 6 October to 9 October 2026
Submission deadline: 15 May 2026
Notification: 23 June 2026

Event date: 23 November to 25 November 2026
Submission deadline: 10 June 2026
Notification: 10 August 2026

Event date: 9 May to 10 May 2026
Submission deadline: 15 March 2026
Notification: 10 April 2026

Event date: 9 May 2026
Submission deadline: 6 March 2026
Notification: 20 March 2026

Event date: 5 May to 8 May 2026

The Computer Security and Industrial Cryptography (COSIC) group belongs to the Electrical Engineering Department at the KU Leuven. The COSIC team has about 100 researchers, including 9 professors, 6 researcher managers/experts, 20 postdoctoral researchers, 60 PhD students, 8 visitors, and 7 support staff.

We are looking for a motivated candidate for a PhD position on practical fully homomorphic encryption. The student will be a part of the FINAL project team. The research will include the design and implementation of novel techniques and improvements for the FINAL scheme using advanced cryptographic techniques such as MPC, FHE, and Zero Knowledge Proofs with the explicit intention for industrial deployment.

Responsibilities:

Design and implement efficient building blocks and protocols for the FINAL scheme.

Improve and optimize implementations for industrial deployment

Plan, design, and evaluate test cases with industry stakeholders

More info and how to apply
https://www.esat.kuleuven.be/cosic/vacancies/

Closing date for applications:

Contact: [email protected]

More information: https://www.esat.kuleuven.be/cosic/vacancies/

This is an urgent call for interested applicants. A funded Ph.D. student position is available for Fall 2026 to work on different aspects of Cryptographic Engineering in the Bellini College at USF (Tampa, FL) with Dr. Mehran Mozaffari Kermani.

We need an applicant who already does have Master’s in Computer Engineering or Computer Science with hardware background (do not contact if you have not obtained a Master’s degree, this position is not for direct Bachelor’s to Ph.D.)

Please send email me your updated CV (including list of publications, language test marks, and references), transcripts for B.Sc. and M.Sc., and a statement of interest to: mehran2 (at) usf.edu as soon as possible. NOTE: The successful candidate will be asked to apply formally very soon to the college, so all the material has to be ready. We do not require GRE.

Closing date for applications:

Contact: Prof. Mehran Mozaffari Kermani

A position for a postdoctoral researcher in isogeny-based cryptography is available in the research group led by Prof. Lorenz Panny in the Department of Mathematics at TUM, located at the Garching campus.

The group was established in 2023 and primarily focuses on mathematical and algorithmic aspects of post-quantum cryptography, ranging from constructive to cryptanalytic considerations. At this time, the group consists of the group leader and two PhD students (one at TUM, one external).

This position is part of the DFG-funded CRYPTIQ project, a cooperation with Prof. Christophe Petit (Université libre de Bruxelles, Belgium). The position is limited to about 2 years (depending on the start date), with a salary following the German TV-L scale for civil servants (level E13). Funding for attending academic events is available.

Requirements for the position include a doctoral degree in a suitable field (mathematics or computer science), as well as solid English skills in speaking and writing (knowledge of German is not needed). The ideal candidate has previously completed novel research projects on topics in (or related to) isogeny-based cryptography, and has built an excellent academic track record in the process.

Applications should include:

• Detailed academic CV.
• (Link to) applicant's PhD thesis.
• Information about possible/desired start dates.
• Name(s) and email address(es) of one or multiple professors willing to provide a letter of recommendation directly to us upon request. (There is no need to send a letter immediately as part of the application.)

Applications will be reviewed starting March 1 until the position is filled. Please send your application files to [email protected] with a meaningful subject line. Feel free to contact the same address for any questions about the position.

Closing date for applications:

Contact: Lorenz Panny <[email protected]>

The Department of Information Security and Communication Technology invites applications for a PhD Research Fellow position in Post-Quantum Cryptography for Privacy Preserving Protocols. The successful candidate will be offered a 4‑year appointment that includes teaching responsibilities.

The selected candidate will conduct research in Post-Quantum Cryptography with a particular focus on privacy-preserving protocols. The research will cover major Privacy-Enhancing Techniques (PETs), including Fully Homomorphic Encryption (FHE), Secure Multi-party Computation (MPC), and Zero-Knowledge Proofs (ZKPs). The candidate will design, analyze, and implement advanced privacy-preserving cryptographic protocols, with applications to real-world domains such as machine learning, distributed systems, and blockchain technologies.

At NTNU we want to increase the proportion of women in scientific positions. Female students are therefore encouraged to apply.

The application deadline is March 20, 2026

For more information, please check the official job announcement.

Closing date for applications:

Contact: Associate professor Jeongeun Park ([email protected])

More information: https://www.jobbnorge.no/en/available-jobs/job/295226/phd-candidate-in-post-quantum-cryptography-for-privacy-preserving-protocols

Internship: Automated Complexity Evaluation for Differential Cryptanalysis

Context The evolution of cryptography and emerging threats (IoT, AI) requires robust encryption schemes. The TAGADA library (Libralesso et al. 2021) assists cryptographers by estimating differential distinguisher probabilities. However, evaluating the full security of an algorithm requires measuring the global time complexity of attacks, beyond simple probabilities.

Objectives The goal is to model and automate the complete complexity evaluation of differential attacks. Key missions include:

• Key Recovery Integration: Incorporating automated key recovery phase evaluation into existing resolution models.
• Global Optimization: Developing methods to optimize overall attack complexity instead of isolated sub-problems (balancing distinguisher probability vs. key extraction cost).
• Security Bounds: Identifying more precise security limits for encryption standards.

Candidate Profile Master’s or Engineering student in Computer Science, Mathematics, or Cybersecurity. Strong interest in symmetric cryptography and algorithmic optimization. Proficiency in English (technical reading/writing). Future Prospects Depending on results, this internship can lead to a PhD in Cryptanalysis (eligible for EU citizens).

Closing date for applications:

Contact: Loïc Rouquette

The paper addresses the challenging and timely issue of vote buying in electronic voting. Electronic voting is a well established process in modern democracies. However, problems such as vote buying continue to pose a significant challenge. This paper aims at addressing this issue by leveraging the novel concept of Anamorphic Encryption to enable voters to cast their original vote together with a hidden ``fake" one. In this way voters can pursue their true preferences unobstructed while providing a compliance proof to potential vote buyers. The security of our construction is proved through a formal security analysis, that considers powerful adversaries who aim at breaching user privacy and influencing votes. We believe that this innovation e-voting approach can enhance the overall security of e-voting systems and pave the way to avoid electoral manipulation.

Interactive Oracle Proofs (IOPs) enable a probabilistic verifier interacting with a prover to verify NP statements while reading only few bits from the prover messages. Zero-Knowledge IOPs (ZK-IOPs) have the additional guarantee that a query-bounded (possibly malicious) verifier learns nothing about the NP witness.

We initiate a systematic study of ZK preservation under IOP composition, and prove general composition theorems for ZK-IOPs in the 2- and multi-IOP setting. Our main result shows that ZK is preserved in the setting of perfect, black-box, straight-line ZK (the standard setting for ZK-IOPs), if the outer IOP has an additional mild property that is satisfied by existing ZK-IOPs. Contrary to common belief, this does not follow from composition theorems for multiparty protocols (Kushilevitz, Lindell and Rabin, STOC`06).

Our composition theorems show that ZK-IOPs can be modularly designed by composing sub-protocols, and ZK of the composed system follows seamlessly from the ZK guarantees of its building blocks. Using our composition theorems, we easily derive both new and known results on ZK-IOPs in various settings, including ZK preservation under parallel/sequential composition, ZK of IOPs for sumcheck and codeswitching, ZK of IOPs for NP using arithmetization and sumcheck, and ZK preservation under IOP proof composition (reproving a result of Bootle, Chiesa and Liu, EC`22).

We present new algebraic attacks on Poseidon2 and Poseidon2b. We exploit the specific structure of the matrices that define the linear layers in the hash function which allows us to improve round-skipping for the constrained-input constrained-output CICO problem. The security of many circuit-friendly hash functions has been measured by their resistance against attacks on the CICO problem. However, we show how to boost our round-skipping attack when directly modelling algebraic preimage attacks of Poseidon2(b) in compression and sponge mode. To the best of our knowledge, our attack provides the first examples where finding preimages is easier than solving the corresponding CICO problem in Poseidon2(b). Furthermore, we describe the first algebraic collision attack that outperforms its algebraic preimage counterpart. We improve over state-of-the-art algebraic attacks for a range of parameters, e.g. for one recommended $128$-bit parameter set we improve over previous state-of-the-art algebraic collision attacks by a factor of $2^{106}$. However, due to the algebraic security margin this does not mean the primitive falls short of its claimed security level. Finally, we discuss how our attacks can be mitigated without affecting the efficiency of Poseidon2(b).