International Association
for Cryptologic Research

Updatable (public-key) encryption is a broad concept covering (public-key) encryption schemes whose keys can evolve over time to support secure key rotation and limit the impact of key compromise. The essential feature is that the encryption keys (and possibly also ciphertexts) can be updated from one epoch to the next via so called update tokens. This concept is useful in various applications, among them secure outsourced storage, secure messaging or low-latency forward-secret key-exchange protocols.

The term, however, is used with varying meanings across the literature. Some works define key-updatable schemes, where only the public and secret keys evolve. Others extend this idea by also allowing ciphertexts to be updated during key evolution. Variants further differ in how evolution is triggered: in some schemes, the receiver performs key updates locally, while in others, the sender initiates the evolution by embedding update information in ciphertexts. Beyond achieving forward secrecy, many formulations also aim for post-compromise security, ensuring that once a compromised key is updated, future ciphertexts regain confidentiality under the new key.

In this paper, we systematize this field with a focus on updatable public-key encryption schemes. Our aim is to first provide a taxonomy that sheds light into the currently fragmented terminology. It then compares their formal definition, syntaxes and formal security models found in the literature, clarifies their interrelations, and identifies common design patterns underlying current schemes. Beyond mapping the definitional landscape we provide a comparative analysis of existing instantiations, focusing on their properties and efficiency, and highlighting their main trade-offs. The paper concludes with open challenges outlining directions for advancing the field.

Cold boot attacks, first introduced by Halderman et al. (USENIX'08), are a class of attacks that aim at recovering cryptographic secrets stored in volatile memory after a computer is powered off, using the fact that DRAM modules retain their contents to a large extent for some time, especially at low temperatures. Cold boot attackers can recover the original contents of memory with some flipped bits, with bit flip probabilities of <10% for one-to-zero and much lower (<0.1%) for zero-to-one shown to be easily achievable. The cryptanalytic goal is then to recover full secret keys based on this noisy data. Successful key recoveries from cold boot attacks have been shown to be feasible for various symmetric and public-key schemes, including AES, RSA, and more recently some lattice-based encryption schemes with secret keys stored in the number-theoretic transform (NTT) domain.

In this paper, we investigate cold boot attacks against NTRU-based signature scheme Falcon and its ancestor, the signature scheme of Ducas–Lyubashevsky–Prest (DLP). Those schemes significantly differ from other schemes previously considered for cold boot attacks, since, in particular, the memory representation of secret signing keys mostly consists of floating point values. As a result, the various relations existing between key coefficients only hold up to floating point errors, which makes key recovery more complex. Nevertheless, at the typical bit flip probabilities achievable with cold boot attacks, we manage to fully recover Falcon and DLP keys with good probability across all parameters in simulations carried out in a simple bit flip model. Furthermore, we validate our techniques using concrete cold boot experiments againt Falcon on a Raspberry Pi single board computer.

Finally, we propose countermeasures with negligible computational cost that significantly reduce the memory footprint of signing keys for Falcon and DLP, and at the same time make cold boot attacks considerably harder.

We introduce vkproof, a preprocessing SNARG which enables verification of the Varuna verifying key (or that of any similar proof system based on Marlin [Chi+20]) for the R1CS compiled from a given higher-level program. It has constant proof size and affords linear verifier costs in the number of instructions of the program rather than the density of the compiled R1CS, which makes it especially appealing in contexts where complex-to-arithmetise functions (such as hashing) appear as program instructions frequently. This verifier succinctness is achieved through modular compilation of programs and the use of fingerprints to verify polynomial correctness. We augment the algebraic holographic proof (AHP) model of Marlin by allowing oracles to witness polynomials in the instance and queries to linear combinations of indexed polynomials, resulting in a primitive we refer to as extended algebraic holographic proofs (eAHP).

ML-DSA implementations face a serious risk from partial leakage of the mask vector $\boldsymbol{y}$. Recent research has shown that this threat is practical. Even highly noisy, single-bit leakage accumulated over many signatures can suffice to recover the secret key. We carefully analyze the number of signatures with bit leakage required for successful key recovery using a stochastic model, rather than relying on a concrete attack method. On the practical side, we develop new attack methods capable of recovering the key using almost the minimal number of signatures required in theory. Our attacks work for bit-error probabilities as high as 0.49 and for leakage at every bit position of index at least four or five (depending on the ML-DSA parameter set), making them more widely applicable than prior attacks, which were not reported to succeed for bit positions below six. In the most favorable scenario, leakage at bit index four keeps our attack practical for leaked bits with an error probability of 0.499, and in the absence of noise reduces the signature requirement to below 1000.

Privacy-preserving data aggregation has become a fundamental tool for large-scale analytics in AI-driven and cloud-based systems. While existing solutions provide the default privacy guarantee, i.e., input confidentiality, most assure a semi-honest adversary model and fail to simultaneously ensure user anonymity, selective disclosure, and result privacy in the multiple data customers environment. In this work, we introduce PRIVADA, a maliciously secure data aggregation solution that uses MPC in the SPDZ framework. Unlike prior data aggregation schemes using MPC with/without SPDZ, PRIVADA supports multiple data customers while preventing inference of user participation and resisting collusions in real-world data aggregation applications. Moreover, our work guarantees \emph{user privacy} and \emph{result privacy}, in addition to \emph{input privacy}. PRIVADA outperforms the state-of-the-art solutions by providing security against participating parties, including malicious data owners, aggregators, and data customers. Our proof-of-concept implementation also supports the new privacy-preserving data aggregation by combining malicious security, being available for multiple data customers, and ensuring strong privacy guarantees in large-scale deployments. The aggregation operation on the aggregator side becomes simpler with PRIVADA, and experimental results show a 12--15 times speedup compared to the state-of-the-art. This confirms that malicious security and strong privacy guarantees can be achievable without sacrificing practicality.

Some consensus protocols, including Proof-of-Work (PoW) and Proof-of-Stake (PoS) designs of Ethereum, contain incentive misalignment because the protocol cannot technically verify whether a block producer or validator has executed (or omitted) validation of transaction correctness before producing a block or issuing an attestation. The incentive to omit validation stems from the risk of losing a fraction of the reward due to a late attestation in PoS, or the risk of missing timely block production (and thus its inclusion) in PoW.

This problem is referred to as the Verifier’s Dilemma (VD), and it has been investigated in prior work in the context of PoW, as well as in hybrid PoW and PoS settings of Ethereum.

In this work, we focus on Ethereum PoS, and we investigate how rational, minimally compliant validators affect long-term network decentralization due to VD and operational costs. Using evolutionary game theory and the replicator equation, we model competition among three validator phenotypes: the honest strategy, the lazy strategy, and the join pool strategy. While the honest strategy, which performs validation, requires the operational cost of expensive hardware to run a full validator node, which is currently about 20% of rewards earned, the lazy strategy, which omits validation (based on VD), enables operation of a reduced validator node at five times lower expense, which is currently about 4% of rewards earned. Moreover, the join pool strategy enables amortization of operational costs among pool members and can incorporate the lazy strategy to further reduce costs.

We analyze the profits of these strategies co-occurring under varying late attestation rates and operational cost levels using our slot-level simulator. Our findings demonstrate that the lazy strategy consistently outperforms the honest strategy in earned profits. Our next experiments reveal that the join pool strategy, combined with a variant of the lazy strategy, forms an evolutionarily stable equilibrium that rapidly collapses the validator population into a single shared pool. These results suggest that Ethereum decentralization can erode through rational economic drift even in the absence of late attestations.

Identity-based Identification (IBI) schemes have gained significant popularity in the field of cryptography due to their superior efficiency and scalability. However, the increasing number of proposed IBI schemes in recent years has made it challenging to compare and evaluate them effectively. To address this issue, this survey presents a comprehensive literature review and analysis of IBI schemes that offer security under various hardness assumptions. Employing a rigorous survey methodology, we introduce the first general taxonomy of IBI schemes, allowing for a systematic classification and evaluation of these schemes based on their security assumptions. Furthermore, we assess the computational and communication costs associated with the deployment of IBI schemes, considering the various challenges and limitations involved. For each class of schemes, we calculate and compare their security, efficiency, benefits, and drawbacks. Researchers and developers are actively involved in implementing and analysing the runtime of IBI, particularly in diverse applications such as mobile and IoT devices. We present implementations and provide essential insights for guiding future advancements in this dynamic field. The survey concludes by identifying current research gaps and proposing future directions for IBI schemes, providing researchers and practitioners with an in-depth understanding of the state-of-the-art in this rapidly evolving field.

Chenu and Smith introduced the notion of $(d,\varepsilon)$-structures, pairs consisting of an elliptic curve over $\mathbb{F}_{p^2}$ and an isogeny of degree $d$ from the curve to its Galois conjugate. They also defined an ideal class group action on a set of supersingular $(d,\varepsilon)$-structures, inherited from the action on oriented supersingular elliptic curves. As cryptographic applications of this action, they outlined extensions of the CSIDH key exchange and of the Delfs-Galbraith algorithm for the supersingular isogeny problem. In particular, their extension of the Delfs-Galbraith algorithm, called the generalized Delfs-Galbraith algorithm, is expected to be more efficient than the original one by a constant factor. Therefore, it is important to find efficient methods for evaluating the ideal class group action on $(d, \varepsilon)$-structures.

In this paper, we focus on the case $d=2$ and present explicit radical 3-isogenies for evaluating the action of the class of a prime ideal above 3. Our approach relies on two representations of $(2,\varepsilon)$-structures: (i) reductions of degree-2 $\mathbb{Q}$-curves and (ii) Montgomery curves. In particular, we show that any $(2,\varepsilon)$-structure can be represented as a pair of a curve coefficient (of a degree-2 $\mathbb{Q}$-curve or a Montgomery curve) and a single sign. From these representations, we derive radical 3-isogenies that efficiently implement the action of the class of a prime ideal above 3. As an application of our radical 3-isogenies, we give an explicit algorithm of the meet-in-the-middle method for finding an ideal class connecting two given $(2, \varepsilon)$-structures, which is a part of the generalized Delfs-Galbraith algorithm.

The IACR Fellows Program recognizes outstanding IACR members for technical and professional contributions to the field of cryptology. Today we are pleased to announce thirteen members that have been elevated to the rank of Fellow for 2026:

• Amos Beimel: for fundamental contributions to secret sharing and secure computation.
• Colin Boyd: for contributions to public-key cryptography and fostering the growth of the Australian cryptologic community.
• Jean-Sébastien Coron: for essential contributions to cryptanalysis, the design of cryptographic primitives, and side-channel security, and for outstanding service to the IACR.
• Fierre-Alain Fouque: for a wide range of contributions to cryptanalysis and asymmetric cryptography and for service to the cryptologic community.
• Henri Gilbert: for linear cryptanalysis and for other fundamental contributions to symmetric-key cryptanalysis, and service to the cryptologic research community.
• Nadia Heninger: for impactful contributions to the analysis of deployed cryptographic protocols and service to the IACR and the wider security community.
• Aggelos Kiayias: for outstanding contributions to cryptographic designs, including the science and implementations of blockchains, for educational leadership, and for service to the IACR.
• Brian LaMacchia: for outstanding service to the IACR and the cryptologic community and for technical contributions to cryptologic practice.
• Gregor Leander: for seminal contributions to symmetric cryptography and outstanding service to the IACR community through editorial leadership, conference organization, and sustained scientific excellence.
• Willi Meier: for seminal contributions to the design and analysis of stream ciphers, and a life long dedication to conducting and promoting research in symmetric-key cryptology.
• Vinod Vaikuntanathan: for fundamental contributions, including to fully homomorphic encryption, secure computation, quantum cryptography, and information-theoretic cryptography.
• Huaxiong Wang: for significant contributions to the design and analysis of cryptosystems and outstanding service to the cryptologic community, particularly in the Asia-Pacific region.
• Hoeteck Wee: for fundamental contributions to the design, construction, and implementation of advanced encryption schemes.

We present RoKoko, a new lattice-based succinct argument system that achieves a linear-time prover alongside polylogarithmic communication and verifier complexity. Asymptotically, our construction improves upon RoK and Roll (ASIACRYPT 2025), the first post-quantum SNARK with $\tilde{O}(\lambda)$ proof size, by a multiplicative factor of $\Theta(\log \lambda)$. Practically, our system yields proofs of roughly $200$KB, while outperforming the state-of-the-art polynomial commitment scheme Greyhound (CRYPTO 2024) with a $100\times$ faster verification time, similar prover time, and competitive proof size. Our framework natively supports (tensor-)structured relations, such as polynomial evaluation and sumcheck relations.

At a high level, our construction follows the recursive split-and-fold paradigm: the prover first splits the witness into $\rho$ sub-witnesses, sends the corresponding cross-terms, and then folds them into a single witness that is shorter by a factor of $\rho$ using verifier challenges. Prior works typically restrict $\rho = O(1)$ to preserve succinct verification and maintain the optimal $\tilde{O}(\lambda)$ proof size. We overcome this “constant barrier”, which enables larger $\rho$ and thereby reduces the proof size. To achieve this, we introduce the following technical contributions.

(i) Committed folding. Instead of sending $O(\rho)$ cross-terms in the clear, the prover commits to the messages and later proves that the committed vector satisfies the verification relations. This enables the use of a larger shrinking factor, thereby reducing the number of recursion rounds. While this strategy has been successfully used in LaBRADOR (CRYPTO 2023), additional care is required here to preserve succinct verification. (ii) Recursive commitments. We generalise the double-commitment technique from LaBRADOR into a framework for recursive commitments, yielding further compression in commitment size. This results in concrete improvements in communication within each recursion round. (iii) Sumcheck-driven structured recursion. We extend the sumcheck framework from SALSAA (ePrint 2025/2124) to prove substantially more complex constraints arising in our construction (and open for future extensions), including correctness of random projections, inner-product claims and well-formedness of recursive commitments. While expressing these constraints as sumcheck relations requires considerable technical effort, the resulting protocols compose seamlessly with the structured recursion, yielding both linear-time proving and succinct verification.

We construct compilers that convert any secure signature scheme into a single-round blind signature scheme. An important property of the construction is that the final blind signature has exactly the same format as the underlying signature scheme, making the blind signature scheme backwards compatible with the underlying scheme. Our compilers make use of (two-key) fully homomorphic encryption and zero-knowledge proofs to ensure unforgeability and blindness of the final scheme. We present three compilers where the main differences is which party does the bulk of the work: the client, the signer, or both. Along the way we introduce a new notion of verifiable FHE that we call committed verifiable FHE, where the verifier does not see the circuit in the clear.

The BBS+/BBS signature scheme is a key building block for anonymous credentials and privacy-preserving authentication and is currently being standardized and increasingly deployed in practice. To avoid the problem of single-point-of-failure, many threshold BBS+ protocols have been recently proposed for general $t$-out-of-$n$ settings. In practice, however, a $2$-out-of-$2$ policy between a server and a mobile device is sufficient to distribute trust while keeping the system lightweight. Yet, existing threshold designs still require at least three rounds/passes and multi-kilobyte communication in the two-party setting. In this work, we focus on the two-party setting and show that one can achieve reduced interaction while maintaining low computational and communication overhead. Specifically, we present a two-pass two-party BBS+ signing protocol that requires only 0.85KB of communication per signature, about 27% of the currently most bandwidth-efficient work (S&P'25) in the $2$-out-of-$2$ setting. It achieves competitive signing times (roughly 62ms for one party and 46ms for the other) and remains efficient even for large message vectors (e.g., $\ell = 500$), making it attractive for practical deployments. Overall, our protocol is only slower than the fastest OT-based design (S&P'23) but uses nearly two orders of magnitude less bandwidth. We provide a full simulation-based security proof in the standard real-ideal paradigm. As an extension, our protocol can be generalized to a $2$-out-of-$n$ threshold setting naturally.

Multi-signatures are a fundamental cryptographic primitive in distributed systems, enabling a set of parties to jointly produce a compact signature on a common message. Of particular interest are constructions instantiated over pairing-free cyclic groups with a two-round signing protocol, as such schemes offer improved efficiency and deployability in practice. Support for key aggregation is an additional highly desirable property, allowing multiple public keys to be combined into a single succinct aggregate public key against which aggregate signatures can be verified. To improve concrete security guarantees, several works have proposed constructions with tight security reductions. However, existing tightly secure constructions have significant limitations. Notably, T-Spoon by Bacho and Wagner (Crypto 2025) is currently the only pairing-free two-round multi-signature scheme that simultaneously achieves tight security and supports key aggregation. Despite these advantages, T-Spoon incurs substantial efficiency overhead: its signatures comprise nine field elements and two group elements, resulting in prohibitively large signature sizes for many practical applications.

In this work, we introduce Earpick-MS, a tightly secure two-round multi-signature scheme over pairing-free cyclic groups that supports key aggregation while achieving compact signatures. Concretely, signatures in Earpick-MS consist of only three field elements and a single bit, thereby reducing the signature size by a factor of approximately 3.5 compared to the state-of-the-art T-Spoon construction. We further present Earpick-TS, a threshold signature variant of our scheme. Earpick-TS retains the same compact signature size and constitutes the first pairing-free two-round threshold signature scheme with a tight security proof. Prior to our work, achieving tight security in pairing-free threshold signatures required at least three rounds of interaction (Chen, PKC 2025; Bacho and Wagner, CiC 2026). Finally, we propose Earpick-muMS, an additional variant that achieves tight security in the multi-user setting while retaining the same compact signature size.

LayerZero Labs is a research-driven protocol company building the infrastructure for cross-chain interoperability. We are looking for a Cryptographer to join our research team and contribute to the design, analysis, and implementation of cryptographic protocols at the core of our systems.

This is a full-time role based in Vancouver, BC. We provide relocation assistance and visa/immigration support for candidates requiring it.

Responsibilities

• Design and analyze cryptographic protocols with a focus on zero-knowledge proof systems (SNARKs/STARKs), proof aggregation, and recursive composition
• Contribute to applied research translating theoretical constructions into production-grade implementations
• Evaluate cryptographic assumptions and assess security of existing and proposed primitives
• Collaborate with low-level systems engineers on performance-critical implementations in Rust/C++

Qualifications

• PhD (or equivalent research experience) in Cryptography, Mathematics, or Computer Science
• Deep expertise in the design and/or cryptanalysis of zero-knowledge proof systems or lattice-based schemes, including their related primitives
• Strong publication record or demonstrable open-source research contributions
• Comfort working at the intersection of theory and engineering — you can write a security proof, implement a cryptographic primitive, and benchmark code
• Experience with Rust or C++ is a strong plus
• Background in distributed computing or GPU development is a plus

Closing date for applications:

Contact: Kenneth Yun, Talent @ LayerZero Labs

More information: https://layerzero.network/zero

We invite applications for a fully funded PhD studentship focusing on the design and evaluation of post-quantum cryptographic solutions for next-generation communication systems.
The project lies at the intersection of cryptography, network security, and systems, with an emphasis on the integration and performance evaluation of quantum-safe mechanisms in 6G and IoT environments.
Funding covers tuition fees at the UK Home rate and includes a tax-free stipend (£21,805 per year, UKRI rate). International and non-UK applicants are welcome to apply; however, they will be required to cover the difference between Home and International tuition fees.
For more information, you can contact: Dr Vipin Sathi ([email protected]) Dr Essam Ghadafi ([email protected])

Closing date for applications:

Contact: Dr Vipin Sathi or Dr Essam Ghadafi

More information: https://www.ncl.ac.uk/postgraduate/fees-funding/search-funding/?code=comp2175

Research Topics:

• Cryptanalysis of hash functions in both classical and quantum settings.

Applicant Skills / Background:

• A strong background in cryptography, mathematics, computer science, or a related discipline.
• Excellent communication and interpersonal skills, with the ability to work effectively in a collaborative research environment.
• Strong critical thinking and analytical skills, with fluency in technical English.
• Proficiency in programming.

Closing date for applications:

Contact: Hailun Yan

We are seeking an exceptional Postdoctoral Researcher to lead high-impact research in the foundations and applications of lattice-based cryptography. This position is designed for an independent researcher across all aspects of post-quantum cryptography, and you will join a premier research environment. The role will focus on all aspects of lattice-based cryptography, including (classical and quantum) cryptanalysis of post-quantum cryptosystems. The ideal candidate will have a PhD in Computer Science, Mathematics, or a related field, along with a stellar publication record that includes publications in CRYPTO, EUROCRYPT, ASIACRYPT, STOC, or FOCS. They should demonstrate, a proven ability to conduct independent research, and clear ambition evidenced by the ability to solve fundamental problems in computational complexity and cryptography. We offer an internationally competitive salary commensurate with the candidate’s elite standing, as well as a generous travel allowance with full funding for attendance at major international conferences and collaborative visits to top global research groups. The position also provides significant research autonomy, with the freedom to define your research agenda. Interested candidates should submit a CV, a brief research statement highlighting their most significant contributions and their research plan for the next three years, and contact information for three references.

Closing date for applications:

Contact: Divesh Aggarwal ([email protected])

The Cryptography Research Group at the Institute of Computer Science at the University of Tartu invites applications for a Ph.D. position in applied post-quantum cryptography, with a focus on the efficient and secure implementation of lattice-based cryptographic schemes. The selected candidate will design, implement, and analyze practical lattice-based cryptographic primitives that remain secure against quantum-capable adversaries. The research will emphasize high-performance implementations, scalability for real-world systems, and strong protection against implementation-level threats such as side-channel attacks.

Candidates with experience in lattice-based cryptography or related areas of computer science and mathematics are especially encouraged to apply. Applicants should hold (or expect to obtain by spring) an MSc degree or equivalent with a research thesis and have a solid background in mathematics or theoretical computer science, including prior exposure to cryptography. Programming experience particularly in Python/SageMath/Magma and/or C/C++ and/or Java and/or Verilog HDL is highly desirable.

The PhD position begins on September 1, 2026, and has a duration of four years. PhD student receives a net monthly stipend of about €1900, while the cost of living in Tartu remains relatively affordable. For more details, https://crypto.cs.ut.ee/Main/PQCPosition2026

Interested candidates should send their applications (including CV, B.Sc./M.Sc. thesis, academic transcripts and motivation letter with a brief statement of research interests) to Sedat Akleylek ([email protected]).

The application deadline is April 16, 2026.

Closing date for applications:

Contact: Sedat Akleylek, ([email protected])

More information: https://crypto.cs.ut.ee/Main/PQCPosition2026

The Swedish NCSA, which is a part of the Swedish Armed Forces, is hiring cryptographers to work on COMSEC systems that protect Swedish, EU and Nato classified information. The job description includes but is not limited to - developing and evaluating cryptographic algorithms and protocols, - writing requirement specifications for and evaluating COMSEC systems, - developing policies, standards and methods in cryptography, and - continuously monitoring the state of the art in cryptography. The job requires a Swedish citizenship and security clearance. For further details, see the job description in the job offer (in Swedish).

Closing date for applications:

Contact: Contact Martin Ekerå ([email protected]), Madeleine Leander ([email protected]) or the HR department ([email protected]) with any questions.

More information: https://www.forsvarsmakten.se/varnplikt-och-karriar/jobba-i-forsvarsmakten/lediga-jobb/47930/kryptolog-till-avdelningen-for-krypto-och-it-/

In view of its ongoing development, the CRYPTO group of the University of Versailles St-Quentin-en-Yvelines (France) invites applications for the following full-time position.

A tenured Assistant Professor position (“Maître de conférences”) is open to highly qualified candidates who are committed to a career in research and teaching. Preference will be given to candidates with very strong research achievements in one or several of the areas related to the general fields of cryptology and information security.

Responsibilities include research, supervision of undergraduates and graduate students, preparation and management of research projects, and teaching in various study programs.

How to apply: Applications must be sent exclusively via the ODYSSEE portal (https://odyssee.enseignementsup-recherche.gouv.fr/). The list of mandatory documents to be provided is defined by the decree of 6 February 2023 (https://www.legifrance.gouv.fr/loda/id/JORFTEXT000047183295/).

Deadline for submitting applications: Friday, April 3, 2026, 4 PM, Paris time (France).

For selected candidates, in person auditions will take place on Monday, May 18, 2026 (in Versailles).

IMPORTANT NOTE: A “Qualification aux fonctions de Maître de conférences” certificate from the french “Conseil National des Universités” is usually required to apply. However candidates who already hold a an Assistant Professor (or equivalent) position may in some cases be exempted from this certificate.

Closing date for applications:

Contact: Louis Goubin, Full Professor, head of the "Cryptology and Information Security" group

e-mail: louis.goubin (at) uvsq.fr

More information: https://odyssee.enseignementsup-recherche.gouv.fr/procedures/recrutement-ec/offres-poste/fiche-offre-poste/261715