International Association
for Cryptologic Research

The Double Ratchet (DR) protocol is a core security component of several end-to-end encrypted communications services, primarily Signal Messenger, WhatsApp, and Facebook Messenger, servicing billions of users. In this work, we provide the first formal analysis of the DR covering all of its features, including out-of-order message arrivals. This analysis is highly automated, allows for all possible key compromises and notably proves Post-Compromise Security (PCS). We also provide partial results for the security of more complex protocol variants, these being the extension of the DR with encrypted headers, and composition with PQXDH as the initial key-exchange. Our analysis uncovered three attacks on the protocol, two of which we confirmed to be present in the main implementation, and a third which exists in the specification. Each of these attacks weakened or broke Forward Secrecy, and are to the best of our knowledge the first such known attacks. In each case, the issues were reported to the Signal developers and subsequently fixed. Overall, our analysis provides new guarantees of the security of Signal Messenger, and demonstrates the high level of security provided by the DR under a variety of strong threat models.

In this paper, we propose a new widely applicable technique for constructing low-depth S-box circuits, which we call SLICE (Segmented Low‑depth Iterative Circuit Exploration). SLICE reduces circuit depth by partitioning circuits into subcircuits and applying bit-level optimizations. To mitigate the optimization cost of subcircuits with large bit-widths or high AND depth, SLICE temporarily reduces their bit-width during the search, making low-depth circuit construction feasible for various S-box sizes. Furthermore, we refine the eBPD algorithm with the aim of minimizing XOR gate count in terms of area, and apply it to the constructed circuits to achieve an additional reduction.

Our proposed method is simple yet powerful, especially in practical applications. This work focuses on three practically deployed cases, namely the AES, Ascon S-box circuits and Dillon’s 6-bit APN S-box used in FIDES, and additionally considers the cube $x^3$ S-box. For the AES S-box, we present 14-, 13- and 12-depth circuits, whereas the previous lowest depth was 14. Notably, the 12-depth design sets a new overall depth record for AES S-box circuits, while the 13-depth design records the most hardware-efficient circuit in terms of the area$\times$delay metric (ADP). For the Ascon S-box, we present the first 4-depth circuit. For Dillon's S-box and the cube $x^3$ S-box, we also derive new low-depth circuits that improve upon the best previously known depths. All of our proposed S-box circuits achieve better ADPs than previous designs. We believe that SLICE will be useful for evaluating both existing and novel S-box designs.

Secure multi-party computation (MPC) enables mutually distrustful parties to jointly evaluate a function on their private inputs. Classic MPC protocols, however, assume a static set of participants in which every party must remain online throughout the entire computation. Recent advances have introduced MPC models with dynamic participation, such as Fluid MPC, in which computation steps are delegated to a sequence of committees that change across epochs. This approach improves robustness, enabling parties to go offline once their roles are complete. Yet, this flexibility comes at a cost: the most efficient dynamic-participation MPC protocols still incur communication overheads exceeding traditional MPC by more than an order of magnitude.

In this work, we formalize the communication complexity of $(d,n)$-threshold secret-sharing-based Fluid MPC. We prove a tight trade-off between communication cost and the adversary's corruption threshold, showing that linear communication complexity $O(n)$ is impossible when the corruption threshold $t$ exceeds a proportion of $d$. Matching this bound, we construct a protocol with a communication cost of $9.3n$ elements per multiplication gate against a semi-honest adversary and $37.3n$ elements against a malicious adversary. A C++ implementation confirms that our approach brings the cost of fluidity within practical limits.

TFHE is one of the most promising scheme in the literature for an adoption of Fully Homomorphic Encryption (FHE) in practice. The core reason of its good performances is the powerful Programmable Bootstrapping (PBS) operation, that enables to homomorphically evaluate a Look-Up Table (LUT) on a ciphertext while simultaneously reducing its noise. However, the computational cost of running a PBS degrades severely when the size of the plaintext space increases, making it intractable for precision larger than 8 bits. So, evaluating a LUT larger than 2^8 is not considered possible with the "vanilla'' TFHE scheme. In this paper, we propose a technique to accelerate LUT evaluation at high precision, that significantly enhances the state of the art. Our method beats the original PBS for spaces larger than 6 bits, and is competitive with the WoP-PBS (the reference of the state of art) while being conceptually simpler. Moreover, our method relies on the standard PBS of TFHE, and therefore does not require the design of new advanced homomorphic operators, which facilitates its integration into larger homomorphic compilation systems.

In a (non-interactive) multi-signature scheme, parties independently generate keys and produce signatures on a common message, which can be aggregated into a single signature verifiable with respect to the set of public keys. Existing multi-signature constructions, however, suffer from at least one of two limitations: either (1) aggregate signatures cannot be further aggregated, or (2) verification requires auxiliary information beyond the set of public keys, such as the aggregation topology.

We argue that these limitations significantly restrict the applicability of multi-signatures in large-scale distributed systems, such as proof-of-stake blockchains. To address this gap, we initiate the formal study of hint-free multi-signatures, which support multi-hop aggregation while allowing verification using only the set of public keys.

To the best of our knowledge, the only previously known (folklore) construction that is fully hint-free relies on recursive SNARKs, which introduces unclear heuristics for security (e.g., proving statements about random oracle relations) or inherently limits the depth of the aggregation topology.

We show that hint-free multi-signatures can be realized without proof recursion, in the standard model. At a high level, we show how to publicly normalize BLS multi-signatures so that verification depends only on the set of public keys rather than a multi-set. While our scheme is not practical (it uses indistinguishability obfuscation), it establishes the feasibility of the primitive provides a foundation for future work on practical constructions.

We explore the design of blind schemes based on the Lattice Isomorphism Problem (LIP), a recently proposed group-action-based assumption for post-quantum cryptography. Our work highlights both the potential and the limitations of LIP-based constructions. In particular, we analyze the Abe–Okamoto framework and demonstrate that it does not yield a secure instantiation under LIP. We further present an attack on the double LIP problem, allowing from two generic distinct instances of a LIP problem to recover the secret unimodular matrix. Finally, we propose a new blind signature scheme that combines LIP with the Closest Vector Problem (CVP) and a modular version of the Short Integer Solution (SIS) problem, offering a fresh direction for lattice-based blind constructions.

Folding schemes enable incremental proving by compressing many relation instances into a small accumulator. Recent lattice-based constructions such as LatticeFold+ [CRYPTO '25] achieve post-quantum security, but prover performance is still dominated by expensive $\ell_\infty$ range checks used to control witness growth during folding and extraction. We present a final $\ell_2$-norm-check design that combines random-projection constraints (in the spirit of Rok and Roll [ASIACRYPT '25]) with an exact shortening step (in the spirit of SALSAA [ePrint 2025/2124]) to recover the original witness $\ell_2$-norm bound at extraction time. Integrated into the LatticeFold+ composition, this gives iterative folding with controlled norm growth, preserved binding and knowledge-soundness goals, and substantially lower prover cost on the dominant norm-check path, while maintaining a similar proof size and verification cost. Our approach is modular and can be applied to other lattice-based folding schemes, providing a practical path for efficient post-quantum folding constructions.

In a paper presented at CRYPTO18, Reparaz et al. introduce a new model called the ``Tile-Probe-and-Fault-Model''. This model proposes to cover more realistic side-channel attacks by considering so-called ``combined'' attacks, in other words attacks using both side-channel leakage and fault injection. In addition, they introduce CAPA, a combined ``Countermeasure Against Physical Attacks'', which is inspired by an MPC protocol called SPDZ. In this paper, by attacking the original Beaver triples generation described in CAPA, we demonstrate that the CAPA countermeasure is not secure in its model, by breaking the countermeasures with a simple resolution of a linear system.

Graph neural network parameters are valuable intellectual property, and high-fidelity extraction enables model stealing, evasion, and downstream abuse. Prior cryptanalytic extraction can recover exact parameters in hard-label settings, yet existing methods focus on feedforward models and do not extend to message-passing graph neural networks. The obstacles include coupled queried nodes, hidden aggregation operators, and sign and scale ambiguities created by message passing. To our knowledge, this is the first cryptanalytic extraction framework for message-passing ReLU graph neural networks in hard-label settings where the oracle returns only the predicted class. We locate dual-point constraints on class-pair decision boundaries and activation hyperplanes, then recover hidden signatures with SVD-based extraction under a fixed ordered two-node query interface. We use ON/OFF distance comparisons to resolve hidden signs, then prove that diagonal scale factors propagate through the recovered prefix and cancel at the output layer. This four-stage recovery chain avoids explicit scale fitting while using only hard-label local queries. On ogbn-arxiv targets with up to 10,660 parameters, the attack achieves 100% prediction fidelity on 8,171 evaluated nodes with 48.68M node queries.

Existing Capture-the-Flag (CTF) platforms trust a single organizer, offer limited auditability, and are vulnerable to infrastructure-level manipulation. We propose zk–MPSFV, a zk-SNARK-based, multi-phase sub-flag verification scheme that replaces centralized scoring with an on-chain, zero-knowledge, publicly verifiable scoreboard. Challenges are decomposed into sub-challenges arranged as a directed acyclic graph (DAG): a team unlocks the next step only after proving completion of all parent nodes. Sub-flags and decryption keys are jointly generated by n organizers and released via an off-chain (t, n) Shamir–BLS threshold signature produced through multi-party computation (MPC), preventing any single organizer from leaking oraltering keys. Teams submit zk-PLONK proofs that the contract verifies, timestamps, and records immutably. Under standard assumptions (collision-resistant hashing, SNARK soundness/zero-knowledge, IND-CCA2 ECIES, and at least t honest organizers), we prove that zk–MPSFV achieves the stated security goals, including DAG-gated progress, anti-replay, and threshold-robust organizer security, while out-of-band flag sharing remains out of scope. On a three-organizer testbed with 30 simulated teams, setup costs 0.45 ms per sub-flag, proof generation averages 5.34 s on an 8 core system, and on-chain verification costs ≈ 170k L2 gas on zkSync Era with a median fee of 1.33 × 10−6 ETH (about $0.0046 at $3,435 ETH). Stress replays sustain ≈ 7 proof transactions/s up to 5000 proofs; extrapolating to 50,000 proofs (1000 teams × 50 submissions) yields ≈ 0.0665 ETH (about $200–$228) and ≈ 2 hours of settlement time. Overall, zk–MPSFV is practical for small- to mid-scale, audit-ready progression CTFs.

Registration-Based Encryption (RBE) is a public-key encryption mechanism which allows a user to register their identity (e.g. email address) and self-generated public key with a key curator (e.g. an organisation). The key curator aggregates these keys into a compact digest. Using only this digest and the recipient’s identity, anyone can encrypt messages to any registered user. As the key curator is not entrusted with any secrets, RBE presents a solution to the key escrow problem, which impedes the adoption of Identity-Based Encryption. This makes RBE an attractive solution for secure communication with and among members of an organisation while preserving user privacy. Despite recent advances [Döttling-Kolonelos-Lai-Lin-Malavolta-Rahimi, EUROCRYPT’23; Fiore-Kolonelos-de-Perthuis, ASIACRYPT’23], practical constructions of RBE are still limited to a small number of registered users (e.g. 1024), lack post-quantum security, or have ciphertext sizes scaling in the order of GB.

The predominant way towards constructing practical RBE is a generic transformation from Laconic Encryption (LE). In this work, we identify an efficiency bottleneck in this transformation and present a new primitive called Batched Laconic Encryption (BLE) which admits a more succinct transformation to RBE. Our resulting RBE scheme is the first post-quantum construction that simultaneously supports a large number of registered users and asymptotically outperforms all comparable RBE schemes. Concretely, for at most $2^{30}$ registered users at 128-bit security, our scheme achieves a ciphertext size of 7 MB, improving on previously reported results by three orders of magnitude. We confirm our results through an open-source prototype implementation demonstrating that all algorithms execute within a few milliseconds. The post-quantum security of our construction is based on the standard Learning with Errors assumption, and our analysis enables several tweaks to significantly reduce ciphertext sizes in practical deployments.

Careful management of shares stored in the architectural, general-purpose register file is an important aspect of software-based implementations of masking, because it can impact the associated side-channel leakage. The erasure of residual shares, i.e., shares whose useful lifetime has expired, is one component of such management: erasing them can, for example, prevent subsequent, unintended share recombination. To support effective share erasure, this work makes two contributions. First, we present an analysis of the underlying problem, systematising associated concepts and terminology, and offering a concrete, motivating example. Second, we present the design, implementation, and evaluation of two components which can support solutions of said problem. These are 1) a policy, namely an extended ABI which provides clear semantics regarding the responsibility of caller and/or callee functions to erase shares, and 2) a mechanism for realising said policy, namely an extended ISA (or ISE) which allows more efficient erasure of shares than via the ISA alone. Although generic in nature, we present both components using the RISC-V base ISA; an associated prototype ISE implementation uses Ibex as a base core. Our evaluation results confirm that combined use of the components can eliminate leakage related to residual shares both effectively and efficiently.

Professor Michael O. Rabin passed at the age of 94.

Professor Rabin was a towering figure in mathematics and one of the founding pioneers of modern cryptography. His work introduced and shaped many of the field’s most fundamental ideas, from primality testing and digital signatures to encryption, oblivious transfer, and cut-and-choose techniques, among many others. Beyond cryptography, his contributions to mathematics and computer science were profound and far-reaching. In particular, he was instrumental in developing foundational concepts such as nondeterminism, polynomial-time computation, and randomized algorithms.

Professor Rabin held distinguished appointments at the Hebrew University of Jerusalem and Harvard University where he was an admired teacher and educator. He was the recipient of numerous honors, including the Turing Award.

End-to-end encrypted applications protect user data by ensuring that user secrets are only available on client devices. However, if a user loses all of their devices, they need a way to recover their data using only a short password. To realize a password-based secret recovery system resilient to brute-force attacks, prior works relied on secure hardware or a few non-colluding servers.

In this work, we take a conceptually different approach that distributes trust across the many clients already in the system, while using the server only as an orchestrator without relying on it for privacy. To achieve this, we design and implement Chorus, a secret recovery system that employs ephemeral committees, each consisting of approximately a thousand clients, to provide strong privacy with high scalability. Committees change frequently in Chorus, typically on the order of a few minutes, to severely limit an attacker's ability to compromise clients on a committee. We design Chorus for unreliable, resource-constrained clients and show that the per-client overhead decreases as more clients join the system.

Assuming each user performs recovery once a year, the expected per-client overhead in Chorus is under $30$ s of computation on a mobile device and $13.2$ MB of communication, both incurred only once every four months in a configuration with $100$M clients, up to $50$M of which may be offline and at most $10$M may be compromised. To achieve this performance, we contribute two key techniques: (i) a password-based secret recovery scheme that confines expensive committee interactions to infrequent, latency-tolerant operations, and (ii) a non-interactive verifiable secret-sharing scheme that reduces client overhead by two orders of magnitude by delegating computation to the server.

Polynomial commitment schemes (PCSs) are a fundamental cryptographic primitive that allows a prover to reveal evaluations for a committed polynomial. Motivated by the inefficiency of proof generation for large-scale computations as well as the concerns regarding third-party reliance and quantum threats, a line of recent works has focused on distributing code-based PCS, where the proving workload is distributed among multiple sub-provers to accelerate proof generation, while preserving transparent setup and plausible quantum resilience. However, for $M$ sub-provers generating an evaluation proof for a polynomial of size $N$, existing solutions either require $O(N)$ total communication among sub-provers, or incur an $O(M)$ overhead in proof size. In this paper, we introduce $\mathsf{Veloz}$, a novel distribution framework for code-based multilinear PCS, which for the first time achieves communication cost sublinear in $N$, and eliminates the dependence of proof size on the number of sub-provers, without compromising proving speed or security. At its core is a customized proof aggregation method from interleaved code that efficiently combines sub-proofs via minimum communication. We further present two instantiations of $\mathsf{Veloz}$: one based on Reed-Solomon code, $\mathsf{Veloz}_{\text{RS}}$, achieves $O(\frac{N}{M}\log{\frac{N}{\log{N}}})$ proving time, $O(\lambda \cdot \frac{\log^{2}{N}}{\log\log{N}} + M\cdot\frac{N}{\log{N}})$ communication, and $O(\lambda \cdot \frac{\log^{2}{N}}{\log\log{N}})$ proof size; the other based on the fast linear code from Brakedown (Golovnev et al., CRYPTO 2023), $\mathsf{Veloz}_{\text{Lin}}$, features $O(\frac{N}{M})$ proving time, $O(\lambda \cdot K + M\cdot\frac{N}{K})$ communication, and $O(\lambda \cdot K)$ proof size for $K \in [\sqrt[3]{N}, \sqrt{N}]$, while enjoying field agnosticity. We also implement both schemes in Rust and conduct a comprehensive performance evaluation. The experimental results demonstrate their linear scalability with increasing $M$. More specifically, for $N = 2^{30}$ and $M = 8$, $\mathsf{Veloz}_{\text{RS}}$ takes 74.8s for proof generation, achieving a 5.18 $\times$ speedup compared to running a single prover, while $\mathsf{Veloz}_{\text{Lin}}$ generates a proof in 26.9s and achieves a 7.02 $\times$ speedup.

Designing cryptographic hash functions that simultaneously achieve high throughput and strong provable security remains a fundamental challenge in symmetric cryptography. Traditional constructions, such as the Merkle-Damg\aa rd (MD) and SPONGE paradigms, inherently suffer from structural limitations: they either expose internal chaining values to length-extension attacks or impose a rigid trade-off between security (capacity) and efficiency (rate), bounding their architectural potential.

In this paper, we introduce the \textbf{Compress-then-Randomize} paradigm, a modular design principle that structurally decouples a hash function into two independent components with distinct security objectives: (1) a \emph{variable-input-length} (VIL) compression component optimized for high-speed message absorption, requiring only collision resistance and multiple-preimage resistance; and (2) a \emph{fixed-input-length} (FIL) finalization component utilizing independent random permutations to ensure indifferentiability from a random oracle. This separation enables the VIL component to maximize processing throughput (approaching the full primitive width) while the FIL component provides robust randomness extraction, effectively mitigating length-extension attacks and achieving tight security bounds.

Leveraging this paradigm, we propose the \textbf{Rocket hash family}, comprising two instantiations: \emph{Rocket-JH} (based on the JH iteration structure with wide-pipe design) and \emph{Rocket-DoubleCBC} (utilizing dual parallel Cipher-Block-Chaining lanes). Both constructions employ pairwise distinct round permutations and achieve superior message processing rates compared to conventional SPONGE-based designs, with Rocket-2 delivering more than $2\times$ the throughput of SHA3-512 for large messages.

For practical instantiation without requiring multiple independent cryptographic primitives, we present \textbf{CTR-Perm}, a novel domain-separation technique that derives $2^w$ effectively independent round functions from a single large permutation using a counter-based input diversification. While backward queries introduce a heuristic assumption regarding preimage multiplicity (bounded by a negligible failure probability $\leq 2^{-526}$ for counter size $w \geq 64$ and hash length 512 bits), we prove the construction remains sound for practical message lengths up to $2^{w-8}$ blocks.

Finally, to formalize the security-efficiency trade-off, we propose \textbf{Hash Effectiveness} (H.E.), a scale-invariant heuristic metric defined as the product of normalized security level and normalized processing rate. We demonstrate that conventional Merkle-Damg\aa rd and SPONGE constructions exhibit H.E. values fundamentally bounded by $1/8$, whereas the Rocket constructions achieve H.E. values approaching $1/4$ (specifically, $0.227$ for Rocket-2 with Keccak-$p$[1600]), thereby establishing a new Pareto frontier in hash function design.

We give a public key encryption scheme with plausible quasi-exponential security based on the conjectured intractability of two constraint satisfaction problems (CSPs), both of which are instantiated with a corruption rate of $1 - o(1)$. First, we conjecture the hardness of a new large alphabet random predicate CSP (LARP-CSP) defined over an arbitrary but strongly expanding factor graph, where the vast majority of predicate outputs are replaced with random outputs. Second, we conjecture the hardness of the standard $k$XOR problem defined over a random factor graph, again where the vast majority of parity computations are replaced with random bits. In support of our hardness conjecture for LARP-CSPs, we give a variety of lower bounds, ruling out many natural attacks including all known attacks that exploit non-random factor graphs.

Our public key encryption scheme is the first to leverage high corruption CSPs while simultaneously achieving a plausible security level far above quasi-polynomial. At the heart of our work is a new method for planting cryptographic trapdoors based on the label extended factor graph for a CSP. Along the way to achieving our result, we give the first uniform construction of an error-correcting code that has an expanding, low density generator matrix while simultaneously allowing for efficient decoding from a $1 - o(1)$ fraction of corruptions.

Event date: 10 August to 14 August 2026
Submission deadline: 15 June 2026

Event date: 1 March to 4 March 2027
Submission deadline: 3 August 2026
Notification: 19 November 2026

PhD Position: Trustworthy AI in Collaborative Machine Learning

The Laboratory of Cryptography and System Security (CrySyS Lab) at the Budapest University of Technology and Economics (BME) invites applications for a fully funded, 48-month PhD position. This role is part of the NKKP STARTING project focusing on the holistic science of Trustworthy AI.

Research Context: Collaborative Machine Learning (Federated Learning) is essential for a democratic AI ecosystem but faces risks like data poisoning, information leakage, and bias. This research moves beyond treating trust pillars — Security, Privacy, Fairness, and Explainability — in isolation. You will investigate the mathematical trade-offs and higher-order dynamics between these objectives to develop a Pareto-optimal Holistic TAI Framework.

Candidate Requirements:

• An M.Sc. degree in Computer Science, Mathematics, or a related field.
• Strong mathematical foundations and robust Python programming skills.
• Excellent command of English (written and verbal).
• Interest in IT security, privacy-enhancing technologies, and ethical AI.

Funding and Benefits: This position offers a competitive financial package for 4 years:

• PhD Scholarship: Standard Hungarian doctoral stipend benefit.
• NKKP Salary Supplement: An additional monthly salary provided by the NKKP STARTING grant.
• Research Support: Full access to the Komodor HPC, GPU cloud resources, and LLM APIs.

Application Documents: Interested candidates should submit:

1. Detailed Curriculum Vitae (CV).
2. Copies of M.Sc. and B.Sc. Diplomas.
3. Official Academic Transcripts.
4. Motivation Letter.
5. List of Publications.
6. Two Letters of Recommendation.

Closing date for applications:

Contact: Balazs PEJO