International Association
for Cryptologic Research

With growing concerns over data privacy, private nearest neighbors search (PNNS) attracts increasing research attention. Existing PNNS follow two main approaches: i) interactive PNNS based on secure multi-party computation protocols that leverage index structures to achieve sublinear complexity, and ii) non-interactive PNNS utilizing fully homomorphic encryption to minimize communication bandwid that the cost of superlinear computational complexity. To address the communication-computation dilemma, we propose HANNS, a non-interactive PNNS protocol with a sublinear number of encrypted comparisons. Our key observation is that, while the full-table scan is inevitable under the non-interactive setting, the number of costly encrypted comparisons can be significantly reduced. Specifically, we develop a cluster ordering scheme over FHE that leverages a segmented rigid transformation to obliviously identify candidate clusters with only a sublinear number of homomorphic comparisons. Furthermore, we introduce a homomorphic product quantization (PQ) scheme that enables coarse search and reranking over PQ-encoded vectors, which significantly reduces the computational and storage overheads. In the experiment, we show that HANNS achieves 41x to 277x speedup and a storage reduction of 12x to 31.7x compared to the most recent non-interactive schemes, while reducing communication by 1,258x to 80,536x and achieving a speedup of 8x to 119x over interactive schemes in low-bandwidth scenarios.

The objective of this work is to investigate methods for improving the self-tuning mechanism of ring oscillator (RO) based True Random Number Generators (TRNGs). It also examines the challenges involved in achieving a reliable and stable design over long-term operation. Furthermore, this work analyzes potential approaches to address these challenges and validates their effectiveness using the NIST statistical test suite.

Blind side-channel analysis (BSCA) can infer keys without known inputs or outputs, but practical use still needs an upstream step that locates repeated computation and candidate points of interest in an unlabeled trace. We address this trace-only structuring problem with a two-stage method that uses only the per-sample mean and standard deviation, without algorithm labels or metadata. Stage1 estimates a repetition scale, start phase, anchor-supported stable core, and period candidates from rank-combined self-similarity. Stage2 stacks the stable core into a representative repetition and partitions it into relative high- and low-score segments. On 16 block cipher implementations across STM32F303 and XMEGA, the method forms consistent repetition windows in most cases. Post-hoc source and assembly comparison separates exact or edge-inclusive count matches from grouped, microperiod, and ambiguous hierarchy relations, while Top-5 candidates often retain body-related hierarchy. In a representative AES/XMEGA case, the trace-only high-score segments cover the strongest S-box CPA hotspots, indicating that the produced coordinates can prioritize, rather than determine, candidate regions for later CPA or BSCA.

Blockchain-based cryptocurrencies give rise to a plenitude of advanced applications (such as cross-currency transfers or privacy-preserving payments) through blockchain protocols - cryptographic protocols that orchestrate the processing of financial transactions on the blockchain. To enable a modular design and to enhance reusability across different cryptocurrencies, many blockchain protocols are built upon adaptor signatures (AS), a well-studied cryptographic building block, which is natively supported by most digital signature schemes used for authorizing cryptocurrency transactions. An inherent limitation of AS-based blockchain protocols is the known impossibility to realize AS for unique signature schemes, such as BLS signatures. As a consequence, existing AS-based protocols cannot be executed on cryptocurrencies that base transaction authorization on BLS signatures (such as the Chia Network).

For such cryptocurrencies, instead, new custom blockchain protocols need to be created, as recently done for the case of coin mixing (S&P'24) or atomic swaps between two cryptocurrencies with BLS-based transaction authorization (ESORICS'24). To avoid such complex and error-prone redesigns, in this work, we develop a novel notion of AS called Two-Party Asymmetric-Input Solitary-Output Adaptor Signature (2P-AISO-AS) that sidesteps the known impossibility result and that can be realized from both randomized (i.e., plain) and unique signature schemes. We provide efficient instantiations of 2P-AISO-AS from BLS and show that we can obtain performant, BLS-compatible blockchain protocols by replacing AS with 2P-AISO-AS in known AS-based protocols, including zero-knowledge contingent payments, atomic swaps, and coin mixing.

Design of hash functions and pseudo-random permutations over Galois extensions of $\mathbb Z_q$ for prime powers $q$ has recently gained some interest in relation to recent directions in advanced cryptography, such as multiparty computation and zero-knowledge protocol design. Thus investigating optimality of cryptographic properties of S-boxes defined by polynomials over Galois rings is of interest. Of particular interest is the differential uniformity of such functions. To our knowledge, there are very few results on the differential uniformity for polynomials over Galois rings $\mathrm{GR}(p^k,m)$ when $k,m\geq 2$. Motivated by designing secure hash functions and block ciphers over Galois rings, a main contribution of this paper is an investigation into the differential properties of polynomials over Galois rings. Finally, we provide a classification of APN permutations in $\mathrm{GR}(4,2)$ up to affine and CCZ-equivalence.

Boolean functions with additional structure play an important role in symmetric cryptography, both for achieving strong cryptographic properties and for enabling efficient implementations. Recent works on homomorphic-friendly symmetric primitives, especially in the context of Hybrid Homomorphic Encryption, highlighted the interest of Boolean functions whose evaluation can be decomposed according to structured partitions of the Boolean cube. A classical example is given by Hamming-weight decompositions, which underlie symmetric and weightwise degree-d Boolean functions. In this work, we generalize this viewpoint by replacing the Hamming weight with a general integer linear form. Given a vector v in Z^n, we partition the Boolean cube (F_2)^n by grouping the Boolean vectors x in (F_2)^n according to the value of into so-called v-slices, and study functions that have bounded degree on each of them. We study how many such slices are needed to describe a given function, and provide bounds and structural properties for the partitions induced by integer vectors. We also show how this representation leads to a homomorphic evaluation strategy in a GSW-like setting, together with noise estimates for the resulting ciphertexts. Finally, we generalize several symmetric and weightwise degree-d Boolean functions using different vector families, and experimentally evaluate their algebraic degree, algebraic immunity, and nonlinearity. The results show that direct generalizations of symmetric functions often lose cryptographic strength, while generalized weightwise degree-d constructions lead to richer and more promising behavior.

In next-generation networks, communication systems will no longer be limited to data transmission and will be expected to acquire awareness of the surrounding environment. This leads to the concept of integrated sensing and communication (ISAC), where the same wireless infrastructure is used for both communication and environmental sensing. Thus, ISAC enables the system to transmit information efficiently and observe and interpret channel variations and user behavior. Motivated by this capability, this work focuses on detecting an active attacker in an urban environment scenario, where the attacker intentionally manipulates beamforming directions to increase interference and mislead the transmitter into allocating the main lobe of beam toward itself instead of legitimate users. We apply game-theoretic approaches to model the interaction between legitimate users and the attacker, and integrate the resulting utility-based formulation into a reinforcement learning (RL) framework. Simulation results demonstrate that the proposed method effectively addresses security challenges in dynamic 6G ISAC systems.

In zero-knowledge machine learning (zkML), the dominant cost is generating the proof, not running the model, and it concentrates in the nonlinearities a transformer must evaluate inside the proof system. It is tempting to exploit a nonlinearity's mathematical structure (low degree, parity, or kernel form) to prove it more cheaply. We show this hope is misplaced for the dominant cost: in a Shout-style (one-hot) lookup argument the per-lookup proving work is a function of the access pattern alone, never of the table values, so function structure has zero leverage on it. This is a separation principle; structure can cheapen only a secondary, once-per-proof table term. That table term stays subordinate as models get deeper because the only data-dependent amplifier of per-layer error in a pre-LN transformer is the LayerNorm gain 1/σ: a σ-floor on typical inputs lets a single fixed proving precision suffice at every depth, keeping proof cost near-linear in the number of layers. We measure this depth-to-cost scaling on two independent proving systems (EZKL/halo2 and Jolt Atlas), and turn the one dial the separation leaves open, the committed address width, into a bit-exact, upstreamed reduction in prover time.

Decision trees are widely used in machine learning due to their simplicity, efficiency, and interpretability. Numerous private decision tree evaluation (PDTE) protocols based on secure multi-party computation (MPC) have been proposed to protect sensitive data during evaluation. However, existing MPC-based PDTE protocols primarily focus on the two or three-party setting. Moreover, their core building block, secure threshold comparison, typically incurs logarithmic-round communication and dominates the online cost of tree evaluation. These limitations motivate the design of scalable and efficient secure comparison protocols for large-scale PDTE. In this paper, we propose a scalable constant round secure comparison protocol with Shamir secret sharing in the honest-majority setting. Concretely, inspired by Falcon, we leverage random shuffling to achieve zero detection with constant-round communication. Furthermore, we reduce random shuffle to random shift, thereby significantly decreasing the offline communication overhead. Besides, we reformulate feature selection and path evaluation in PDTE as PLUT functionalities and integrate them with our scalable comparison protocol to achieve scalable PDTE. Finally, we extend the above Shamir secret sharing-based protocols to the packed secret sharing variants and further improve their online communication efficiency. We instantiate these protocols as a framework SC-DT and report their improved performance: i) For secure comparison, we achieve a speedup of $1.7-2.3\times$ and reduce communication by $1.7-2.5\times$ in the online phase compared with Helix (Cryptology ePrint’2025). ii) For PDTE, our protocol achieves up to a $9\times$ speedup and reduces online communication by $1.5\times$ in the online phase compared with Mostree (ACSAC’2023). iii) For large-scale decision tree evaluation tasks, SC-DT evaluates a random forest consisting of 100 trees and 85100 nodes in a 21-party WAN setting, achieving an amortized latency of approximately 300 ms per tree.

Zero-knowledge proof systems are increasingly relying on the Sumcheck protocol to avoid the FFT-heavy structure of earlier SNARK designs. Sumcheck is well suited for GPU acceleration; it consists of sequential rounds where each round performs regular, parallelizable operations over large multilinear evaluation tables. The focus is on how to organize this work across rounds: intuitively, the active polynomial state should remain close to the device that processes it, the CPU-GPU boundary should only expose values that are needed to transition, and various cryptographic settings should be kept stable.

This paper presents Chimera, a GPU-CPU framework for accelerating Sumcheck in Spartan-style SNARK provers. Chimera uses a hybrid execution model: large polynomial evaluation and folding work runs on the GPU, active polynomial state remains resident on GPU across profitable rounds, compact round messages return to Spartan's host transcript, and small domains fall back to CPU execution. Chimera also specializes the wrappers around Spartan's small round-polynomial commitments and proof objects, and introduces a memory-aware chunking path.

On BN254 Spartan R1CS instances, Chimera demonstrates a \(7.96\times\) improvement of the committed-Sumcheck region at \(N=2^{17}\), relative to clean Spartan. Across full Spartan proving runs from \(2^{12}\) to \(2^{27}\) constraints, Chimera improves end-to-end prover time for all measured sizes, reaching \(1.27\times\)-\(1.64\times\) speedup for sizes \(2^{24}\)-\(2^{27}\). Ablation studies show that Chimera's gains come from choosing the right execution boundary rather than from any single optimization. The GPU handles the large, regular Sumcheck work, while Spartan keeps the protocol state needed for transcript and verifier compatibility. This reduces movement of polynomial data without disrupting the proof system. The remaining gap between Sumcheck-region and end-to-end speedup shows that, after Sumcheck is accelerated, polynomial commitment and proof-wrapper costs become the next bottleneck.

Modern hardware security heavily relies on the assumption that pre-synthesis algorithmic protections will survive the physical fabrication pipeline. However, untrusted third-party Electronic Design Automation (EDA) toolchains often apply aggressive structural optimizations that can silently compromise perfectly symmetric designs, introducing critical data-dependent power side-channel vulnerabilities. Existing pre-silicon verification methodologies require exposing highly sensitive, proprietary gate-level intellectual property (IP) to external auditors to verify structural security. In this paper, we introduce a novel Zero-Knowledge Hardware Auditor, an end-to-end framework that provides mathematical guarantees of physical data-obliviousness without revealing the underlying circuit netlist. By translating synthesized gate-level topologies into a custom Side-Channel Intermediate Language (SCIL), our architecture maps physical dynamic switching activity into arithmetic constraints executable within a Halo2 zero-knowledge virtual machine (zkVM). This enables the first implementation of a zero-knowledge Bounded Toggle Assessment (ZK-BTA), a deterministic structural counterpart to classical Test Vector Leakage Assessment. Experimental evaluations across standard cryptographic primitives and ISCAS-85 benchmarks demonstrate that the framework successfully identifies inherently leaky logic and captures EDA-induced asymmetries, such as a 13% leakage rate introduced into a theoretically secure Montgomery Ladder, while proving the structural integrity of Dual-Rail oblivious logical topologies. Furthermore, the asymmetric zk-SNARK architecture ensures scalable component-level auditing, yielding a succinct cryptographic proof of physical security that can be publicly verified in under 0.08 seconds.

I am looking to hire exceptional postdoctoral researchers to join my research group (currently a singleton, but part of CISPA's larger research area on Algorithmic Foundations and Cryptography, "https://cispa.de/en/research/research-areas/algorithmic-foundations-and-cryptography").

Research topic should align with my research ("https://pierremeyercs.github.io/") (e.g. Theory of Cryptography and Secure Multiparty Computation).

General information about being a PostDoc at CISPA is available here: "https://career.cispa.de/jobs/postdoc-8".

Closing date for applications:

Contact: Pierre Meyer

Event date: 8 November 2026
Submission deadline: 1 August 2026
Notification: 1 September 2026

We present key-recovery attacks on the constructions of TALUS (Kao and Chang), a threshold ML-DSA (FIPS 204) construction available on arXiv and scheduled for presentation at the NIST Threshold Call Preview Talks Round 2 (TCPT-2, https://csrc.nist.gov/events/2026/tcpt).

For TALUS-MPC, which is claimed EUF-CMA secure against an adversary corrupting up to $T − 1$ parties, we show the claim is false via two independent attacks, both exploiting the same root cause. TALUS-MPC uses Feldman commitments that apply the public matrix A to secret values: key shares of $s_1$ during key generation, and contributions to the nonce $y$ during signing. Since A is left-invertible in every ML-DSA parameter set, these images are invertible by Gaussian elimination, with no lattice problem to solve. A passive observer recovers all key shares of $s_1$ directly from the key-generation broadcast, and independently recovers the aggregate nonce y from the signing broadcast, which then yields $s_1 = c^{−1} \cdot (z − y)$ from a single signature.

For TALUS-TEE and TALUS-MPC, we identify a persisting flaw: the rejection-sampling check that protects the error term $s_2$ in standard ML-DSA has been removed. Each signature leaks a noisy linear equation in $s_2$; applying least-squares recovery over the cyclotomic ring - an instance of LWE without modular reduction - recovers the full secret from a few hundred million signatures. The sample counts we derive are not optimized and we believe exploiting the bounded noise structure and lattice-reduction techniques would reduce them significantly, but we focus on establishing the structural flaw.

In this work we propose a novel Boolean lookup-table evaluation methodology over binary CKKS when circuit XORs are kept lazy, i.e., evaluated as additions whose least significant bits remain correct. Our method represents a LUT in the Walsh basis, forms the required parity sums by lazy CKKS additions, and packs them into ciphertext slots. We then use CKKS binary bootstrapping as a refresh step: the StC stage maps the packed lazy parities to MSB-encoded bits, removing the overflow; CtS places the parity values in slots; and $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ cleans the binary noise, leaving clean parities in the slot domain. The LUT is then evaluated by recombining these parities with plaintext Walsh coefficients. This decouples the LUT size from the multiplicative depth of the surrounding circuit: large LUTs can be handled by cleaning selected factored parity signs and spending only a small constant depth in recombination. We apply this framework to AES-CTR transciphering. The AES S-box is evaluated with a nibble-split Walsh decomposition, which supports more AES blocks at the cost of one additional multiplication depth. The AES state remains in full complex CKKS packing so real and imaginary lanes carry independent AES blocks. In CPU experiments, the Walsh S-box AES-CTR algorithm is 3.25x faster than the sparse-bootstrapping XBOOT variant at the same 1024-block batch size.

We study the limits of single-server private information retrieval (PIR) with preprocessing. Prior work has shown that single-server PIR with sublinear communication requires a linear number of (public-key) server operations per query [DMO00, DH24]. Recent breakthrough works, including [CHK22, ZPZS24, LMW23], circumvent these lower bounds by critically leveraging preprocessing to construct single-server PIR with sublinear query computation.

Our work presents computation lower bounds for any single-server PIR with preprocessing that makes blackbox usage of any cryptography (such as random oracles and virtual blackbox obfuscation). For any client preprocessing scheme where the client stores $s$ bits about an $n$-bit database, we prove the online amortized computation must be $\Omega(n/s)$ across $k = \Omega(s)$ queries (even if performed in a single batch query). In more detail, we prove that they must have either $\Omega(n/s)$ amortized online communication or the server must perform $\Omega(n/s)$ cryptographic operations. Our lower bounds are optimal as there exist PIRs with client preprocessing matching exactly one of the above requirements while outperforming the other. Furthermore, our lower bounds also rule out the existence of doubly efficient PIR from blackbox cryptography with sublinear query computation (current constructions use ring LWE). We note our lower bounds are widely applicable to any single-server PIR scheme that makes blackbox usage of cryptography including those with weaker privacy guarantees. In contrast, prior works only proved computation lower bounds for restricted classes of single-server PIR constructions (e.g., non-encoding servers or single-roundtrip queries).

Our proof framework also supports $\Omega(n/s)$ communication lower bounds for the following three classes of single-server PIR: schemes where the server performs $o(n/s)$ cryptographic operations, schemes where the server's cryptographic operations depend only on query communication and schemes with perfect privacy in the idealized model. Our results hold unconditionally whereas prior communication lower bounds required additional complexity assumptions.

We also prove lower bounds for symmetric private information retrieval (SPIR) with client preprocessing in the random oracle model and present a matching SPIR construction with client preprocessing using only OWFs during queries.

In this paper, we investigate the nonexistence of $N$-ary sequences with ideal arithmetic correlation. We prove that there exist no ternary, quaternary, or $6$-ary sequences with ideal arithmetic autocorrelation when the connection integer is an odd prime power $p^{t}$ and $\textup{ord}_{p^{t}}(N)=\phi(p^{t})/4$, where $\phi$ denotes Euler's totient function. Furthermore, when the connection integer is an odd prime $p$ and $\textup{ord}_{p}(N)=\phi(p)/6$, no such ternary, quaternary, or $6$-ary sequences exist for ideal arithmetic correlation. This includes in particular the case $p\equiv7(\textup{mod}12)$, for which $\textup{ord}_{p}(N)=\phi(p)/6$ and we further show that no $N$-ary sequence with ideal arithmetic correlation exists for any prime $N>2$. These results provide further evidence that ideal arithmetic correlation is highly restrictive in the $N$-ary setting.

We present a concrete bit-operation cost model for solving multivariate quadratic systems with XL using Wiedemann linear algebra, and Berlekamp-Massey sequence recovery. Following the CryptAttackTester methodology, we implement XL in a circuit-oriented model and derive closed-form cost formulas for the XL, Wiedemann, and Berlekamp-Massey steps. We instantiate the model for GF(2), GF(31), and GF(256), including baseline, constant-coefficient, and bucketed matrix-evaluation variants. Experiments on small parameter sizes show that the formulas accurately predict the circuit costs, while asymptotic analysis confirms convergence to the expected leading constant factors determined by the underlying field arithmetic. We apply the resulting estimates to Fukuoka MQ Challenge instances and to multivariate candidates from the NIST additional-signature process, providing a unified bit-operation comparison of direct Wiedemann-XL costs across several MQ-based schemes.

Privacy-Preserving Machine Learning (PPML) is a methodology designed to maintain data privacy throughout the machine learning pipeline. Although cryptographically protecting input privacy at the training phase is theoretically feasible, it remains computationally intensive in practice. As such, most recent works in this area focus on the inference phase. In contrast, we consider the training phase. Our goal is to enable machine learning engineers to use customer data earlier in the ML pipeline without compromising customer privacy or violating regulations. In this work, we introduce a framework named PriFT (Private Fine-Tuning), which leverages a transformer as a feature extractor and then performs training of a neural network on privacy-protected features. PriFT supports fully-private training, where the data is encrypted in the entire ML pipeline, as well as semi-private training, which balances privacy and performance by decrypting the true and predicted labels during training. PriFT can perform secure training both by means of Multiparty Computation (MPC) and based on Homomorphic Encryption (HE), which allows for a direct comparison of the two most prevalent cryptographic solutions for secure computation on a real-world use case. The codebase of our experiments is fully open-sourced and based on well-established libraries, namely Crypten and TenSEAL. Our experimental results show that the MPC approach largely outperforms the HE approach, especially in the semi-private setting. Furthermore, the MPC-based solution in the semi-private setting outperforms the fully-private training approximately by 3×, offering an adequate privacy-performance tradeoff. Our results show that both HE and MPC can achieve accuracy close to that of plaintext models.

Blind watermarking enables image ownership verification without requiring the original image. However, existing schemes usually require the owner to reveal the watermark seed and watermark positions during extraction. This creates a strong trust assumption on the verifier. Once such secrets are exposed, a malicious verifier can forge or remove the watermark. In this paper, we present TIM, the first publicly verifiable blind watermarking scheme with sensitive parameters privacy based on zero-knowledge proof. TIM reconstructs the extraction procedure of Integer DCT blind watermarking into an arithmetic-circuit-friendly form. This allows the owner to prove correct extraction without revealing the watermark seed or embedding positions.

TIM addresses three main challenges. The first is the high proving cost for high-resolution images. The second is the conflict between circuit rigidity and watermark robustness. The third is the hashing overhead of iterative state binding. To address them, TIM combines Nova and Spartan to decompose full-image extraction into iterative proofs. It uses a threshold-based voting mechanism for robust detection. It also introduces a hierarchical state update mechanism to reduce circuit and memory costs. Experiments show that TIM preserves good imperceptibility and robustness while achieving practical efficiency. For a 4K image, proof generation takes 5.61 minutes and uses 9.61 GB peak memory. These results show that TIM is the first blind watermarking scheme to achieve seed privacy, public verifiability, and practical performance for high-resolution image ownership proofs.