International Association
for Cryptologic Research

Primitive-only PQC benchmarks are insufficient for attributing composed hybrid costs on Cortex-M4 because shared hash backends, randomized-signature behavior, and fixed classical/wrapper work affect measured performance. We implement a common bare-metal Cortex-M4 harness for representative KpqC/NIST families, measuring uniform Hash-CT hybrid KEM benchmark rows with X25519 and Bindel et al. hybrid-signature AND-combiner rows. The goal is composed-cost attribution under a uniform benchmark transcript rather than primitive-only ranking.

Our measurements show three attribution effects. First, replacing only Keccak-f[1600] changes SHAKE-heavy signing by up to 2.16×, while SPHINCS⁺-SHA2 and FN-DSA control rows remain at 1.00×. Second, median-only signature tables can change deployment conclusions. In the nominal level-5 signing rows, HAETAE5 beats FN-DSA-1024 by median and mean latency, but its observed maximum reaches 4.53× its median while FN-DSA-1024 remains essentially flat. Third, a local SMAUG-T backend improves standalone SMAUG-T by 1.79–1.82×, but the visible gain drops to 1.42–1.65× inside SMAUG-T+X25519 hybrids. Supporting KEM rows place lattice hybrids at 3.7–8.8 M cycles and HQC hybrids at 19.6–74.5 M cycles. Together, the results motivate reporting composed-cost attribution, backend provenance, and variance alongside primitive timings.

This paper proposes an optimized GPU implementation of the ARIA-GCM authenticated-encryption pipeline (CTR keystream, GHASH authentication, and their AEAD composition): ARIA-CTR uses a packed 32-bit S-box staged in shared memory, GHASH is optimized separately with a fixed-key 4-bit Shoup lookup table, the two stages are integrated as both a two-kernel and a fused single-kernel AEAD, and the same aria_gcm.cu source is tuned for Ampere and Pascal through compile-time parameters. For ARIA-CTR, the four distinct S-box tables are merged into one 1 KiB shared-memory table (R=1 staging) and each thread encrypts CTR_IPT counter blocks in parallel to fill the ALU-bound diffusion layer. For GHASH, each thread owns one segment of sblk blocks, applies W-way Horner interleaving with precomputed powers of H, and keeps the reduction table in shared memory. Experiments on an RTX 3090 and a GTX 1080 Ti show that packed S-box staging improves naive ARIA-CTR by 14.5×, the Shoup LUT improves bit-serial GHASH by 21.5×, and the tuned pipeline reaches 924 Gb/s (CTR), 2,865 Gb/s (GHASH), and 622 Gb/s (fused AEAD) on the RTX 3090. Using a simple sequential-composition model, we show that the GHASH optimization is what shifts the AEAD bottleneck onto ARIA-CTR: without it the pipeline would be GHASH-bound near 120 Gb/s, whereas the tuned GHASH makes CTR account for about three quarters of the per-byte cost. We back the analysis with Nsight Compute measurements of register usage, achieved occupancy, shared-memory bank conflicts, and DRAM traffic.

We present a quantum resource estimation of the Rijndael variants \[ N_b = N_k \in \{4,5,6,7,8\}, \qquad N_r = N_b + 6, \] under the NIST MAXDEPTH quantum cost model. Extending the AES quantum encryption oracle~\cite{ref5} parametrically to arbitrary $N_b = N_k$, we generalize the in-place key schedule, including the single- and double-\texttt{SubWord} cases, the \texttt{ShiftRows} offsets, and the round constants. We implement and verify the resulting oracles using ProjectQ. The verified variants range from 1,624 qubits at a full depth of 1,090 for Rijndael-128/128 to 3,240 qubits at a full depth of 1,839 for Rijndael-256/256. Under the NIST PQC MAXDEPTH bounds $\{2^{40}, 2^{64}, 2^{96}\}$, the Grover key-recovery qubit cost in $\log_2$ units ranges from $\{80.15, 32.15, 10.67\}$ for Rijndael-128/128 to $\{210.65, 162.65, 98.65\}$ for Rijndael-256/256. The standardized analogues at Categories 1, 3, and 5, namely Rijndael-128/128, Rijndael-192/192, and Rijndael-256/256, meet the corresponding AES-based bounds. The intermediate Rijndael-160/160 and Rijndael-224/224 variants provide reference points between the standardized AES key lengths.

Information set decoding (ISD) is the standard generic decoding attack considered for code-based cryptography. A concrete quantum-resource estimate for Grover-accelerated ISD requires an oracle whose dominant component is Gauss–Jordan elimination.

We improve the elimination circuit of Perriello et al. [25] and Jang et al. [15] by not updating the entries that no later pivot or the final weight predicate reads. The required result vector is recovered by a parallel back-substitution on the syndrome register. For the target schemes, our elimination circuit improves the qubit count by about 22% compared to [15]. The Toffoli count improves by about 20% compared to both [25] and [15]. The Toffoli depth improves by about 67% compared to [25] but degrades by about 0.3% compared to [15].

We report logical resource estimates for the quantum ISD attack on HQC and Classic McEliece. The product of the total gate count and the full depth exceeds the NIST post-quantum security thresholds, and the full depth exceeds the MAXDEPTH upper bound.

We also provide fault-tolerant estimates of the physical qubit count and the runtime under a surface-code model with magic-state distillation. As one example, HQC-128 requires about $2^{43}$ physical qubits and about $2^{53}$ years at a 1 μs code cycle.

This paper presents a memory-efficient and high-speed implementation of NTRU+, one of the key encapsulation mechanisms (KEMs) selected by Korea’s post-quantum cryptography project (KpqC), on the ARM Cortex-M4. NTRU+ is small enough to run on its own on a Cortex-M4 class microcontroller, yet in real embedded environments, the peak stack occupied by polynomial buffers and the running time dominated by the NTT become key constraints. To address this, in the proposed technique, we reduce memory by analyzing when each polynomial buffer is actually live and restructuring the algorithm so that only a single buffer is resident during computation, and we significantly improve speed by rewriting the NTT for the mixed-radix structure of NTRU+ in Cortex-M4 assembly. By doing so, the assembly NTT acceleration compensates for the recomputation overhead introduced by the memory optimization, so that the combined implementation is both smaller and faster than the reference. Experimental results show that, relative to the KpqClean_ver2[1] reference implementation, the proposed technique reduces the peak stack by 83–84% while improving the speed of all three operations by up to 1.8×.

FAEST is a symmetric-key post-quantum digital signature scheme and a third-round candidate in the NIST Additional Digital Signatures standardization process. Its signing path concentrates cost in two operations: round-wise constraint generation, which proves in zero knowledge that the AES circuit is computed correctly, and finite-field multiplication, which computes the leaf nodes of a vector commitment. This paper accelerates both operations on a CUDA-enabled GPU, with AES round constraint generation as the main contribution. Specifically, we fuse the three consecutive stages that make up constraint generation into a fused GPU path and keep the intermediate results between stages resident in device memory, thereby reducing host–device data transfer. As a supporting measure, we batch independent finite-field multiplications for leaf nodes, jointly improving end-to-end signing performance. We verify the correctness of the implementation through byte-level output agreement with the CPU reference implementation. Combining fused constraint generation with batched leaf hashing, the full GPU path achieves up to roughly a 3× end-to-end signing speedup over the CPU reference. Furthermore, when AES constraint generation fusion is added on top of leaf hashing that is already performed on the GPU, an additional reduction in signing latency is observed in five of the six evaluated AES s/f variants. The magnitude of this effect does not scale monotonically with the security parameter; rather, it is determined by the per-variant bottleneck structure.

We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under LWE) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.

Dynamic universal accumulators provide succinct set commitments for evolving datasets, but balancing efficiency and scalability remains challenging. In particular, Bilinear Pairing (BP) accumulators offer constant size witnesses, but their public parameters size and dynamic operation costs grow linearly with the global capacity of the set. To address this bottleneck, we propose a trapdoorless hierarchical accumulator (HACC) that keeps BP-style efficient witness update and verification while avoiding this linear dependence. For a set of current size $n$ and a pre-defined parameter $t$ ($t \ll n$), HACC requires only $\mathcal{O}(t)$ public parameters, while supporting addition, deletion, and witness generation in $\mathcal{O}(t\log_t n)$ time, which is far more efficient than the $\mathcal{O}(n)$ costs of BP accumulators (Nguyen, CT-RSA'05, Damg\r{a}rd et al., eprint'08, and Srinivasan et al., CCS'22); moreover, HACC has $\mathcal{O}(\log_t n)$ sized witnesses with amortized $\mathcal{O}(1)$ witness updates. We further integrate polynomial multiproofs to reduce witness verification to constant pairing complexity in read-heavy epoch-based settings. We prove correctness and soundness of HACC under the $t$-SDH assumption in the random oracle model. Experimental results show that under comparable parameter budgets, HACC is $9.7\times$ -- $1803.4\times$ faster than BP accumulators for element update and witness generation, and consumes $34.6\times$ -- $3679.4\times$ smaller public parameters size.

The Lattice Isomorphism Problem asks whether two given lattices $\mathcal L_1$ and $\mathcal L_2$ are related by an orthogonal linear transformation. Haviv and Regev gave a seminal $n^{O(n)}$-time algorithm for this problem based on an isolation lemma (SODA 2014).

We give algorithms for the decision, search, and all-isomorphisms versions of the problem running in time $n^{n+o(n)}$ times a polynomial in the input size. The main new ingredient is a Gaussian heat argument over convex bodies generated by shortest vectors: for $w\sim D_{\mathcal L^*,s}$, the vector $w$ canonically determines $n-o(n)$ independent shortest vectors, leaving a residual instance of rank $o(n)$. The remaining residual dimensions are handled by an $n^{o(n)}$-time canonicalizer obtained by adapting the Haviv-Regev algorithm. We then combine this canonicalizer with a birthday argument to recover all isomorphisms.

For the all-isomorphisms version, this bound is asymptotically optimal in the worst case up to an $n^{o(n)}$ factor. As an extension, we also give, in the QRAM model, a quantum variant running in time $n^{\frac{2}{3}n+o(n)}$. It outputs a representative isomorphism together with generators for the automorphism group, thereby providing a compact description of the entire isomorphism coset.

Password-authenticated key exchange (PAKE) remains central to WPA3-Personal, the personal mode of the latest Wi-Fi security standard, where the Simultaneous Authentication of Equals (SAE) protocol enables secure Wi-Fi access via a low-entropy password. However, SAE’s symmetric password authentication makes all associated stations (STAs) vulnerable once the network-edge access point (AP) is compromised. Although SAE+ (IEEE TIFS 2024) addresses this issue in the client–server model with verifier-based asymmetric authentication, its weak binding of the password-derived verifier, ephemeral randomness, and protocol transcripts still enables key-compromise impersonation (KCI) attacks and offline dictionary attacks. Therefore, designing a verifier-based asymmetric SAE protocol that preserves the SAE workflow while resisting these attacks remains challenging. To address this challenge, we propose AsymSAE, a verifier-based asymmetric SAE protocol tailored for personal Wi-Fi networks. Following the SAE workflow in IEEE Std 802.11-2024, AsymSAE realizes asymmetric authentication by allowing the STA and AP to use the user password and the password-derived verifier, respectively. We further formulate a verifier-based security model to capture the asymmetric structure, and prove the security of AsymSAE in this model. Heuristic security analysis and ProVerif verification demonstrate that AsymSAE provides forward secrecy, transcript-based offline dictionary attack resistance, AP-side KCI resistance, session-key confidentiality, and mutual authentication. Our performance evaluation, including ns-3-based network simulation, demonstrates that AsymSAE can achieve significant verifier-based security enhancement without incurring extra communication overhead, while introducing minimal additional computational overhead and authentication latency.

Event date: 23 September to 25 September 2026

The Department of Applied Mathematics at the Naval Postgraduate School invites applications for multiple tenure-track openings in all areas of computational applied and discrete mathematics. These openings are at the level of Assistant Professor (AD-03); however, exceptional candidates may be considered for appointments at the levels of Associate Professor (AD-05) or Professor (AD-07). For further details, including instructions on how to apply, please see the official advertisement at https://main.hercjobs.org/jobs/22392507. Review of applications will begin immediately and will continue until the positions are filled. Applicants submitting materials by August 1, 2026 will receive full consideration.

Closing date for applications:

Contact: Prof. Anthony P. Austin Department of Applied Mathematics Naval Postgraduate School Monterey, CA 93943-5121 (831) 656-3629

More information: https://main.hercjobs.org/jobs/22392507.

Our group has an available position, which can be filled either at the PhD or postdoctoral level, depending on the applicant’s qualifications, research experience, and fit with the group.

Recent research topics in our group include tight security, secure messaging, key exchange, public-key encryption, and digital signatures. We are also open to considering new topics in provable security. Prior knowledge of formal security definitions and reduction-based proofs is therefore desirable.

We expect candidates to have very good proficiency in English. Knowledge of German is beneficial, since the position includes teaching obligations.

We are looking for a highly motivated candidate with a Master’s degree, or equivalent qualification, in Computer Science, Mathematics, or a closely related field. Candidates who expect to complete their Master’s or PhD degree in 2026 are also encouraged to apply.

To express your interest, please send the following documents to me by email by 14 August 2026:

• A motivation letter that describes your research interests and why you would like to work with our group, at most 2 pages
• A curriculum vitae
• Academic transcripts and certificates
• Contact details of 2 academic referees, at least one of whom should be your thesis supervisor
• For postdoctoral applicants: a list of publications.

Closing date for applications:

Contact: Jiaxin Pan

More information: https://sites.google.com/view/jiaxinpan/open-positions

Who is talking to whom? Consider a group of users who wish to communicate anonymously via a network of intermediate relays. We study anonymous communication under two standard strong adversarial models. A passive adversary observes all network traffic and additionally views the internal states of a constant fraction of corrupted relays, while an active adversary may also control the behavior of these corrupted relays. The goal of an anonymous communication protocol is to ensure that the adversary cannot distinguish who is communicating with whom.

One of the most practical and widely adopted approaches is onion routing, where messages are first wrapped in layers of encryption and anonymity emerges through repeated "shuffling" of onions at honest relays that peel a layer and randomly permute outgoing onions. In general, this approach may not achieve anonymity. The challenge is to rigorously quantify conditions for efficiently achieving anonymity, where efficiency is measured as a function of the protocol's security parameter λ, which we assume, without loss of generality, is at least linear in the network size.

A well-known result from ICALP'18 shows that if each hop in a routing path is chosen uniformly at random from all relays, then onion routing achieves anonymity against a passive adversary whenever both the number of rounds and the server load grow faster than log λ. In this setting, anonymity arises from the fact that every onion is repeatedly shuffled with a uniformly random subset of other onions. However, this assumption requires a fully connected network.

We generalize this result to sparse networks. We show that when routing paths are selected by performing independent random walks on a sparse, constant-degree expander graph, onion routing still achieves anonymity with the same asymptotic efficiency parameters as in the complete-network setting. In particular, this matches the optimal round-complexity bound known for complete networks, despite the fact that onions only shuffle within their local neighborhoods at each round, and an adversary may extract information from observing transitions between neighboring nodes.

We further extend our results to active adversaries. In the sparse-expander setting, we construct, under different conditions, (1) a differentially private protocol that achieves (ε, negligible in λ)-differential privacy, and (2) an anonymous protocol. Both run efficiently in polylogarithmic rounds and incur polylogarithmic server load.

This work introduces a polynomial-time attack on the signature scheme Facto-DSA. We provide an implementation that breaks all proposed parameter sets, including the largest, in under one minute on a standard laptop. These results question the suitability of multivariate polynomial factorization as a foundation for robust cryptographic schemes.

Integral cryptanalysis analyzes block ciphers using input structures for which the sum of a chosen function of the output bits becomes key-independent. However, most methods still test one output expression at a time, so they can miss distinguishers that emerge only when several outputs are combined, either linearly or nonlinearly. They are also not designed to capture key-dependent integral combinations, which may hold deterministically on part of the key space. In this work, we develop Split-and-Cancel, a method that combines exact expansion in a short final part with an oracle on the preceding rounds to determine which suffix monomials can survive from the chosen structure and records them in a binary matrix. Key-independent combinations are then extracted from the left kernel of this matrix. We first apply the method in a reduced model with omitted boundary key additions, where linear dependencies in this matrix yield certified key-independent sum combinations among output bits and higher-degree output products. When the omitted boundary key is restored, the same combinations yield deterministic weak-key distinguishers. We apply the method to SIMON, SIMECK, SPECK, PRESENT, and GIFT. Our strongest deterministic results add one round to the best integral distinguishers for SIMON-32, SIMON-48, SIMON-64, SIMON-96, SIMON-128, all standard SIMECK variants, and SPECK from block sizes 32 to 128. For PRESENT and GIFT, we obtain one-round improvements for deterministic weak-key integral distinguishers. In each case, the exact weak-key class covers at least a quarter of the key space: $2^{78}$ of $2^{80}$ keys for PRESENT-80, $2^{126}$ of $2^{128}$ keys for PRESENT-128, GIFT-64 and GIFT-128. These results show that exact modeling of a short final part can reveal key-independent and weak-key integral behavior missed by single-observable searches.

Fully homomorphic encryption (FHE) enables computation on encrypted data without decryption. In TFHE, programmable bootstrapping (PBS) evaluates nonlinear functions through lookup tables (LUTs), but a direct multivariate LUT over a $t$-ary plaintext space has size $t^\ell$. This paper studies LUT compression for multivariate functional bootstrapping via variable separation and additive inner representations.

We first apply this approach to non-negative integer division with remainder. For a dividend $m$, a divisor $d$, and $h=\lfloor m/d\rfloor$, we use a logarithmic transformation to decompose bivariate division into two univariate logarithmic PBS calls, one homomorphic subtraction, and one outer exponential PBS call. To handle integer plaintexts, we introduce a rounded logarithmic function $\operatorname{clog}_{B,M}$ and give a sufficient condition on $M$ for exact quotient recovery. The resulting homomorphic division-with-remainder algorithm achieves $\widetilde{O}(1)$ equivalent blind-rotation complexity under theoretically optimal parameters, and also yields frameworks for modular reduction and truncated division.

We further prove that every finite function $f:[t]^\ell\to[t]$ can be written as $f(x_1,\ldots,x_\ell)=q\left(\sum_{i=1}^{\ell}p_i(x_i)\right)$, and search for small-span representations using simulated annealing with reheating. Experiments show a 3.6x speedup for division with remainder at $t=64$, and a 1.9x speedup for the Hamming-weight interval function, compared with estimates based on [BBR26].

The threat of large-scale quantum computers to classical public-key cryptography has motivated the development of post-quantum cryptographic schemes. Among these, lattice-based constructions have become the mainstream choice in the ongoing NIST standardization process. The security of these schemes typically relies on the hardness of the LWE problem, and the dual-sieve-FFT attack is widely recognized as one of the most effective approaches against it. Recent improvements by MATZOV and Carrier et al. have significantly advanced its efficiency. In this paper, we propose a new variant of the dual-sieve-FFT attack that integrates modulus switching and lossy source coding. We provide a theoretical analysis of the integrated approach and show that the enumeration size in the FFT step can be reduced from $q^{n_\text{fft}}$ to $p^{k_\text{fft}}$ (with $p

As privacy concerns rise, numerous laws require machine learning-based applications to comply with stringent privacy regulations. While Homomorphic Encryption (HE) allows computation directly on encrypted data, existing HE-based inference solutions suffer from significant computational and memory overhead for both single and multiple samples. Additionally, current methods require many rotation keys, which limits their practicality in a broader range of scenarios.

To address these challenges, we propose channel-interleaved packing (CHIP) to embed three-dimensional (3-D) data into 2-D ciphertexts, enabling 3-D HE convolution to be performed as a 2-D HE convolution combined with channel aggregations via ciphertext rotations. To further improve the performance of CHIP-based convolution, we introduce an efficient 2-D convolution that halves the number of HE multiplications. For computationally intensive inference tasks, we employ partial-kernel and mini-batch strategies that iteratively process sliced kernels and subsets of samples, aggregating the results to produce the final output.

Experimental results demonstrate the superior efficiency of our method compared to the state-of-the-art HE-based approaches by Lee et al. (ICML'22) and Cheon et al. (IEEE TDSC'24) in both single-sample and multi-sample scenarios. Using ResNet18, VGG11, and VGG16 with a batch size of 64, our solution achieves speedups of up to 4.7$\times$. When processing a single test sample, the speedup increases to 60$\times$. Moreover, our method requires only 29 rotation keys for evaluation, which is at least 35\% fewer than previous works, resulting in an overall memory reduction of up to 45\%. Code is available at: \url{https://github.com/whcjimmy/chip}.

This work revisits a natural paradigm for constructing public-key encryption, whereby the public key is an obfuscated block cipher in encryption mode. We show that if the block cipher is a permutable pseudorandom permutation [Shmueli–Zhandry, Crypto ’25] and the obfuscator is indistinguishability-secure, then the following holds.

1. Applying the obfuscated cipher directly to the message and a short random nonce, without any additional structure or consistency checks, suffices for CCA2 security. 2. Augmenting the scheme with the capability to generate obfuscated decrypt-then-apply-$f$ circuits (for any given function $f$), yields a *functional encryption* scheme that is *simulation-secure against adaptive chosen-ciphertext attacks*. 3. For any length-preserving function $g$, augmenting the public key with an obfuscated decrypt-apply-$g$-reencrypt circuit allows anyone to homomorphically apply $g$ to encrypted data, for an unbounded number of times, while preserving semantic security. (This relies on subexponential security.)

We also show that, under the split-circuit pseudorandomness (SCP) assumption of [Canetti–Chamon–Mucciolo–Ruckenstein, TCC ’24], random reversible circuits form a permutable pseudorandom permutation family. This points to obfuscated random reversible circuits as a potential alternative avenue to public-key encryption with strong security and rich functionality.