International Association
for Cryptologic Research

Group key agreement protocols are essential for modern secure messaging. Most existing group key agreement protocols assume a centralized model with a semi-trusted service that mediates the communication. This is efficient, but problematic for some important applications, since a central service can be a choke point for surveillance and censorship. There is a nascent literature on decentralized group key agreement that avoids such reliance, but existing proposals either do not scale, with update costs linear or quadratic in the group size, or lack proofs of security. Centralized protocols can offer much lower (logarithmic) cost.

We present BeeKEM, the first decentralized group key agreement protocol with logarithmic update cost in the common case (degrading to linear in the worst case) and proofs of security. We provide an open-source implementation and demonstrate that it is competitive with OpenMLS. BeeKEM opens the door for a range of communication and collaboration applications offering not only end-to-end encryption, but also metadata privacy and censorship resistance.

Edge-AI Internet-of-Things (IoT) devices increasingly perform local neural-network inference in physically accessible environments. While prior physical attacks on neural networks mainly focus on model extraction, parameter recovery, or intermediate computation, the final decision stage remains insufficiently studied. This paper investigates the physical security of ArgMax-based decision logic, which converts output scores into the final class label in many edge-AI deployments. We show that a sequential ArgMax implementation can expose deterministic power-trace patterns associated with loop iterations and conditional maximum updates. These patterns can be used to recover decision-related timing information and guide voltage fault injection, enabling targeted redirection of the final inference result. We implement the attack on a real MCU-based edge-AI platform using an STM32F407VG device running an X-CUBE-AI-deployed convolutional neural network. Under dual-point voltage fault injection, the unprotected ArgMax achieves targeted redirection to all non-original classes in the MNIST case study. To mitigate this threat, we propose Shuffled-ArgMax, a lightweight software-level defense that combines randomized traversal, loop-integrity checking, and redundant decision verification. Experimental results show that, under the same attack setting, Shuffled-ArgMax reduces the targeted redirection success rate from 56.92% to 0%, demonstrating strong resilience against targeted misclassification attacks. Meanwhile, it introduces only a small end-to-end runtime overhead relative to the complete DNN inference.

Mutual correlated agreement (MCA) bounds how many points on an affine line of received words can agree with codewords on many coordinates when the line does not admit a common codeword explanation on those coordinates; the corresponding line parameters are called bad. MCA arises in the soundness analysis of code-based proof systems. For Reed-Solomon codes with arbitrary prescribed evaluation sets, existing deterministic bounds apply only at integer error budgets strictly below the exact Johnson boundary.

Fix integers $r\ge2$ and $h\ge1$. For every sufficiently large $K$, let $L\subseteq\mathbb{F}_q$ be any set of $n=rK$ distinct points and set $C=\operatorname{RS}_{
We also derive a MCA upper bound for maximum distance separable (MDS) codes from a sharp lower bound on the number of rejected local membership tests. For Reed-Solomon codes over sufficiently large fields, the resulting endpoint bound is exact whenever at most $K+1$ agreements are required. It yields exact $2^{-128}$ thresholds for four explicit smooth-domain codes of length $64$: we identify the largest safe integer budget and prove that the next one is unsafe.

As a concrete application to the Grand MCA Challenge, we exhibit a single prime field $\mathbb{F}_Q$, with $Q<2^{256}$, that supports the required smooth domains at all four target rates. With $K=2^{18}$, the first post-Johnson budget has MCA error below $2^{-128}$ at rates $1/2,1/4,1/8,$ and $1/16$, as does the second such budget at rate $1/8$.

This work contains an exposition of the seven foremost unsolved problems in the domain of isogeny-based cryptography, obtained by asking eleven experts in isogeny-based cryptography what they considered to be the most important unsolved problems in isogeny-based cryptography, and curated down to the seven problems in this document. For each problem, an expert wrote a short write-up giving the precise statements and descriptions per problem.

Verifying Groth16 proofs on Bitcoin enables a broad class of trust-minimised applications, bridges, light clients, validity rollups, but Bitcoin script lacks the pairing operations required to evaluate the verification equation natively. A recent line of work on Bitcoin-side garbled-circuit SNARK verification (Delbrag, BitVM3, BitVMX-GC, Glock, Argo MAC) has produced practical constructions but does not provide formal universal-composability analysis.

We present $\Pi_{\mathsf{DV\text{-}Groth16}}$, a protocol for designated evaluation of Groth16 proofs on Bitcoin. The prover holds a standard Groth16 proof $\pi_{\mathsf{in}}$ under a public, one-time ceremony SRS. The verifier generates, from a secret seed, a compact per-session trapdoor SRS for a fixed outer circuit, the inner Groth16 verifier, computed natively over a one-layer 2-chain (BLS12-377 inside BW6-761), and proves it well-formed. The prover produces an outer Groth16 proof that her inner proof verifies, and garbles a small circuit that checks the outer proof in scalar form: after the verifier reveals his seed, the prover signs the discrete logarithms of her pre-committed outer proof elements, and the circuit checks them against the commitments together with the scalarized verification identity, releasing a slashing key on failure. Cut-and-choose enforces garbling correctness; deposits and commitments are locked in Bitcoin UTXOs with a three-tier settlement (refund, slash-fast, slash-commit). The per-session SRS has fixed size, independent of the assertion circuit, and all elliptic-curve computation inside the garbled circuit reduces to three fixed-base scalar multiplications.

We prove that $\Pi_{\mathsf{DV\text{-}Groth16}}$ GUC-emulates an ideal functionality $\mathcal{F}_{\mathsf{DV\text{-}Groth16}}$ capturing the three-tier behaviour against static corruption in the GUC-hybrid model, with a concrete bound assembled from named primitive advantages. We make precise how designated evaluation and enforcement differs from designated-verifier deniability, and exhibit a variant achieving the latter at the cost of a per-proof SRS for the assertion circuit itself.

Generalized integral properties extend classical integral distinguishers, but their search is hindered by the size of the generalized function space. In this work, we study a structured and tractable subclass of generalized integral properties by restricting the generalized Boolean function to a separable form. This separable restriction decouples the plaintext side from the ciphertext side, thereby casting the search as the interplay between plaintext-side suppression of propagation sources and ciphertext-side cancellation of unknown monomials. On the plaintext side, we consider a structured space generated by linear combinations of basic plaintext structures; on the ciphertext side, we work in a degree-bounded Boolean candidate space. This yields an explicit and controllable search space while still capturing meaningful extensions of classical integral distinguishers.

Based on this formulation, we develop two matrix-based solving strategies that avoid exhaustive enumeration of the mapping space. The first is a unified MBM (Matrix--Bipartite graph--Matrix) framework, which reduces the joint search to a Boolean constraint system amenable to MILP. The second is a specialized solver for fixed plaintext structures, where the search for ciphertext-side low-degree mappings is reduced to a linear cancellation system and solved by Gaussian elimination. Experiments confirm the practical effectiveness of the proposed methods. For SPECK and SIMON, our search extends the number of rounds covered by mapping-based integral distinguishers. In particular, for SPECK, whose modular-addition structure makes integral modeling considerably more challenging, the proposed framework still yields improved distinguishers. For PRESNET, RECTANGLE, and SKINNY, our methods identify additional balanced integral properties beyond those captured by previous approaches. These results show that structured search provides a practical way to broaden the reach of automated integral analysis across different cipher families.

Public Key Encryption for Broadcast ($\mathsf{PKEBC}$) is a multi-recipient encryption primitive that guarantees decryption consistency across all designated recipients. Concretely, if a ciphertext $c$ is encrypted for Bob and Charlie, and Bob’s decryption yields a message $m$, then Charlie’s decryption of $c$ must also succeed and produce the same $m$. This property, though seemingly natural, is essential in secure group messaging, where consistent message delivery is often implicitly assumed. However, no efficient constructions of $\mathsf{PKEBC}$ currently exist: known approaches achieve consistency through Non-Interactive Zero-Knowledge ($\mathsf{NIZK}$) proofs of generic statements. Not only is the complexity of the $\mathsf{NIZK}$ statements already prohibitively expensive, but, in addition, it is not even clear if these can be turned into purely algebraic statements while retaining linear-sized ciphertexts. This is crucial to enable the use of efficient $\mathsf{NIZK}$ constructions. This paper presents new generic $\mathsf{PKEBC}$ constructions along with optimized instantiations of each. Concretely, we introduce $\mathsf{PKEBC}_{\mathsf{SM}}$ and $\mathsf{PKEBC}_{\mathsf{FO}[\mathsf{mPKE}]}$, and prove the security of these constructions in the standard and random oracle models, respectively. – $\mathsf{PKEBC}_{\mathsf{SM}}$ achieves consistency via $\mathsf{NIZK}$ proofs. Crucially, we hand-tuned the $\mathsf{NIZK}$ statements of our instantiation to ensure the $\mathsf{NIZK}$ is only used to prove very simple and carefully optimized purely algebraic statements. – $\mathsf{PKEBC}_{\mathsf{FO}[\mathsf{mPKE}]}$ achieves consistency via the Fujisaki-Okamoto ($\mathsf{FO}$) transform (CRYPTO 1999 and Journal of Cryptology 2013) applied to a Multi-Recipient Public Key Encryption scheme ($\mathsf{mPKE}$). Specifically, $\mathsf{NIZK}$'s ciphertext recomputation during decryption ensures ciphertexts are well-formed, eliminating the need for costly $\mathsf{NIZK}$ proofs. We then give two suitable $\mathsf{mPKE}$ instantiations: one based on Kurosawa’s $\mathsf{mPKE}$ (PKC 2002) and the other from Hash Proof Systems. For all our schemes and their instantiations, ciphertext sizes and encryption and decryption times grow linearly with the number of receivers. Our constructions therefore enable the first practical group messaging applications with consistency guarantees.

Digital contact tracing systems play a pivotal role in mitigating the spread of infectious diseases during pandemics by identifying individuals exposed to confirmed cases. In decentralized privacy-preserving contact tracing protocols, users broadcast pseudo-random IDs and, upon infection, upload the relevant IDs to a cloud server. Other users can then download these IDs to determine if they have been in proximity to infected individuals. However, existing protocols often lack verifiability, implicitly assuming honest user behavior when uploading data to the server. This gap creates vulnerabilities, including false positives and false negatives, which hinder the widespread adoption crucial for the effectiveness of contact tracing apps. This paper introduces SPiRiT, a secure and privacy-preserving verifiable contact tracing protocol, designed to address these shortcomings by introducing verifiability, ensuring the legitimacy of uploaded IDs, while still maintaining user privacy. Verifiability ensures whether an upload contains a valid set of pseudo-random IDs with respect to the contagious period of the infected individual, and that the individual claiming those IDs is the legitimate owner, in a privacy-preserving manner. The goal of our design is to maintain a balance between the competing objectives of privacy, security, and decentralization while fostering greater public trust and adoption by addressing the aforementioned vulnerabilities. Through rigorous evaluation using a face-to-face individual interaction dataset, we demonstrate that SPiRiT not only reduces false alarms but also can be on par with or even outperform existing protocols in detecting high-risk contacts.

With the widespread adoption of Field Programmable Gate Arrays (FPGAs) in security-critical industries such as defense and telecommunications, ensuring the confidentiality of sensitive data processed by these devices has become paramount. Side-Channel Analysis (SCA) poses a significant threat, necessitating the protection of cryptographic primitives through effective and efficient countermeasures. Within the framework of well-established formal adversary models, Boolean masking offers provable resistance to SCA by randomizing sensitive intermediate computations using Shamir’s secret sharing. However, the secure and efficient implementation of Boolean masking in hardware presents a complex and error-prone challenge. Physical effects such as glitches, transitions, and couplings can undermine essential security assumptions, potentially weakening the effectiveness of masking. Although robust masking schemes are designed to maintain their security in the presence of glitches and transitions, and their secure implementation can be verified at the gate level using a wide range of automated verification tools – albeit mostly for Application-Specific Integrated Circuits (ASICs) and not FPGAs – leakages caused by coupling effects remain undetectable by such tools, as they occur at a lower abstraction level. In this work, we focus on detecting (low-level) vulnerabilities in masked FPGA designs through experimental and tool-assisted evaluation. The flaws that we target are not detectable at the Register Transfer Level (RTL ) level, and in some cases, not even at the gate level, as they arise from optimizations introduced during synthesis or implementation, or from the specific outcomes of the Place and Route (PnR) process. We demonstrate that these flaws are not only theoretically concerning, but can lead to observable leakages in practical experiments. Furthermore, we show how to formally abstract, unveil, and mitigate such leakages, thereby enabling a security-aware FPGA design flow that spans from the behavioral to the physical level. As an example, we implement all the evaluation steps presented as an extension of PROLEAD and validate its accuracy and effectiveness through practical case studies.

Recently, Boyle, Jain, Servan-Schreiber, and Srinivasan (EUROCRYPT 2025) introduced the notion of simultaneous-message and succinct (SMS) secure computation. In an SMS protocol, after an initial sampling of a common reference string (CRS), two parties—Alice (with a large input) and Bob (with a small input)—can simultaneously exchange encodings of their private inputs and obtain additive shares of the output of a function evaluated over their inputs. The key requirement is succinctness: namely, the sizes of the CRS and each input encoding grow only polylogarithmically in the size of Alice's input and the function output. Boyle et al., and independently Abram, Malavolta, and Roy (STOC 2025), constructed SMS for all bounded-depth Boolean circuits from the plain learning with errors (LWE) assumption.

In this work, we extend the study of SMS along two new dimensions:

Reusable SMS: In this setting, the same input encodings can be reused to compute multiple functions.

Multiparty SMS: In the multiparty setting, we consider computations over one large input and multiple small inputs. Succinctness in this case means the size of the CRS and input encodings can grow with the total length of the small inputs (but polylogarithmically with the length of the long input and the size of the function output).

Assuming polynomial hardness of LWE (with a sub-exponential modulus-to-noise ratio), we construct reusable two-party SMS for all bounded-depth Boolean circuits with polylogarithmic communication. By additionally assuming indistinguishability obfuscation, we present a generic compiler from reusable two-party SMS to reusable multiparty SMS.

Our construction of reusable two-party SMS from LWE relies on a new "dual-use" technique where we reuse an LWE secret key between a lattice-based algebraic homomorphic MAC and a lattice-based homomorphic encryption scheme. This dual-use technique allows us to bootstrap a reusable SMS protocol for quadratic functions into one that supports arbitrary (bounded-depth) Boolean circuits. Along the way, we also show how to adapt a previous lattice-based algebraic homomorphic MAC based on ring LWE to obtain one based on the plain LWE assumption.

AESpolyW, proposed at IEEE S&P 2026, is a wide-block encryption mode designed to exploit instruction-level parallelism between AES and polynomial hashing. Although AESpolyW achieves high throughput and outperforms HCTR2 and EME on most tested platforms, we show that AESpolyW does not achieve strong tweakable-PRP security. Our attack requires only two encryption queries and one decryption query, and distinguishes AESpolyW from an ideal tweakable permutation with advantage close to one. We further show that this weakness directly compromises Encode-then-Encipher authenticated encryption (AE) instantiated with AESpolyW. For the appended-zero, prepended-zero, and inserted-zero variants, we construct fresh ciphertext forgeries that are accepted with probability one. The same attacks also yield chosen-ciphertext plaintext disclosure and complete IND-CCA breaks. These results are structural and do not rely on any weakness of AES, the polynomial hash, or PHASH.

The rise of quantum computing threatens widely deployed public-key cryptosystems, driving the adoption of post-quantum cryptography (PQC) algorithms that rely heavily on modular arithmetic. Existing hardware accelerators of the PQC algorithms for resource-constrained Internet-of-Things (IoT) devices remain limited and lack integrated fault detection mechanisms. In this work, we present CMALU, a Compact, fault-tolerant Modular Arithmetic Logic Unit supporting six operations on a single reconfigurable datapath, with a 2-bit input selecting Mode-0 (un-protected baseline), Mode-1 (on-the-fly parity and invariant checking with a formal single-bit detection guarantee), and Mode-2 (extending Mode-1 along with hardware-reuse recomputation for deterministic silent data corruption (SDC) elimination without datapath duplication). Under system-level fault injection into CMALU internal registers on an NTT accelerator and an Ibex RISC-V core running ML-KEM-512, Mode-1 achieves 100% single-bit and stuck-at detection at zero latency overhead, and Mode-2 achieves 0% SDC. The synthesis results after the post-place-and-route stage on a field-programmable gate array (FPGA) and application-specific integrated circuit (ASIC) implementations with the NTT accelerator targeting 65nm CMOS and the Ibex RISC-V integration targeting Nangate45 45nm confirm CMALU's suitability for resource-constrained IoT deployment.

LESS is a code-based signature scheme built on the linear equivalence problem and, in its v2.0 round-2 form, a candidate in the NIST call for additional post-quantum signatures. No microcontroller implementation of it has been reported: the official benchmarking effort for the additional signatures excluded it on memory grounds, and an x86-massif cross-check puts the reference's peak stack at up to $\approx 836$~KB---beyond the SRAM of even the largest mainstream Cortex-M4. This paper provides the first such implementation, to the best of our knowledge---a complete characterization of LESS (v2.0) on the Arm Cortex-M4 across all seven parameter sets. NIST did not advance LESS to the third round in May 2026; we develop the implementation techniques and the evaluation methodology to outlast that outcome.

We map the speed--memory design space with three operating points, all byte-identical to the NIST known-answer tests. The primary point is a \emph{balanced} configuration signing $4.1$--$4.3\times$ faster than the platform-normalized reference while using $41$--$59\%$ less peak stack. With double-pass signing at category~5, it is the only configuration whose signing we measured on target across all seven sets---at category~5, the resident-matrix configurations exceed the device's 640~KB of SRAM. It is flanked by a \emph{speed ceiling} at $4.5$--$4.7\times$ (at reference-level memory) and a \emph{memory floor} that signs with about a one-kilobyte measured stack at only $1.2$--$1.5\times$ reference time at category~1, with key generation on par with or below reference cost---so at category~1, memory minimization is nearly free.

The speedups rest on three increasingly platform-specific layers: algorithmic restructuring, intrinsic-free two-lane SWAR (SIMD-within-a-register) arithmetic for $\mathbb{F}_{127}$ with a lazy-reduction scheme, and hand-scheduled assembly kernels---including a rank-2 row-elimination kernel---together with a systematic audit of all kernels against the Cortex-M4 timing rules. Read against the reference's own profile, these results indicate that implementation maturity, not the scheme, accounts for a $>4\times$ swing in achievable microcontroller signing---a data point for standardization-time performance evaluation, offered without revisiting the decision.

We further report a catalog of negative results (techniques that help on desktop SIMD but hurt on the M4) and an alignment-safe transpose that returns $\approx 170$~KB of static memory to the stack under an \texttt{-O3} build. The evaluation methodology---Pareto-monotone adoption criteria, byte-identical correctness gates, and coverage and ablation reporting---transfers to the surviving third-round candidates, for which NIST has explicitly called for constrained-device evaluation.

The California Consumer Privacy Act (CCPA) grants consumers the right to request deletion of personal data held by registered data brokers. California’s 2023 Delete Act provides a new mechanism through which consumers can exercise this right by leveraging a centralized Delete Request and Opt-out Platform (DROP), enabling users to submit a single request that must be periodically processed by all registered data brokers. Since this platform aggregates sensitive user information, it is intentionally designed with safeguards against information leakage and unauthorized disclosure. This legislation, and the system it introduces, are positioned to serve as a template for wider deployment, with copy-cat legislation already introduced in many US states.

In this document, we evaluate the privacy architecture of the first-generation DROP system from a cryptographic perspective. The proposed design relies on hash-based record linkage---a widely used technique that offers heuristic rather than rigorous privacy guarantees. We begin by analyzing the inherent risks of this approach and identifying simple, lightweight modifications that can modestly improve its privacy guarantees by making it more difficult for malicious actors to exploit these vulnerabilities.

We then contrast this approach with Private Set Intersection (PSI), a class of provably secure cryptographic protocols that only reveal the intended matching records and nothing more. For future iterations of DROP, we propose a comprehensive PSI-based redesign, arguing that it would substantially reduce the risk of accidental information leakage while incurring only moderate additional computational overhead. Next, we highlight how DROP presents a compelling application for advanced variants of PSI with extended functionalities and stronger security guarantees, and we outline several research directions for the cryptography community, motivated by the unique requirements of such systems. Finally, we identify systemic risks that cannot be mitigated by PSI alone and discuss potential complementary approaches for addressing these broader challenges.

We hope this document serves as a common starting point for the cryptography and policy communities working to design future data deletion systems.

This paper presents a native Rust implementation of the Korean post-quantum cryptography algorithms (i.e., NTRU+, SMAUG-T, HAETAE, AIMer). We optimize the implementation in Rust for speed and memory usage, and compare our implementation with the C reference code (KpqClean) and unoptimized Rust implementation (baseline).

For speed, we use AVX2 and PCLMULQDQ to accelerate NTT- and Toom–Cook-based polynomial multiplication, 4-way SHAKE, and carry-less GF(2^λ) multiplication. Compared to the C reference, the speed-optimized version reduces the execution time by 32–76% across all target schemes.

For memory, we reduce large temporary buffers through on-the-fly approach, two-pass sampling, and transcript recomputation. Against the C reference, the memory-optimized implementation reduces the total memory usage by 1–94% across all target schemes.

Overall, these results show a speed–memory trade-off, letting an implementation be chosen according to whichever resource is more constrained.

To initiate migration to post-quantum cryptography (PQC), it is necessary to identify whether deployed software uses quantum-vulnerable (QV) public-key cryptographic schemes such as RSA, ECDSA, and Diffie–Hellman (DH). However, many ELF executables are distributed without source code, making it necessary to directly screen executable binaries for QV candidates. A prior tool, Quantum-vulnerable Executable Detection (QED), provides high precision but incurs substantial analysis cost, whereas its lightweight variant, QED-Lite, is faster but produces more false positives (FPs).

This paper proposes ML-QED-Lite, a machine learning-based approach designed to retain the efficiency of QED-Lite while reducing FPs. Unlike a post-filter that merely reclassifies candidates selected by QED-Lite, ML-QED-Lite directly takes all ELF executables in a target directory as input. For each file, it extracts function symbols, library dependencies, and binary-level attributes, and then uses a trained classification model to determine whether the file is a candidate for PQC migration.

The evaluation results show that ML-QED-Lite detects the same five positive executables as QED-Lite on the network dataset while reducing FPs from two to zero. On the synthetic dataset, ML-QED-Lite retains the same six positive executables while reducing FPs from four to zero. These results indicate that ML-QED-Lite preserves the true positives (TPs) identified by QED-Lite while reducing FPs, thereby improving the practicality of lightweight screening for PQC migration.

Following the standardization of major post-quantum cryptography (PQC) algorithms, C implementations of ML-KEM, ML-DSA, and SLH-DSA have been rapidly deployed. However, known-answer tests (KATs) verify only functional correctness and do not establish the absence of timing leakage caused by secret-dependent branches, memory accesses, or variable-latency instructions. This paper presents CT-KAT, an integrated screening platform for assessing constant-time risks in PQC C implementations. CT-KAT is configured through a single YAML file. Using this configuration, it validates the build and KAT execution. It also automatically generates harnesses for the functions under analysis. It then performs several analyses within a unified pipeline. These include Valgrind/Memcheck-based structural checks, a ct-matrix over compiler and optimization-level combinations, and an assembly-level asm-scan. When configured, the pipeline also runs dudect-based timing tests. CT-KAT aggregates the results of these checks into a single verdict drawn from a nine-class taxonomy. CT-KAT does not treat a PASS result as proof of constant-time behavior. Instead, it applies a default-deny policy when assigning verdicts. It also provides supporting evidence to guide manual triage. When applied to a PQClean-based PQC corpus, CT-KAT produced four main classifications. The baseline ML-KEM target was classified as robust. The KyberSlash reproduction was flagged as a secret-dependent variable-latency risk, labeled varlat-secret-risk. The variable-time behavior of ML-DSA and SLH-DSA/SPHINCS+ was accepted under the label accepted-variable-time. Falcon-512 was retained for further analysis and labeled needs-analysis. These results show that CT-KAT provides a screening framework that integrates signals from multiple analysis layers while making the limitations of each tool explicit.

AIMer is a post-quantum digital signature scheme with a conservative design. Its security relies only on the symmetric-key one-way function AIM2 and an MPC-in-the-Head (MPCitH) zero-knowledge proof. AIMer is a Korean post-quantum cryptography (KpqC) standard. However, the AIMer standard code released in January 2026 is a portable C reference implementation. It does not include processor-specific optimizations. As a result, it does not exploit AVX-512, a 512-bit vector instruction set available on modern processors. This paper presents an AVX-512 optimized implementation for all six AIMer variants. We parallelize binary-field multiplication with VPCLMULQDQ. The implementation processes four MPC parties per 512-bit register. We also handle conditional XOR accumulation in the linear layer with a single VPTERNLOGQ instruction. In addition, we accelerate the Keccak permutation using AVX-512VL. Our implementation is 1.60–1.84× faster than the AVX2 implementation for signing. We further analyze the source of this speedup. Contrary to common intuition, most of the improvement comes from Keccak. In the 128-bit and 192-bit variants, Keccak accounts for about 86% of the total improvement. Only in the 256-bit variants does the field-arithmetic contribution increase to about 42%, due to the wider field size. These results show that vectorizing symmetric primitives is as important as binary-field arithmetic in MPCitH signatures. In some cases, it is even more important.

As TLS 1.3 migrates to post-quantum cryptography (PQC), hybrid X.509 transition strategies—alternative-signature (Catalyst), Composite, Chameleon, and signature combiners—are compared on cost but rarely on whether they actually enforce the classical↔PQC binding they promise. We show they often do not, and that the failure persists even in stacks that do check the binding. The same BouncyCastle library accepts a Catalyst certificate carrying a forged ML-DSA signature on its default path yet rejects it via an opt-in call; and wolfSSL, the only stack that checks a present alternative signature by default, cannot require one, so a stripped certificate is silently accepted (a path whose experimental build also shipped CVE-2026-5393). That no stack can mandate the binding is the surprise; that an ignored non-critical extension is skipped by nine verifiers is the expected X.509 baseline, which we reproduce with an independent non-BouncyCastle generator. Composite, by contrast, binds structurally (three verifiers across three OID families reject corruption of either half). Folding this measured enforcement axis into a four-axis cost model (strategy sizes differ by under 4.4%) overturns the cost-led recommendation: once enforcement is priced in, the compatibility winner Catalyst is displaced by a structurally-bound encoding—a combiner where the operator controls both endpoints, or Composite once a like-for-like P-256 pairing ships. A compatibility-led ranking can thus recommend a strategy whose PQC protection no deployed verifier enforces.

HCTR2 is a wide-block encryption mode that encrypts one fixed-size message as a single unit, so that flipping a single plaintext bit re-randomizes the whole ciphertext. Its main use is disk encryption, where the message is a disk sector. We instantiate it with ARIA, the Korean national block-cipher standard, and implement it on an NVIDIA RTX 4080 GPU. With many independent messages, assigning one thread per message keeps the device occupied. At low queue depth, however, most of the GPU sits idle, and encrypting one 16 KiB message is several times slower than a single CPU core. The reason is that one HCTR2 message is internally sequential, so it cannot simply be split across threads.

We present a fine-grained kernel in which one 32-thread warp cooperates on a single message. The kernel exploits the linearity of POLYVAL. It splits the long hash computation into contiguous per-thread pieces, has each thread compute a partial result, and combines the partials with warp shuffles to obtain exactly the same value as the sequential computation. This brings the latency of one message down to parity with a single CPU core (ARIA-256: 222 μs on the GPU vs. 209 μs on the CPU). Moreover, the number of threads per message and of messages per block acts as a knob that trades latency for throughput, spanning 222 μs/30 GB/s to 1774 μs/49 GB/s. With as few as four messages in flight the GPU already beats the CPU. We validate correctness for all three key sizes.