International Association
for Cryptologic Research

We are hiring two postdoctoral researchers at Boston University to work at the intersection of systems and applied cryptography.

About the role. We are building secure and scalable computing infrastructure using secure multiparty computation (MPC), fully homomorphic encryption (FHE), and trusted execution environments (TEEs). We seek candidates who combine strong foundations with hands-on systems engineering and want to help build an open-source system for deploying secure data workflows in the cloud. This NSF-funded project (https://www.nsf.gov/awardsearch/show-award/?AWD_ID=2613424) builds upon years of research by the PIs, and we already have an exciting set of real use cases from stakeholders eager to adopt the system.

The positions are initially offered for 1 year, with possibility of renewal for 1 additional year. The start date can be September 2026, January 2027, or September 2027.

Responsibilities

• Collaborate with faculty members, PhD students, and our academic and industry partners
• Contribute to research spanning systems, cryptography, data analytics, and machine learning
• Design and implement cryptographic protocols and full-stack software solutions
• Mentor graduate and undergraduate students
• Participate in a vibrant, interdisciplinary research environment

Requirements

• PhD in Computer Science, Computer Engineering, or closely related field
• Experience with MPC, FHE, TEEs, or related technologies
• Excellent programming skills in one or more of the following languages: C++, Rust, or Go
• Strong academic record with publications and presentations at top-tier security and/or systems venues
• (Optional) Experience with open-source software development practices and/or contributions to open-source projects

Closing date for applications:

Contact: Interested candidates should email Vasia Kalavri ([email protected]), Mayank Varia ([email protected]), and John Liagouris ([email protected]) with a detailed CV and a 2-page research statement. Applications will be reviewed on a rolling basis starting August 15 and until the positions are filled.

Recent works have highlighted the risk of deterministic memory encryption, as used for example in AMD SEV. In the so-called ciphertext side-channel attack, an adversary leaks sensitive information, such as cryptographic keys, from an encrypted VM by observing changes in the encrypted contents of the memory. To date, countermeasures have been quite restricted in scope and have not addressed the root cause. Alternatively, some studies suggest adding freshness to memory encryption. However, this approach is considered impractical due to the performance overhead introduced by fetching such freshness values for every single memory access.

In this work, we propose an efficient approach for eliminating most of the overhead of fetching the aforementioned freshness. Our core idea is to repurpose the ECC memory area to efficiently store random nonces or counters. We propose a range of implementations with varying trade-offs between security guarantees and performance overhead, and demonstrate that we can achieve a solid baseline security even with small random nonces. By leaving a portion of ECC memory unused, we show that it is possible to efficiently integrate protection mechanisms such as memory integrity and memory tagging, while limiting the overall performance overhead to approximately 2%.

Private Function Evaluation (PFE) facilitates the secure computation of private functions on private inputs in an oblivious manner, ensuring that both the function and the inputs remain confidential throughout the entire computational process. PFE has garnered significant attention due to its critical applications in various domains, such as privacy-preserving healthcare systems and privacy-preserving credit checks, where safeguarding the confidentiality of the function itself is of paramount importance.

However, despite its broad applicability, existing PFE schemes often exhibit inefficiencies, even in relatively straightforward scenarios such as the evaluation of lookup tables. To mitigate these limitations, we propose a novel variant of PFE, termed Preprocessed Private Function Evaluation (PPFE), which leverages preprocessing techniques to significantly enhance the efficiency of online computations. Within this framework, we introduce a specialized construction tailored specifically for lookup table operations, achieving sublinear complexity during the online computation phase.

The efficacy of the proposed approach is demonstrated through experimental evaluations. For a lookup table of size $2^{24}$, the online computation time required to process a single query is about 3 milliseconds, representing a performance improvement of more than an order of magnitude compared to existing results. Furthermore, the proposed scheme exhibits strong scalability, effectively handling thousands of adaptive queries within the same framework.

The McEliece code-based cryptosystem, utilizing binary Goppa codes, is the earliest public-key encryption scheme that is still considered post-quantum secure. We present a simple, classical quasipolynomial-time distinguisher for Goppa--McEliece in the asymptotic "Classic McEliece" regime: for code length $n$, extension degree $m=\Theta(\log n)$, Goppa degree $t=\Theta(n/\log n)$, and public-code dimension $k=\Theta(n)$, the algorithm runs in time $n^{{\mathcal O}(\log n)}$ and distinguishes the McEliece public key from the uniform distribution over $\mathbb F_2^{k\times n}$ with advantage $1-o(1)$. The distinguisher is not merely asymptotic: it applies to all Classic McEliece parameter sets considered in the NIST process and yields improved (though not yet practical) concrete attack estimates.

Our distinguishing attack originated from a failed attempt to construct doubly efficient private information retrieval (PIR) protocols from algebraic locally decodable codes, and can be intuitively explained from the PIR perspective. We extend this provable algorithm to a heuristic $n^{{\mathcal O}(\log n)}$-time ciphertext-decryption attack that recovers the message from a noisy codeword.

Selfish mining undermines incentive compatibility of proof-of-work blockchains, letting a miner earn disproportionate rewards at a hashrate lower than the majority threshold. A decade of work has asked whether a strategy is profitable, however, far less is understood about when it becomes profitable. Timing is critical since selfish mining operates at a loss before it turns a profit, typically requiring tens of weeks to break even in the classic case.

In this paper, we present a holistic study of the time-to-profitability (TTP) of existing selfish mining strategies structured around four contributions. First, in the single-attacker setting, we characterize TTP across the full strategy space and find that TTP-minimizing and profit-maximizing strategies frequently diverge, making attack horizon a critical metric. In particular, under realistic fee dynamics, the use of incentive transactions to recruit honest-but-rational miners enable incentivized strategies to reach profitability up to $15\times$ faster than classic selfish mining at the same hash rate. Second, we explore TTP for the first time in the multi-attacker setting, showing that the difference in strategies between opposing attackers has a dramatic impact on joint-profitability lag. Third, we generalize intermittent selfish mining by exploring temporal composition over the full strategy space and show that its purported benefits are largely overstated. That is, alternating strategies rarely outperform the best static strategy in terms of either TTP or long-term profits. Finally, and building off our earlier findings, we explore adaptive, state-conditioned strategy selection at the difficulty adjustment period (DAP) level. We compare a general-purpose LLM agent against a fixed decision-tree selector, both implementing the same selection criteria. We find that both selectors reliably identify profit-maximizing strategies from observed network conditions, at a low operating cost, lowering the expertise barrier to exploiting adaptive selfish mining.

Lattice-based cryptography offers a promising direction for transitioning Bitcoin toward post-quantum security, serving as a secure replacement for currently deployed discrete logarithm signatures. The primary advantages of lattice-based signature schemes include the compact combined size of signatures and public keys (e.g., in some cases below 1.6 KB), the robustness of underlying security assumptions, and an algebraic structure that, while not yet yielding practical constructions, holds potential for advanced functionality such as threshold and multi-signatures, compared to hash-based constructions. In this paper, we present a self-contained review of three lattice-based signature schemes, with Bitcoin's post-quantum transition as the motivating application: Dilithium, Falcon, and Hawk. The latter was recently withdrawn from NIST standardization following a key-recovery attack; we retain it because its design paradigm remains of independent interest. For each protocol, we detail the high-level intuition, the necessary technical preliminaries, low-level mechanics, performance, and security analysis. We then assess the deployment aspects relevant to Bitcoin: the on-chain footprint, determined by the combined public-key and signature size and compared against hash-based alternatives; the target security level for outputs that may remain unspent for decades; implementation constraints, such as Falcon's floating-point signing; and wallet key derivation.

No prior exposure to lattice-based cryptography is assumed: all the required background is developed within the document.

Threshold Decyption (TD) enables a set of decryptors, each holding a secret key share, to collaboratively decrypt ciphertexts. Lots of TD schemes consider only CPA security under static corruptions, but a stronger and more reasonable security notion in practice is CCA security under adaptive corruptions, which enhances the ability of adversaries to obtain partial decryptions of chosen ciphertexts and adaptively corrupt decryptors during the protocol. There are many works on TD from lattices, seeking for post-quantum security. However, none of these TD schemes achieves both adaptive security (i.e., security under adaptive corruptions) and polynomially-bounded modulus in lattices. Given the fact that polynomial modulus provides more post-quantum confidence than super-poly modulus, Devevey et al. [PKC 2021] left constructing an adaptively secure TD with polynomial modulus from lattices as an open problem.

In this paper, we resolve the above open problem by proposing three adaptively secure (t,N)-TD schemes based on the LWE assumption, all with polynomial modulus under appropriate settings. - TD0: an adaptively CPA-secure scheme in the asynchronous setting in the standard model, whose modulus is polynomial for small number of users N. - TD1: an adaptively CCA-secure scheme in the asynchronous setting in the standard model, whose modulus is polynomial for small N and bounded decryption queries. - TD2: an adaptively CCA-secure scheme in the synchronous setting in the random oracle (RO) model, whose modulus is polynomial for bounded decryption queries.

The main technical challenge is to limit the leakage of secret key shares arising from decryption queries, while keeping the modulus a polynomial. To overcome this barrier, we develop a refined polynomial noise flooding technique based on a detailed min-entropy analysis of secret shares conditioned on linear matrix hints, leveraging recent advances on Matrix-Hint LWE. Based on our new technique, we build TD1 using the replicated secret sharing (RSS) scheme, hence supporting only small N. To enable larger N, we design TD2 using the Shamir secret sharing scheme, in which we further integrate our new technique with the zero-sum masking technique [Katsumata et al., CRYPTO 2024] to restrict the secret key leakage. To the best of our knowledge, our TD1 and TD2 are the first non-interactive lattice-based threshold decryption schemes achieving adaptive CCA security and polynomial modulus, simultaneously. Moreover, they achieve the strongest notion of adaptive CCA security among those compared in [Brzuska et al., PKC 2026]. We further establish robustness for both TD0 and TD1 via publicly verifiable partial decryptions, ensuring that the combination either outputs the correct plaintext or aborts.

In multi-epoch deployments, private set union~(PSU) operates in an adaptive-input loop: after observing the union at epoch $t$, the receiver may choose its next input for epoch $t+1$. Liu et al.~(EUROCRYPT 2026) formalized this multi-epoch adaptive-input setting for updatable private set intersection and provided an instantiation, but their framework does not extend to PSU. Meanwhile, existing PSU protocols are analyzed only in the single-shot setting. We present the first semi-honest, adaptive-input-secure updatable PSU protocol supporting two-sided add/delete updates in the multi-epoch adaptive-input setting of Liu et al. Our construction is built around a new primitive, the updatable oblivious key-value store (uOKVS). Its defining rule, distributional erasure, requires each refresh to be distributed identically to a fresh static encoding of the current key set, rather than merely indistinguishably. We realize uOKVS by combining the Band-OKVS of Bienstock et al. with a PRF under a persistent key. The resulting refresh reuses a cached factorization, so its per-epoch encoding cost scales linearly rather than quadratically in the band width $w$. Building on this layer, we obtain a multi-epoch PSU protocol whose leakage is limited to set and update cardinalities, even against adaptive-input adversaries. We implement the protocol and benchmark it in a single-threaded setting. At $n = 2^{20}$ with per-epoch updates $\Delta = 55$ over $10$ epochs, the online per-epoch wall-clock time is $1.41$ s on LAN, yielding a $30.9\times$--$98.9\times$ speedup over prior static PSU protocols re-executed from scratch at each epoch.

Event date: 6 May to 7 May 2027
Submission deadline: 30 November 2026
Notification: 11 January 2027

Event date: 16 September to 18 September 2026

HPI is recognized as one of the leading university institutes for computer science (www.hpi.de). Our goal is to strengthen Europe's digital sovereignty with excellent research and practice-oriented teaching in computer science. At HPI, we are convinced that excellence is created when knowledge from different disciplines is collaboratively combined to create responsible and pioneering solutions for the future.

In our research clusters "Systems," "Data and AI," "Foundations," "Digital Health," "Security," and "Business and Society" researchers from various disciplines work together on topics relevant to solving the challenges facing society. The Digital Engineering Faculty of the University of Potsdam and HPI offers a computer science engineering degree program that is unique in Germany.

In the course of its strong growth, the Hasso Plattner Institute is offering a PhD position in the research group Cybersecurity - High-Assurance Systems, led by Prof. Dr. Chitchanok Chuengsatiansup, which investigates mechanisms to safeguard our digital information with the focus on cryptographic engineering, side-channel analysis, implementation optimization, and post-quantum cryptography.

The application deadline is 20 September 2026.

For further information and how to apply, please visit:
https://jobs.plattnerfoundation.org/HPI/job/Potsdam-PhD-position-%28fmx%29-High-Assurance-Systems-14482/1362941055/

Closing date for applications:

Contact: Chitchanok Chuengsatiansup

More information: https://jobs.plattnerfoundation.org/HPI/job/Potsdam-PhD-position-%28fmx%29-High-Assurance-Systems-14482/1362941055/

We are looking for a PhD student to join the Crypto Team and Security Group at Chalmers with Christoph Egger as main supervisor. The position is fully funded for 5 years and comes with 20% teaching duties in the department. The Crypto Team currently has 2 faculty members, one Post-Doc and 4 PhD students and is embedded in the security group that captures a wide range of topics.

Depending on the interests of the applicant, possible research topics include fine-grained and bounded space cryptography, realization of idealized models, relationship between cryptographic notions, and similar topics in foundational cryptography. Alternatively, a focus on formal methods for Cryptography is possible. One or two extended research visits are encouraged during the doctoral study. Applicants should have a strong interest in the mathematical analysis of algorithms in general and cryptography in particular. A master's degree in mathematics, computer science, or a related discipline is required. The working language in the department is English, and applicants are expected to be fluent both in written and spoken English. Swedish courses are available for interested students.

Applications are due August 14 (or until filled)

Closing date for applications:

Contact: Christoph Egger: [email protected]

More information: https://www.chalmers.se/om-chalmers/arbeta-hos-oss/lediga-tjanster/?rmpage=apply&rmjob=15017

We are looking for outstanding PhD students and postdoctoral researchers to join the cryptography group led by Dr. Michael Reichle at INSAIT in Sofia, Bulgaria. INSAIT is already a top research institute in AI and Theory and you have the opportunity to help shape INSAIT into a world-class research institute for Cryptography and Security. Sofia offers great gastronomy, an affordable cost of living and quick access to nature, with many parks and Vitosha Mountain just outside the city.

Topics. Research areas include post-quantum cryptography, protocols for signatures and encryption, and zero-knowledge proofs. Applicants with interests in related areas of cryptography are also encouraged to apply.

PhD applicants. You should hold (or be close to completing) a Master's degree and have a strong background in cryptography, theoretical computer science, mathematics, or a related field. You will be co-supervised by Mariana Raykova under the Google PhD fellowship program.

Postdoctoral applicants. You should hold (or be close to completing) a PhD in a related field. A strong research record, ideally including publications at IACR conferences or leading security venues, is preferred.

The positions are well funded and come with no teaching obligations. The start date is flexible, with positions available from October 2026 onward. Applications will be considered on a rolling basis until the positions are filled.

Closing date for applications:

Contact: Please apply via https://insait.ai/information-security-and-cryptography. For questions, please contact Michael Reichle ([email protected]).

More information: https://insait.ai/information-security-and-cryptography

The Department of Computing at The Hong Kong Polytechnic University (PolyU) is offering multiple fully funded PhD positions in the broad area of cryptography and cybersecurity. Successful candidates will work with Dr. Yu Shen (https://shenyu-official.icu/) and conduct research in areas including, but not limited to:

• Blockchain security and privacy
• Distributed computing and consensus
• Secure multi-party computation, cryptographic protocols, and game theory
• Quantum cryptography

The PhD positions are fully funded for 3–4 years, with a competitive monthly stipend. Detailed information on scholarships and tuition fees is available at: https://www.polyu.edu.hk/cee/prospective-students/research-postgraduate-programme/scholarships-and-tuition-fee/

Eligibility Requirements

Applicants should have:

• A strong background in cryptography, cybersecurity, theoretical computer science, or related areas; and
• Fulfilled the general PhD admission requirements of PolyU:
https://www.polyu.edu.hk/study/pg/research-postgraduate

Application Procedure

Interested candidates are invited to send the following materials to Dr. Yu Shen at [email protected]:

• Curriculum vitae (CV)
• Academic transcripts
• A brief statement describing research interests and relevant experience

Applications will be reviewed on a rolling basis until the positions are filled. We welcome highly motivated candidates with a strong interest in advancing the foundations and applications of modern cryptography to apply.

Closing date for applications:

Contact: Yu Shen ([email protected])

Luxium AG in Zug, Switzerland is building a new Layer 1 blockchain from first principles, with a post quantum cryptographic core rather than a retrofit of classical primitives. We seek a full time Chief Blockchain Architect to own the protocol design and its long term technical direction. The work opens with an architecture phase: set the protocol foundations and write the specification the engineering team builds against then lead the technical organization, working directly with the founders. Two main elements are specific to this system, an on chain price formation mechanism inside the protocol, and Luxium Nation, a global network with governance and payment layers on the same token. Scope Design the core architecture: consensus, validator model, network layer, state model and execution environment. Select and justify the cryptographic primitives, including signatures, hashes, commitments and key management, with attention to quantum resistance and migration paths. State and defend the security model: adversary and network assumptions, safety and liveness arguments, and the trade offs between scalability, security and decentralization. Produce rigorous specifications and identify technical risk. We want depth in distributed systems, consensus and their cryptography, the ability to architect from first principles rather than assemble components, and strong technical writing. Valued: prior Layer 1 design or production consensus work; publications in cryptology or distributed computing; open source contributions; post quantum constructions; systems level implementation (Rust, Go, C++ or comparable). Relocation to Zug is required and fully supported. If that is not possible for you, say so and we will discuss it. Compensation is negotiated individually and may combine salary, incentives, equity and token participation. Aprox range 210,000chf - 310,000chf Apply to [email protected] with a CV and links to relevant work, publications or repositories and feel free to ask any questions .

Closing date for applications:

Contact: Daniel Gagnidze

More information: https://www.jobs.ch/en/vacancies/detail/f7defdb8-bc1e-4fe0-9c00-d1b2d358e4e8/

Grinding is a technique which introduces a proof of work into the Fiat-Shamir transform: by constraining the challenge to satisfy a $w$-bit condition, forging a proof requires about $2^w/\varepsilon$ evaluations of the hash function instead of $1/\varepsilon$, where $\varepsilon$ is the soundness error of the underlying protocol. This allows one to select reduced parameters, yielding shorter proofs and signatures. Grinding is used in FAEST, MQOM and SDitH, the three MPC-in-the-Head schemes selected for the third round of the NIST additional post-quantum signature standardization process, where it is instantiated with Keccak. In this short paper, we investigate grinding schemes in which the proof of work is expressed in terms of block cipher computations, specifically AES, which is significantly faster than Keccak on modern CPUs, is already a building block of these schemes, and underlies the very definition of the NIST security categories. We formalize the notion of grinding scheme together with a protocol-agnostic security notion, we propose a construction performing two cipher calls per iteration, and we prove, in the ideal cipher and random oracle models, that an adversary making $Q_E$ cipher queries breaks it with probability at most $\frac{4}{3} \cdot \varepsilon\, Q_E / 2^w$, up to negligible terms. We further generalize the scheme to use more cipher calls per iteration, which makes the constant $\frac43$ tend to $1$.

We present a formally verified implementation of the ML-KEM Number-Theoretic Transform (NTT) based on Plantard arithmetic, produced via a code generator that targets ML-KEM, ML-DSA, and FN-DSA from a single parameter triple. The generator embeds a static bound analyzer that places modular reductions at code-generation time without runtime branching, eliminating per-scheme manual tuning while preserving constant-time guarantees. Each generation produces structurally identical implementations in two backends: portable C, and Jasmin for formal verification. To establish end-to-end correctness, we contribute a parametric formalization of Plantard arithmetic in \textsc{EasyCrypt} and a layer-by-layer program-equivalence proof connecting the extracted Jasmin ML-KEM NTT to the abstract specification of formosa-mlkem; the existing algebraic chain is reused unchanged to extend correctness down to the mathematical NTT definition. Benchmarks across three schemes show that the generated code outperforms reference C by $1.5\times$--$1.8\times$ on the forward NTT and $1.7\times$--$2.5\times$ on the inverse, and outperforms the formally verified formosa-mlkem Jasmin baseline by $1.26\times$ and $2.19\times$ on ML-KEM. We believe our techniques generalize to other lattice-arithmetic primitives requiring both performance and formal verification.

Levin and Pedersen proposed at Asiacrypt2025 a new verifiable random function (VRF) based on a CGL-analogue hash function constructed from radical isogenies. Their construction applies the same secret radical-CGL walk to a public starting curve and a message-dependent curve, and uses an R1CS proof relation to show that the two walks use the same secret key.

We present a two-stage attack on this construction. The first stage concerns the unspecified representation of the public key. The reported key size indicates that the public curve is stored as a \(j\)-invariant, whereas both the specified radical-CGL computation use two coefficients to represent a curve. By exploiting this form we can produce two different VRF outputs under the same public key and message, breaking the unique provability. Hence, the output of the radical-CGL computation must follow the specification.

In the second stage, we exploit these coefficients to recover the VRF secret key. With \(1536\) queries, our implementation recovers the complete \(256\)-bit secret in 30 minutes, thereby breaking residual pseudorandomness. Interestingly, we also observe that the using public key alone without queries can sometimes reveal one or two bits of the secret walk.

Besides, we extend Lai's observation to obtain a one-query attack on the group-action-based VRF proposed in the same paper with advantage closed to 1/2. Together, these constitute three attacks on their work.

We perform the first formal security analysis of the cryptographic core of Olvid, an end-to-end encrypted messaging app notably used by French government officials, including ministers. Despite its deployment in sensitive contexts and its role in critical communications infrastructure, Olvid's cryptographic security has received little independent analysis. To address this gap, we develop detailed models of Olvid's authenticated key exchange and continuous key agreement protocols. We formally verify that our protocol models achieve security properties such as mutual authentication, session-key secrecy, forward secrecy, and replay protection, under an active Dolev-Yao network adversary model that can compromise parties. While we constructively prove that the protocol design meets core security guarantees, our analysis also reveals that, contrary to its claims, the protocol does not meet strong modern security properties that are met by other state-of-the-art secure-messaging protocols, such as Signal. For example, we show in our formal analysis that Olvid is not secure in modern security models such as eCK. Along the way, we uncover a potential timing leakage, and discuss Olvid's anonymity claims.

Motivated by the 2026 COLDCARD incident, this paper studies cryptographic asset recovery after self-custodial seed-generation failures. Self-custodial hardware wallets depend on secure entropy sources for seed generation. If an RNG implementation or design failure reduces seed entropy, an adversary may reconstruct wallet signing keys through offline search. Such weaknesses may also be discovered long after wallet creation, placing existing self-custodial assets at risk. To prevent large-scale exploitation after such a failure is identified, a hardware manufacturer or security response team may perform a protective sweep of affected assets into a protected recovery treasury. Asset redistribution then creates a fundamental authentication problem: once the signing key can be reconstructed by both the legitimate owner and an adversary, possession of that key no longer uniquely identifies the legitimate controller. We propose Z-SCAPE, a zero-knowledge recovery-credential protocol for privacy-preserving asset recovery after seed-generation failures and protective sweeps. Before compromise, the user commits to a recovery credential consisting of an independently generated 256-bit recovery secret $r$ and an RNG-independent personal record $P$. After an incident, the prover proves knowledge of $(P,r)$ in zero knowledge while binding the proof to the incident, a fresh verifier nonce, an expiry value and a fresh destination address. The protocol enables recovery claims without revealing $P$, $r$ or the compromised wallet private keys, while preventing replay and destination substitution. Z-SCAPE provides concrete integration mechanisms for Bitcoin and Ethereum and enables protected assets to be returned only to the fresh destination bound to an accepted recovery proof.