From Newsgroup: sci.crypt

## In this issue
1. [2026/284] Knowledge Soundness of Polynomial Commitments in ...
2. [2026/752] GlitchSnipe: Toward Localized Voltage Fault Attacks
3. [2026/1184] Public-Key Pseudorandom Codes from Distorted ...
4. [2026/1360] A Prototype-Based Study of Zero-Knowledge Proof ...
5. [2026/1367] SoK: Hash-Based Polynomial Commitments and Low- ...
6. [2026/1368] SDDT: An Operation Skip Attack Framework for ...
7. [2026/1369] Algebraic Modelings of the Supersingular Isogeny ...
8. [2026/1370] smklhs: Succinct Multi key Linearly Homomorphic ...
9. [2026/1371] The Small-Field Turn in Succinct Proofs: A ...
10. [2026/1372] Retrieve-Compute PIR and Its Applications
11. [2026/1373] Formalizing Privacy of Anonymous Credentials: A ...
12. [2026/1374] Analysing the Post-Quantum Security of S/MIME
13. [2026/1375] MPC with Weighted and Fluid Participation
14. [2026/1376] Secure and Efficient Federated Learning with ...
15. [2026/1377] HAWK ``Guessing Game'' is not Polynomial-Time
16. [2026/1378] (R)Icy-DVRF: A Robust Distributed Verifiable Random ...
17. [2026/1379] Hierarchical Structure in Attribute-Based Inner- ...
18. [2026/1380] TIM: A Sensitive-Parameter-Privacy Blind ...
19. [2026/1381] PriFT: Private Fine-Tuning using off-the-shelf MPC ...
20. [2026/1382] Concrete Bit-Operation Cost of XL: For Solving ...
21. [2026/1383] Notes on the ideal arithmetic correlations of ...
22. [2026/1384] Lower Bounds for PIR with Preprocessing from ...
23. [2026/1385] Walsh LUT Evaluation on Lazy Bits for CKKS AES ...
24. [2026/1386] Key-Recovery Attacks on TALUS: A Cryptanalytic Note
25. [2026/1387] ZK-Audit: Proving Power Side-Channel Resilience in ...
26. [2026/1388] Chimera: A Hybrid GPU Backend for Sumcheck ...
27. [2026/1389] SC-DT: Scalable Constant Round Secure Comparison ...
28. [2026/1390] A Separation Principle for Lookup-Based zkML: ...
29. [2026/1391] 6G Sensing Security: Distributed Game-Theoretic RL ...
30. [2026/1392] Slicing Boolean Functions with Inner Products
31. [2026/1393] On the Differential Uniformity of Polynomials over ...
32. [2026/1394] Adaptor Signatures Meet BLS: Enabling Efficient ...
33. [2026/1395] Blind Trace-Only Segmentation of Cipher ...
34. [2026/1396] Reliable TRNG and its Challenges
35. [2026/1397] HANNS: Low-Storage Non-Interactive Approximate ...
36. [2026/1398] How to Encrypt with Random Reversible Circuits
37. [2026/1399] CHIP: Efficient Homomorphic Encryption-Based CNN ...
38. [2026/1400] What Happens When integrating Modulus Switching and ...
39. [2026/1401] A New Framework for Efficient Multivariate ...
40. [2026/1402] On Extending Integral Distinguishers
41. [2026/1403] A polynomial-time key recovery attack of Facto-DSA
## 2026/284
* Title: Knowledge Soundness of Polynomial Commitments in the Algebraic Group Model Does Not Guarantee Extractability
* Authors: Petr Chmel, Pavel Hub|i-iek, Dominik Stejskal
* [Permalink](https://eprint.iacr.org/2026/284)
* [Download](https://eprint.iacr.org/2026/284.pdf)
### Abstract
The Algebraic Group Model (AGM) has become a standard framework for analyzing the knowledge soundness of group-based polynomial commitment schemes. In this work, we formally establish inherent limitations of this methodology. We isolate a structural property satisfied by essentially all practical group-based polynomial commitments, which we term AGM-clarity. We prove that for AGM-clear schemes, evaluation binding implies knowledge soundness in the AGM. This collapse reveals that the AGM definition of knowledge soundness does not capture a distinct security property, but is merely a structural consequence of evaluation binding.
To precisely characterize the guarantees on extractability provided by the AGM, we introduce Weak Interpolation Knowledge Soundness (WIKS) in the standard model, which is an extreme relaxation of extractability. We show that WIKS is implied by standard evaluation binding and prove that, for AGM-clear schemes, knowledge soundness in the AGM is equivalent to WIKS. We further reformulate WIKS as Correct-Interpolation Binding and use this binding-style characterization to establish that, for binding polynomial commitments, special soundness is strictly stronger than WIKS. Together, these results calibrate AGM knowledge soundness for practical polynomial commitment schemes against two standard-model notions: for AGM-clear schemes, it is already implied by evaluation binding, while for binding schemes, it remains strictly weaker than special soundness. In particular, AGM proofs of knowledge soundness do not certify "knowledge" in the sense of immediate extractability.
## 2026/752
* Title: GlitchSnipe: Toward Localized Voltage Fault Attacks
* Authors: Fatemeh Khojasteh Dana, Saleh Khalaj Monfared, Hamed Okhravi, Shahin Tajik
* [Permalink](https://eprint.iacr.org/2026/752)
* [Download](https://eprint.iacr.org/2026/752.pdf)
### Abstract
Voltage glitching is one of the most prominent fault injection techniques due to its effectiveness and simplicity. Although it is generally regarded as a spatially global fault method, in which the injected glitch uniformly affects all circuits on the die, several studies have observed that specific locations may be affected more than others. To characterize this phenomenon, we draw inspiration from methods used in electromagnetic interference (EMI) analysis. In this paper, we demonstrate that voltage attacks can be modeled as the transfer of conducted electromagnetic energy through the power delivery network (PDN) to the chiprCOs die. By analyzing voltage glitches in the frequency domain and modeling the PDN as a communication channel, we demonstrate that different frequency components of an injected glitch signal propagate through the network in distinct patterns. In this context, we further show that modulating the supply voltage with a single-frequency sinusoidal signal, rather than injecting a pulse-shaped glitch, enables an adversary to influence transistors in specific regions of the chip and thus induce localized faults. To validate these claims, we first propose a post-silicon profiling framework that identifies the frequency bands in which the systemrCOs PDN is most vulnerable and maps the spatial regions of the chip affected by each frequency component. To this end, we perform extensive profiling on several FPGAs using distributed time-to-digital converters (TDCs) to measure the impact of injected signals across a range of frequencies. As a proof-of-concept, we also demonstrate successful localized voltage attacks on simple FSMs and AES-128 implementations with various placements, to further show the sensitivity of chip locations to injected energy at different frequencies. Our results reveal that even minor changes in design placement can significantly affect a circuitrCOs susceptibility to voltage-based fault attacks, either weakening or strengthening its resilience.
## 2026/1184
* Title: Public-Key Pseudorandom Codes from Distorted McEliece Assumptions
* Authors: Victor Dyseryn, Danilo Francati, Daniele Venturi
* [Permalink](https://eprint.iacr.org/2026/1184)
* [Download](https://eprint.iacr.org/2026/1184.pdf)
### Abstract
Pseudorandom codes (PRCs), introduced at Crypto 2024 by Christ and Gunn, are encryption schemes with pseudorandom ciphertexts and error-correction guarantees. PRCs are useful as a tool to obtain watermarking for generative models, in particular ensuring that a watermark is hard to remove against an attacker that can modify up to a given fraction of the watermarked output (a.k.a. the robustness property). A PRC is public-key if the encoding procedure is public (whereas detection requires the corresponding secret key).
In this paper, we provide the first construction of public-key PRCs for the binary alphabet satisfying robustness in the presence of a constant fraction of substitutions ($1/6 - \varepsilon$, for arbitrary $\varepsilon > 0$) and at the same time achieving pseudorandomness against sub-exponential-time distinguishers. The pseudorandomness property relies on a new family of distorted McEliece assumptions that we introduce, instantiated with a class of expanded subcodes of Reed-Solomon codes, called Raw Reed-Solomon codes, for which we provide heuristic evidence of (plausible) sub-exponential hardness.
Our construction is obtained by revisiting the original blueprint by Christ and Gunn to obtain public-key PRCs based on McEliece assumptions. Along the way, we also uncover that their blueprint does not work directly with Raw Reed-Solomon codes. In particular, we show that a generating matrix of a permuted Raw Reed-Solomon code is distinguishable in polynomial time from a uniformly random generating matrix. To circumvent that difficulty, we propose to distort the public key by multiplication with a sparse invertible matrix of constant row Hamming weight.
## 2026/1360
* Title: A Prototype-Based Study of Zero-Knowledge Proof Verification for Privacy-Preserving Blockchain Interoperability
* Authors: Chilume O. Gabriel, Hlomani B. Hlomani, Kabo Nkabiti
* [Permalink](https://eprint.iacr.org/2026/1360)
* [Download](https://eprint.iacr.org/2026/1360.pdf)
### Abstract
Blockchain networks need to exchange messages and assets across independent systems, but cross-chain verification can expose private validation data to relayers, bridge logic, validators, or destination-chain components. This paper presents a prototype-based zero-knowledge verification layer for privacy-preserving blockchain interoperability. The prototype uses Circom and SnarkJS to generate Groth16 proofs, verifies those proofs in Rust using arkworks BN254, and maps the result into a Substrate-style interoperability decision model. The work addresses a practical implementation gap between common zero-knowledge proof tools and Rust-based blockchain interoperability environments. Private values stay off-chain, while only the proof, public commitment, verification metadata, and final decision are passed to the runtime-facing layer. The prototype includes valid-proof acceptance, tampered-input rejection, runtime-compatible verification records, and a simulated interoperability decision layer. Experimental results show proof generation at 199 ms, SnarkJS valid-proof verification at 161 ms, tampered-input rejection at 160 ms, and Rust verifier execution at 340 ms. These results show that a SnarkJS-generated Groth16 proof can be verified in Rust and used to control whether a simulated cross-chain action is accepted or rejected. The current scope does not include a full FRAME pallet or live Cross-Consensus Messaging (XCM) dispatch. In Polkadot, XCM is the message format used to send instructions between different chains. The prototype is not intended to replace Polkadot's existing parachain auditing mechanisms. Instead, it explores a complementary privacy-preserving verification path for selected interoperability conditions where private inputs should not be exposed. The prototype provides a repeatable technical path for building privacy-preserving verification in Polkadot/Substrate-style interoperability workflows.
## 2026/1367
* Title: SoK: Hash-Based Polynomial Commitments and Low-Degree Tests: From FRI to Basefold, STIR, and WHIR
* Authors: Christos Skatharoudis
* [Permalink](https://eprint.iacr.org/2026/1367)
* [Download](https://eprint.iacr.org/2026/1367.pdf)
### Abstract
Hash-based low-degree tests and polynomial commitment schemes have become the cryptographic engine of a large fraction of deployed succinct-argument systems. Unlike pairing-based commitments such as KZG, they require no trusted setup, rely only on a collision-resistant hash, are plausibly post-quantum, and operate over any sufficiently large field, unlocking small fields whose arithmetic is fast on commodity hardware. Between 2017 and 2025 this design space evolved rapidly along two intertwined lineages: the Reed-Solomon proximity-test line (FRI, DEEP-FRI, STIR, WHIR) and the linear-code tensor-commitment line (Ligero, Brakedown), which Basefold and WHIR ultimately merge. Yet the primary sources report their guarantees under different, and frequently conflated, soundness regimes: unique decoding, the Johnson list-decoding bound, and (conjecturally) capacity. The folklore surrounding these schemes has drifted from what the papers actually prove.
We systematize this line of work. We organize the seven core schemes along a taxonomy of committed object, code class, and testing mechanism; we trace the evolutionary chain in which each scheme answers a concrete limitation of its predecessor; and we ground the theory in a survey of production zero-knowledge systems, showing how field choice and soundness regime jointly explain real engineering decisions, including a sumcheck-based multilinear prover reaching mainnet in 2026. We make two systematizing corrections. First, the DEEP folklore: the out-of-domain trick that survives in deployment (DEEP-ALI, on the constraint side) is distinct from the low-degree-test modification it is usually conflated with. That modification was superseded for FRI soundness by the Proximity Gaps analysis, which also proves Johnson-bound FRI soundness and is itself routinely misattributed to the original FRI paper. Second, and more consequential: the capacity-soundness conjectures on which nearly all deployed systems set their parameters had their strongest, up-to-capacity forms, including the mutual-correlated-agreement conjecture behind the newest schemes, disproved over large fields in late 2025. Soundness up to the Johnson bound is unaffected and the practical repricing is modest, but the discount the ecosystem had tacitly taken was, in its optimistic form, wrong. Our central thesis is that this proven-versus-conjectured soundness axis, not asymptotic query complexity, is the load-bearing and least-consistently-reported dimension of the design space, and the field has now had to reprice it.
## 2026/1368
* Title: SDDT: An Operation Skip Attack Framework for Bitslice CiphersrCoValidated on PIPO
* Authors: Dongwoo Kang, Hanbeom Shin, DongHyeon Kim, Seokhie Hong, HeeSeok Kim * [Permalink](https://eprint.iacr.org/2026/1368)
* [Download](https://eprint.iacr.org/2026/1368.pdf)
### Abstract
Bitslice implementations are widely adopted in lightweight
cryptography (LWC) due to their efficiency and inherent resilience to side-channel attacks. However, this paper reveals that their decomposition of the S-box exposes critical vulnerabilities to the operation skip
fault model. Unlike data corruption faults suffering from high-entropy diffusion, we identify that skipping bitwise operations induces strongly restricted differential patterns. To exploit this characteristic, we propose the Skip-induced Difference Distribution Table (SDDT), a framework mapping operation omissions to output differences. We validate
this approach on the block cipher PIPO through practical experiments, successfully recovering the master key from deeper rounds with fewer
faults than previously possible. Our findings underscore the fragility of bitslice designs against precise operation skip faults.
## 2026/1369
* Title: Algebraic Modelings of the Supersingular Isogeny Problem
* Authors: Alessio Caminata, Andrea Sanguineti, Silvia Sconza
* [Permalink](https://eprint.iacr.org/2026/1369)
* [Download](https://eprint.iacr.org/2026/1369.pdf)
### Abstract
We present a new algebraic modeling of the Supersingular Isogeny Problem as a system of multivariate polynomial equations, in the case where the elliptic curves are connected by an isogeny whose degree is a power of $2$ or $3$. This modeling relies on Renes formulas for elliptic curves in Montgomery form (degree $2$) or triangular form (degree $3$). We investigate several algebraic properties of these systems: we prove that they are zero-dimensional, compute the dimension of their highest degree part, and show that they are not in generic coordinates. Experimental results show that solving these systems via Gr||bner basis techniques is significantly faster than solving the algebraic modeling with modular polynomials.
## 2026/1370
* Title: smklhs: Succinct Multi key Linearly Homomorphic Signatures for Certified Statistics
* Authors: Diego F. Aranha, Cecilia Boschini, Hanna Ek, Elena Pagnin
* [Permalink](https://eprint.iacr.org/2026/1370)
* [Download](https://eprint.iacr.org/2026/1370.pdf)
### Abstract
We study the problem of certifying statistical claims over datasets contributed by multiple independent sources. In this setting, an untrusted server aggregates signed data records and publishes claims such as sums, averages, or rates, while any third party can verify that these claims are correct with respect to the authenticated input data, without needing access to the underlying records. A central challenge is to achieve public verifiability without requiring trust in the aggregator, while keeping both the proof size and the verification cost small enough for practical deployment. This problem is motivated by applications in which reliable and scalable certification of published statistics is essential, including official health and demographic reporting.
In this work, we present smklhs, a multi-key linearly homomorphic signature scheme for this setting. Compared to the state of the art, smklhs is the first practical construction to enjoy evaluated signatures of size logarithmic in the number of distinct signers involved in the computation, and else independent on the total number of input messages. We prove smklhs secure against fully adaptive adversaries in the random oracle and algebraic group models, under well-studied hardness assumptions in bilinear groups.
We implement our scheme using the high-performance pairing library RELIC and compare it with prior work. To demonstrate practicality, we consider a case study on authenticated mortality statistics related to the impact of COVID-19 in Spain. At the 128-bit security level, our experiments show that an authenticated claim covering a 180-day nationwide dataset with over 300,000 signed records generated by 190 distinct signers can be verified in approximately 22 seconds on a commodity desktop machine. These results indicate that our approach is fast, lightweight, and practical for real-world deployment.
## 2026/1371
* Title: The Small-Field Turn in Succinct Proofs: A Systematization of Finite-Field Choice in Modern SNARKs and STARKs
* Authors: Christos Skatharoudis
* [Permalink](https://eprint.iacr.org/2026/1371)
* [Download](https://eprint.iacr.org/2026/1371.pdf)
### Abstract
Over the past half-decade, transparent succinct arguments have migrated off the 256-bit scalar fields of pairing-friendly elliptic curves and onto small fields: the 64-bit Goldilocks prime, the 31-bit primes BabyBear and KoalaBear, the Mersenne prime 2-|-|reA1 reached through the circle construction, and binary tower fields down to Free. We call this movement the "small-field turn" and systematize it with the finite field, rather than the proof system or the virtual machine, as the unit of analysis. We organize the fields in use by the structural properties that drive their selection: machine-word fit, two-adicity, reduction cost, and the S-box automorphism structure exploited by algebraic hashes; and we show how each is realized in a production prover (Plonky2, Plonky3, Stwo, Binius, and their descendants). We then assemble, across systems that state it only individually, the relationship between base-field width and the extension degree that FiatrCoShamir soundness requires, and we set that relationship against the measured gap between conjectured and provable soundness for non-interactive FRI. Finally, we separate the peer-reviewed results on embedding and arithmetization overhead from the vendor benchmarks that dominate the topic, and identify the controlled cross-field comparison whose absence is the area's sharpest empirical gap. No prior work takes field choice as its organizing object across this design space; the nearest systematization treats it as one dimension among many within a zero-knowledge virtual machine taxonomy. We frame the turn as the exploration of a single trade, cheaper arithmetic against repurchased soundness and simulated non-native operations, and argue from the provenance of the fields where the frontier is likely to move next.
## 2026/1372
* Title: Retrieve-Compute PIR and Its Applications
* Authors: Benny Applebaum, Shahar Shechter
* [Permalink](https://eprint.iacr.org/2026/1372)
* [Download](https://eprint.iacr.org/2026/1372.pdf)
### Abstract
Two-server Private Information Retrieval achieves arbitrarily small
polynomial communication, but relies on a strong non-collusion assumption that is difficult to justify in practice.
We introduce a new variant of two-server PIR in which one server acts as a standard \emph{compute} server, while the other is a restricted \emph{retrieval-only} server. The latter stores a public encoding of the database and merely serves requested symbols or blocks of this encoding, without performing any PIR-specific computation. We argue that such a retrieval-only server can be instantiated using existing static-content or repository-hosting services, thereby grounding the
non-collusion assumption in realistic architectural and deployment constraints. Assuming Learning Parity with Noise (LPN) over the ternary field with inverse-polynomial noise rate, we construct RC-PIR with arbitrarily small polynomial communication and polynomial storage. Leveraging this construction, we derive the following unexpected applications for every constant \(k\): \begin{enumerate}
\item \(k\)-server PIR with arbitrarily small polynomial communication and privacy against any coalition of \(k-1\) servers.
\item \(k\)-server robust PIR with arbitrarily small polynomial communication that simultaneously achieves correctness and privacy with respect to an arbitrary monotone access structure \(\mathcal{A}\). Namely, correctness is guaranteed whenever the set of online servers \(S\) satisfies
\(S \in \mathcal{A}\), while privacy holds against every coalition
\(S \notin \mathcal{A}\).
\item A \(k\)-party secure computation protocol for size-\(n\) truth tables also known as lookup tables, with arbitrarily small polynomial communication and passive security against any coalition of \(k-1\) parties. This result extends to active security either in the honest-majority setting, or without an honest majority assuming collision-resistant hash functions.
\end{enumerate}
None of these results were previously known under the LPN assumption. Along
the way, we uncover new relationships between different complexity measures of PIR.
## 2026/1373
* Title: Formalizing Privacy of Anonymous Credentials: A Provably Secure Framework with Predicate Proofs
* Authors: Yu Zhang, Zongbin Wang, Jian Hou
* [Permalink](https://eprint.iacr.org/2026/1373)
* [Download](https://eprint.iacr.org/2026/1373.pdf)
### Abstract
Anonymous credentials enable privacy-preserving authentication but existing systems either lack support for predicate proofs or are tied to specific signature schemes without a formal framework. We propose the first constructive framework for anonymous credentials with native predicate proof support. The framework provides definitions of entities, operations, adversary models, and security propertiesrCounforgeability, unlinkability, and minimal disclosure. To demonstrate its feasibility, we instantiate the framework with BBS signatures, Pedersen commitments, and ring signature based proofs. The instantiation yields compact credentials and efficient zero-knowledge predicate proofs. We prove that the instantiation satisfies all security properties under standard assumptions (q-SDH, discrete logarithm, and the zero-knowledge of the ring signature based proof). A performance evaluation confirms that credential issuance, verification, and predicate prove/verify are practical on standard hardware, with compact credentials and proofs whose communication cost grows modestly with the number and encoding length of proved attributes, and favorable runtime and storage relative to a CL-based baseline. Our framework provides a modular foundation for designing and analyzing anonymous credential systems with fine-grained attribute disclosure.
## 2026/1374
* Title: Analysing the Post-Quantum Security of S/MIME
* Authors: Sayan Das, Anupam Chattopadhyay
* [Permalink](https://eprint.iacr.org/2026/1374)
* [Download](https://eprint.iacr.org/2026/1374.pdf)
### Abstract
Secure/Multipurpose Internet Mail Extensions (S/MIME) is a standards-based mechanism for certificate-backed email signing and encryption. Its post-quantum migration is now technically actionable: ML-KEM public keys can be represented in X.509 certificates, and CMS can carry ML-KEM recipient information through \texttt{KEMRecipientInfo}. These standards solve an encoding problem, but they do not by themselves solve an assurance problem. A mailbox may possess a post-quantum-capable certificate while a generated CMS \texttt{EnvelopedData} object still protects the content-encryption key (CEK) through RSA or elliptic-curve key management; a multi-recipient message may mix ML-KEM and classical recipient paths for the same CEK; and archived mail may remain protected only by quantum-vulnerable mechanisms.This paper studies this assurance gap by shifting the unit of analysis from certificates to encrypted messages. We model encrypted S/MIME as a multi-recipient CMS object with certificate-bound paths to a shared CEK and show that post-quantum confidentiality is a universal message-level property: every valid path to the CEK must satisfy the active migration policy. Consequently, the presence of one ML-KEM recipient path is insufficient if another valid classical path can recover the same CEK. We then present \texttt{SMIME-PQCheck}, a standards-driven validation framework that combines X.509 profile checks, CMS recipient-structure analysis, policy-driven hybrid handling, and archive-level risk aggregation. The framework classifies S/MIME objects as \texttt{pqc-protected}, \texttt{hybrid-protected}, \texttt{classical-only}, \texttt{unsafe-mixed-mode}, \texttt{invalid}, or \texttt{unknown}. The result is a practical assurance layer for organizations migrating S/MIME deployments from certificate-level PQC readiness to auditable message-level protection.
## 2026/1375
* Title: MPC with Weighted and Fluid Participation
* Authors: Ghada Almashaqbeh, Sumedh Ghude
* [Permalink](https://eprint.iacr.org/2026/1375)
* [Download](https://eprint.iacr.org/2026/1375.pdf)
### Abstract
Most existing multiparty computation (MPC) protocols assume static and equal participation. All computing parties can dedicate resources and stay online for the entire computation, and they have equal influence on computation correctness and security (i.e., they are equally hard to corrupt). Supporting dynamic participation, so parties can join/leave at will, and associating weights to these parties reflecting their trust level, are essential to enable MPC in contemporary emerging applications. Existing solutions addressed these issues separately at varying security levels, and attempting to combine them while addressing malicious security raises several challenges and open questions.
In this paper, we close this gap and develop maliciously-secure MPC protocols that support weighted participation in both static and dynamic (or fluid) settings. In particular, we extend prior work on weighted ramp secret sharing (WRSS) to support verifiability and proactivity, which could be of independent interest. Then, we show how to perform arithmetic operations over weighted shares in a verifiable way, thus enabling maliciously-secure weighted MPC with guaranteed output delivery under static participation. Utilizing the proactivity feature of our secret sharing scheme, we develop a state handover protocol and employ it to support dynamic participation in committee-based MPC with the same security guarantees. Both protocols are synchronous and assume honest majority. To the best of our knowledge, our work is the first to support both weighted and dynamic participation in MPC.
## 2026/1376
* Title: Secure and Efficient Federated Learning with Adaptive Differential Privacy and Verifiable Homomorphic Aggregation
* Authors: Mohaddese Seyedi, Farhad Rahmati, Zahra Seyedi
* [Permalink](https://eprint.iacr.org/2026/1376)
* [Download](https://eprint.iacr.org/2026/1376.pdf)
### Abstract
Federated Learning (FL) enables collaborative model training without centralizing raw data, but remains vulnerable to gradient inference attacks, malicious aggregation servers, and communication inefficiencies. Existing cryptographic secure aggregation schemes provide confidentiality and verifiability yet lack formal statistical privacy guarantees, while most differential privacy (DP)-based approaches rely on fixed noise injection, resulting in suboptimal privacy--utility tradeoffs.
This paper proposes HEAD-FL, a secure and efficient federated learning framework that integrates adaptive differential privacy with verifiable homomorphic aggregation. The proposed scheme introduces a round-adaptive Gaussian perturbation mechanism analyzed under the R|-nyi Differential Privacy (RDP) framework, enabling tight cumulative privacy accounting and explicit conversion to $(\varepsilon, \delta)$-DP guarantees. By adopting Federated Averaging (FedAvg) instead of gradient-based aggregation, the framework significantly reduces communication overhead while preserving confidentiality, verifiability, and robustness to client dropouts.
Theoretical analysis and experimental evaluation demonstrate that HEAD-FLachieves improved privacy--utility tradeoffs and enhanced communication efficiency compared with fixed-noise and gradient-based secure aggregation methods, making it suitable for deployment in privacy-sensitive and bandwidth-constrained environments.
## 2026/1377
* Title: HAWK ``Guessing Game'' is not Polynomial-Time
* Authors: Markku-Juhani O. Saarinen
* [Permalink](https://eprint.iacr.org/2026/1377)
* [Download](https://eprint.iacr.org/2026/1377.pdf)
### Abstract
We show that the runtime complexity of the attack described in \emph{``Cryptanalysis of HAWK: a Guessing Game''} is much higher than originally claimed by its authors, and the attack is unlikely to pose a threat to HAWK's security in its present form.
The attack algorithm had not been implemented before this work; the polynomial-time running-time claim was based on four ``plausible heuristics''. Our experiments and implementation data point to a super-polynomial class-number obstruction, consistent with exponential-scale growth. The experiments also helped to identify faulty ``Heuristic 4'' as the source of the observed computational wall when scaling dimension $n$. The authors of Guessing Game have acknowledged our findings. To make the argument more universal, we also offer a machine-checked conditional reduction from explicit assumptions that shows the complexity to be at least super-polynomial.
In terms of methodology, our work demonstrates the role of powerful AI tools in contemporary cryptanalysis -- the sudden feasibility of rapid exploration and trial implementation of advanced attack techniques. A public research artifact contains all source code and datasets to reproduce our results.
## 2026/1378
* Title: (R)Icy-DVRF: A Robust Distributed Verifiable Random Function based on ROAST signatures
* Authors: Ahmet Ramazan A-f-#rta+f, O-fuz Yayla, Melis Ber|oin Y-#lmaz
* [Permalink](https://eprint.iacr.org/2026/1378)
* [Download](https://eprint.iacr.org/2026/1378.pdf)
### Abstract
Ensuring robustness and liveness in distributed verifiable random functions (DVRFs) allows the protocol to maintain correct operation and guarantee output generation, even in the presence of malicious actors attempting to disrupt the process, delay cryptographic shares, or remain unresponsive. Because existing DVRF protocols typically rely on synchronous or semi-synchronous network assumptions, simultaneously achieving these properties remains a challenge.
To address this limitation, this paper enhances the FROST-based Icy-DVRF protocol to achieve both robustness and liveness. Specifically, we propose (R)Icy-DVRF, a novel protocol that operates over an asynchronous network while maintaining a constant-size proof. This is achieved by integrating the ROAST wrapper framework into the underlying threshold signature mechanism.
## 2026/1379
* Title: Hierarchical Structure in Attribute-Based Inner-Product Functional Encryption
* Authors: Hirotomo Shinoki
* [Permalink](https://eprint.iacr.org/2026/1379)
* [Download](https://eprint.iacr.org/2026/1379.pdf)
### Abstract
Attribute-based inner-product functional encryption (AB-IPFE), introduced by Abdalla et al. (Asiacrypt'20), is a cryptosystem that combines the access-control capability of attribute-based encryption (ABE) with the linear-computation capability of inner-product functional encryption. By introducing a hierarchical structure between these two functionalities, we can decompose the key generation algorithm into two steps. While such a structure has been extensively studied in contexts such as hierarchical IBE and delegatable ABE, it has received little attention in AB-IPFE despite its naturalness.
In this paper, we formalize a framework for two-level hierarchies in AB-IPFE and classify existing schemes according to their hierarchizability. In particular, we focus on adaptively secure schemes that support expressive access control, such as arithmetic programs in the public-index setting and attribute-hiding inner-product predicates in the private-index setting. To the best of our knowledge, the only efficient constructions known to meet these requirements are those obtained from the framework of Abdalla et al. in the private-index setting and from the scheme of Datta and Pal (Asiacrypt'21) in the public-index setting. We propose several new pairing-based constructions that achieve adaptive security.
First, we revisit the approach of Abdalla et al. Based on their framework, we propose three types of constructions that trade off hierarchizability, ciphertext size, and secret-key size. These constructions are based on predicate encodings and therefore support arithmetic span programs or attribute-hiding inner-product predicates.
Second, we revisit the approach of Datta and Pal. Their scheme supports attribute-weighted sums, which differ slightly from our target functionality. Although this already yields an AB-IPFE scheme, the resulting scheme is limited to the non-zero-type key-policy setting. We efficiently adapt their scheme to obtain AB-IPFE schemes that also support zero-type predicates, and we propose a ciphertext-policy variant. All of the resulting constructions can be hierarchized, but their intermediate secret keys are large. We also propose variant schemes with shorter intermediate secret keys, at the cost of somewhat larger final secret keys. These schemes support arithmetic branching programs.
## 2026/1380
* Title: TIM: A Sensitive-Parameter-Privacy Blind Watermarking Based on Zero-Knowledge Proof
* Authors: Haoran Si, Xi Lin, Huiyan Chen
* [Permalink](https://eprint.iacr.org/2026/1380)
* [Download](https://eprint.iacr.org/2026/1380.pdf)
### Abstract
Blind watermarking enables image ownership verification without requiring the original image. However, existing schemes usually require the owner to reveal the watermark seed and watermark positions during extraction. This creates a strong trust assumption on the verifier. Once such secrets are exposed, a malicious verifier can forge or remove the watermark. In this paper, we present TIM, the first publicly verifiable blind watermarking scheme with sensitive parameters privacy based on zero-knowledge proof. TIM reconstructs the extraction procedure of Integer DCT blind watermarking into an arithmetic-circuit-friendly form. This allows the owner to prove correct extraction without revealing the watermark seed or embedding positions.
TIM addresses three main challenges.
The first is the high proving cost for high-resolution images. The second is the conflict between circuit rigidity and watermark robustness. The third is the hashing overhead of iterative state binding.
To address them, TIM combines Nova and Spartan to decompose full-image extraction into iterative proofs. It uses a threshold-based voting mechanism for robust detection. It also introduces a hierarchical state update mechanism to reduce circuit and memory costs. Experiments show that TIM preserves good imperceptibility and robustness while achieving practical efficiency. For a 4K image, proof generation takes 5.61 minutes and uses 9.61 GB peak memory. These results show that TIM is the first blind watermarking scheme to achieve seed privacy, public verifiability, and practical performance for high-resolution image ownership proofs.
## 2026/1381
* Title: PriFT: Private Fine-Tuning using off-the-shelf MPC and HE libraries
* Authors: Qiuxuan Ma, Eleftheria Makri, Nusa Zisaric
* [Permalink](https://eprint.iacr.org/2026/1381)
* [Download](https://eprint.iacr.org/2026/1381.pdf)
### Abstract
Privacy-Preserving Machine Learning (PPML) is a methodology designed to maintain data privacy throughout the machine learning pipeline. Although cryptographically protecting input privacy at the training phase is theoretically feasible, it remains computationally intensive in practice. As such, most recent works in this area focus on the inference phase. In contrast, we consider the training phase. Our goal is to enable machine learning engineers to use customer data earlier in the ML pipeline without compromising customer privacy or violating regulations. In this work, we introduce a framework named PriFT (Private Fine-Tuning), which leverages a transformer as a feature extractor and then performs training of a neural network on privacy-protected features. PriFT supports fully-private training, where the data is encrypted in the entire ML pipeline, as well as semi-private training, which balances privacy and performance by decrypting the true and predicted labels during training. PriFT can perform secure training both by means of Multiparty Computation (MPC) and based on Homomorphic Encryption (HE), which allows for a direct comparison of the two most prevalent cryptographic solutions for secure computation on a real-world use case. The codebase of our experiments is fully open-sourced and based on well-established libraries, namely Crypten and TenSEAL. Our experimental results show that the MPC approach largely outperforms the HE approach, especially in the semi-private setting. Furthermore, the MPC-based solution in the semi-private setting outperforms the fully-private training approximately by 3|u, offering an adequate privacy-performance tradeoff. Our results show that both HE and MPC can achieve accuracy close to that of plaintext models.
## 2026/1382
* Title: Concrete Bit-Operation Cost of XL: For Solving Multivariate Quadratic Systems Using Wiedemann and Berlekamp-Massey
* Authors: H|+lya Evkan, Ruben Niederhagen
* [Permalink](https://eprint.iacr.org/2026/1382)
* [Download](https://eprint.iacr.org/2026/1382.pdf)
### Abstract
We present a concrete bit-operation cost model for solving multivariate quadratic systems with XL using Wiedemann linear algebra, and Berlekamp-Massey sequence recovery. Following the CryptAttackTester methodology, we implement XL in a circuit-oriented model and derive closed-form cost formulas for the XL, Wiedemann, and Berlekamp-Massey steps. We instantiate the model for GF(2), GF(31), and GF(256), including baseline, constant-coefficient, and bucketed matrix-evaluation variants. Experiments on small parameter sizes show that the formulas accurately predict the circuit costs, while asymptotic analysis confirms convergence to the expected leading constant factors determined by the underlying field arithmetic. We apply the resulting estimates to Fukuoka MQ Challenge instances and to multivariate candidates from the NIST additional-signature process, providing a unified bit-operation comparison of direct Wiedemann-XL costs across several MQ-based schemes.
## 2026/1383
* Title: Notes on the ideal arithmetic correlations of $N$-ary sequences
* Authors: Feifei Yan, Pinhui Ke
* [Permalink](https://eprint.iacr.org/2026/1383)
* [Download](https://eprint.iacr.org/2026/1383.pdf)
### Abstract
In this paper, we investigate the nonexistence of $N$-ary sequences with ideal arithmetic correlation. We prove that there exist no ternary, quaternary, or $6$-ary sequences with ideal arithmetic autocorrelation when the connection integer is an odd prime power $p^{t}$ and $\textup{ord}_{p^{t}}(N)=\phi(p^{t})/4$, where $\phi$ denotes Euler's totient function. Furthermore, when the connection integer is an odd prime $p$ and $\textup{ord}_{p}(N)=\phi(p)/6$, no such ternary, quaternary, or $6$-ary sequences exist for ideal arithmetic correlation. This includes in particular the case $p\equiv7(\textup{mod}12)$, for which $\textup{ord}_{p}(N)=\phi(p)/6$ and we further show that no $N$-ary sequence with ideal arithmetic correlation exists for any prime $N>2$. These results provide further evidence that ideal arithmetic correlation is highly restrictive in the $N$-ary setting.
## 2026/1384
* Title: Lower Bounds for PIR with Preprocessing from Blackbox Cryptography
* Authors: Alexander Hoover, Giuseppe Persiano, Kevin Yeo
* [Permalink](https://eprint.iacr.org/2026/1384)
* [Download](https://eprint.iacr.org/2026/1384.pdf)
### Abstract
We study the limits of single-server private information retrieval (PIR) with preprocessing. Prior work has shown that single-server PIR with sublinear communication requires a linear number of (public-key) server operations per query [DMO00, DH24]. Recent breakthrough works, including [CHK22, ZPZS24, LMW23], circumvent these lower bounds by critically leveraging preprocessing to construct single-server PIR with sublinear query computation.
Our work presents computation lower bounds for any single-server PIR with preprocessing that makes blackbox usage of any cryptography (such as random oracles and virtual blackbox obfuscation). For any client preprocessing scheme where the client stores $s$ bits about an $n$-bit database, we prove the online amortized computation must be $\Omega(n/s)$ across $k = \Omega(s)$ queries (even if performed in a single batch query). In more detail, we prove that they must have either $\Omega(n/s)$ amortized online communication or the server must perform $\Omega(n/s)$ cryptographic operations. Our lower bounds are optimal as there exist PIRs with client preprocessing matching exactly one of the above requirements while outperforming the other. Furthermore, our lower bounds also rule out the existence of doubly efficient PIR from blackbox cryptography with sublinear query computation (current constructions use ring LWE). We note our lower bounds are widely applicable to any single-server PIR scheme that makes blackbox usage of cryptography including those with weaker privacy guarantees. In contrast, prior works only proved computation lower bounds for restricted classes of single-server PIR constructions (e.g., non-encoding servers or single-roundtrip queries).
Our proof framework also supports $\Omega(n/s)$ communication lower bounds for the following three classes of single-server PIR: schemes where the server performs $o(n/s)$ cryptographic operations, schemes where the server's cryptographic operations depend only on query communication and schemes with perfect privacy in the idealized model. Our results hold unconditionally whereas prior communication lower bounds required additional complexity assumptions.
We also prove lower bounds for symmetric private information retrieval (SPIR) with client preprocessing in the random oracle model and present a matching SPIR construction with client preprocessing using only OWFs during queries.
## 2026/1385
* Title: Walsh LUT Evaluation on Lazy Bits for CKKS AES Transciphering
* Authors: Rostin Shokri, Nektarios Georgios Tsoutsos
* [Permalink](https://eprint.iacr.org/2026/1385)
* [Download](https://eprint.iacr.org/2026/1385.pdf)
### Abstract
In this work we propose a novel Boolean lookup-table evaluation methodology over binary CKKS when circuit XORs are kept lazy, i.e., evaluated as additions whose least significant bits remain correct. Our method represents a LUT in the Walsh basis, forms the required parity sums by lazy CKKS additions, and packs them into ciphertext slots. We then use CKKS binary bootstrapping as a refresh step: the StC stage maps the packed lazy parities to MSB-encoded bits, removing the overflow; CtS places the parity values in slots; and $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ cleans the binary noise, leaving clean parities in the slot domain. The LUT is then evaluated by recombining these parities with plaintext Walsh coefficients. This decouples the LUT size from the multiplicative depth of the surrounding circuit: large LUTs can be handled by cleaning selected factored parity signs and spending only a small constant depth in recombination. We apply this framework to AES-CTR transciphering. The AES S-box is evaluated with a nibble-split Walsh decomposition, which supports more AES blocks at the cost of one additional multiplication depth. The AES state remains in full complex CKKS packing so real and imaginary lanes carry independent AES blocks. In CPU experiments, the Walsh S-box AES-CTR algorithm is 3.25x faster than the sparse-bootstrapping XBOOT variant at the same 1024-block batch size.
## 2026/1386
* Title: Key-Recovery Attacks on TALUS: A Cryptanalytic Note
* Authors: Guilhem Niot
* [Permalink](https://eprint.iacr.org/2026/1386)
* [Download](https://eprint.iacr.org/2026/1386.pdf)
### Abstract
We present key-recovery attacks on the constructions of TALUS (Kao and Chang), a threshold ML-DSA (FIPS 204) construction available on arXiv and scheduled for presentation at the NIST Threshold Call Preview Talks Round 2 (TCPT-2, https://csrc.nist.gov/events/2026/tcpt).
For TALUS-MPC, which is claimed EUF-CMA secure against an adversary corrupting up to $T reA 1$ parties, we show the claim is false via two independent attacks, both exploiting the same root cause. TALUS-MPC uses Feldman commitments that apply the public matrix A to secret
values: key shares of $s_1$ during key generation, and contributions to the nonce $y$ during signing. Since A is left-invertible in every ML-DSA parameter set, these images are invertible by Gaussian elimination, with no lattice problem to solve. A passive observer recovers all key shares of $s_1$ directly from the key-generation broadcast, and independently recovers the aggregate nonce y from the signing broadcast, which then yields $s_1 = c^{reA1} \cdot (z reA y)$ from a single signature.
For TALUS-TEE and TALUS-MPC, we identify a persisting flaw: the rejection-sampling check that protects the error term $s_2$ in standard ML-DSA has been removed. Each signature leaks a noisy linear equation in $s_2$; applying least-squares recovery over the cyclotomic ring - an instance of LWE without modular reduction - recovers the full secret from a few hundred million signatures. The sample counts we derive are not optimized and we believe exploiting the bounded noise structure and lattice-reduction techniques would reduce them significantly, but we focus on establishing the structural flaw.
## 2026/1387
* Title: ZK-Audit: Proving Power Side-Channel Resilience in Synthesized Hardware
* Authors: Sakib Anwar Rieyan, Nektarios Georgios Tsoutsos
* [Permalink](https://eprint.iacr.org/2026/1387)
* [Download](https://eprint.iacr.org/2026/1387.pdf)
### Abstract
Modern hardware security heavily relies on the assumption that pre-synthesis algorithmic protections will survive the physical fabrication pipeline. However, untrusted third-party Electronic Design Automation (EDA) toolchains often apply aggressive structural optimizations that can silently compromise perfectly symmetric designs, introducing critical data-dependent power side-channel vulnerabilities. Existing pre-silicon verification methodologies require exposing highly sensitive, proprietary gate-level intellectual property (IP) to external auditors to verify structural security. In this paper, we introduce a novel Zero-Knowledge Hardware Auditor, an end-to-end framework that provides mathematical guarantees of physical data-obliviousness without revealing the underlying circuit netlist. By translating synthesized gate-level topologies into a custom Side-Channel Intermediate Language (SCIL), our architecture maps physical dynamic switching activity into arithmetic constraints executable within a Halo2 zero-knowledge virtual machine (zkVM). This enables the first implementation of a zero-knowledge Bounded Toggle Assessment (ZK-BTA), a deterministic structural counterpart to classical Test Vector Leakage Assessment. Experimental evaluations across standard cryptographic primitives and ISCAS-85 benchmarks demonstrate that the framework successfully identifies inherently leaky logic and captures EDA-induced asymmetries, such as a 13% leakage rate introduced into a theoretically secure Montgomery Ladder, while proving the structural integrity of Dual-Rail oblivious logical topologies. Furthermore, the asymmetric zk-SNARK architecture ensures scalable component-level auditing, yielding a succinct cryptographic proof of physical security that can be publicly verified in under 0.08 seconds.
## 2026/1388
* Title: Chimera: A Hybrid GPU Backend for Sumcheck Acceleration in Zero Knowledge Provers
* Authors: Kashfia Farheen, Nektarios Georgios Tsoutsos
* [Permalink](https://eprint.iacr.org/2026/1388)
* [Download](https://eprint.iacr.org/2026/1388.pdf)
### Abstract
Zero-knowledge proof systems are increasingly relying on the Sumcheck protocol to avoid the FFT-heavy structure of earlier SNARK designs. Sumcheck is well suited for GPU acceleration; it consists of sequential rounds where each round performs regular, parallelizable operations over large multilinear evaluation tables. The focus is on how to organize this work across rounds: intuitively, the active polynomial state should remain close to the device that processes it, the CPU-GPU boundary should only expose values that are needed to transition, and various cryptographic settings should be kept stable.
This paper presents Chimera, a GPU-CPU framework for accelerating Sumcheck in Spartan-style SNARK provers. Chimera uses a hybrid execution model: large polynomial evaluation and folding work runs on the GPU, active polynomial state remains resident on GPU across profitable rounds, compact round messages return to Spartan's host transcript, and small domains fall back to CPU execution. Chimera also specializes the wrappers around Spartan's small round-polynomial commitments and proof objects, and introduces a memory-aware chunking path.
On BN254 Spartan R1CS instances, Chimera demonstrates a \(7.96\times\) improvement of the committed-Sumcheck region at \(N=2^{17}\), relative to clean Spartan. Across full Spartan proving runs from \(2^{12}\) to \(2^{27}\) constraints, Chimera improves end-to-end prover time for all measured sizes, reaching \(1.27\times\)-\(1.64\times\) speedup for sizes \(2^{24}\)-\(2^{27}\). Ablation studies show that Chimera's gains come from choosing the right execution boundary rather than from any single optimization. The GPU handles the large, regular Sumcheck work, while Spartan keeps the protocol state needed for transcript and verifier compatibility. This reduces movement of polynomial data without disrupting the proof system. The remaining gap between Sumcheck-region and end-to-end speedup shows that, after Sumcheck is accelerated, polynomial commitment and proof-wrapper costs become the next bottleneck.
## 2026/1389
* Title: SC-DT: Scalable Constant Round Secure Comparison and its Application to Privacy Decision Tree Evaluation
* Authors: Qinghui Zhang, Xiaojun Chen, Yansong Zhang, Xudong Chen
* [Permalink](https://eprint.iacr.org/2026/1389)
* [Download](https://eprint.iacr.org/2026/1389.pdf)
### Abstract
Decision trees are widely used in machine learning due to their simplicity, efficiency, and interpretability. Numerous private decision tree evaluation (PDTE) protocols based on secure multi-party computation (MPC) have been proposed to protect sensitive data during evaluation. However, existing MPC-based PDTE protocols primarily focus on the two or three-party setting. Moreover, their core building block, secure threshold comparison, typically incurs logarithmic-round communication and dominates the online cost of tree evaluation. These limitations motivate the design of scalable and efficient secure comparison protocols for large-scale PDTE. In this paper, we propose a scalable constant round secure comparison protocol with Shamir secret sharing in the honest-majority setting. Concretely, inspired by Falcon, we leverage random shuffling to achieve zero detection with constant-round communication. Furthermore, we reduce random shuffle to random shift, thereby significantly decreasing the offline communication overhead. Besides, we reformulate feature selection and path evaluation in PDTE as PLUT functionalities and integrate them with our scalable comparison protocol to achieve scalable PDTE. Finally, we extend the above Shamir secret sharing-based protocols to the packed secret sharing variants and further improve their online communication efficiency. We instantiate these protocols as a framework SC-DT and report their improved performance: i) For secure comparison, we achieve a speedup of $1.7-2.3\times$ and reduce communication by $1.7-2.5\times$ in the online phase compared with Helix (Cryptology ePrintrCO2025). ii) For PDTE, our protocol achieves up to a $9\times$ speedup and reduces online communication by $1.5\times$ in the online phase compared with Mostree (ACSACrCO2023). iii) For large-scale decision tree evaluation tasks, SC-DT evaluates a random forest consisting of 100 trees and 85100 nodes in a 21-party WAN setting, achieving an amortized latency of approximately 300 ms per tree.
## 2026/1390
* Title: A Separation Principle for Lookup-Based zkML: Activation-Function Structure Cannot Reduce Per-Lookup Proving Cost
* Authors: Min Jun Jo
* [Permalink](https://eprint.iacr.org/2026/1390)
* [Download](https://eprint.iacr.org/2026/1390.pdf)
### Abstract
In zero-knowledge machine learning (zkML), the dominant cost is generating the proof, not running the model, and it concentrates in the nonlinearities a transformer must evaluate inside the proof system. It is tempting to exploit a nonlinearity's mathematical structure (low degree, parity, or kernel form) to prove it more cheaply. We show this hope is misplaced for the dominant cost: in a Shout-style (one-hot) lookup argument the per-lookup proving work is a function of the access pattern alone, never of the table values, so function structure has zero leverage on it. This is a separation principle; structure can cheapen only a secondary, once-per-proof table term. That table term stays subordinate as models get deeper because the only data-dependent amplifier of per-layer error in a pre-LN transformer is the LayerNorm gain 1/-a: a -a-floor on typical inputs lets a single fixed proving precision suffice at every depth, keeping proof cost near-linear in the number of layers. We measure this depth-to-cost scaling on two independent proving systems (EZKL/halo2 and Jolt Atlas), and turn the one dial the separation leaves open, the committed address width, into a bit-exact, upstreamed reduction in prover time.
## 2026/1391
* Title: 6G Sensing Security: Distributed Game-Theoretic RL for Urban Beamforming and Attacker Detection
* Authors: Parmida Geranmayeh, Onur Gunlu
* [Permalink](https://eprint.iacr.org/2026/1391)
* [Download](https://eprint.iacr.org/2026/1391.pdf)
### Abstract
In next-generation networks, communication systems will no longer be limited to data transmission and will be expected to acquire awareness of the surrounding environment. This leads to the concept of integrated sensing and communication (ISAC), where the same wireless infrastructure is used for both communication and environmental sensing. Thus, ISAC enables the system to transmit information efficiently and observe and interpret channel variations and user behavior. Motivated by this capability, this work focuses on detecting an active attacker in an urban environment scenario, where the attacker intentionally manipulates beamforming directions to increase interference and mislead the transmitter into allocating the main lobe of beam toward itself instead of legitimate users. We apply game-theoretic approaches to model the interaction between legitimate users and the attacker, and integrate the resulting utility-based formulation into a reinforcement learning (RL) framework. Simulation results demonstrate that the proposed method effectively addresses security challenges in dynamic 6G ISAC systems.
## 2026/1392
* Title: Slicing Boolean Functions with Inner Products
* Authors: Pierrick M|-aux, Tim Seur|-
* [Permalink](https://eprint.iacr.org/2026/1392)
* [Download](https://eprint.iacr.org/2026/1392.pdf)
### Abstract
Boolean functions with additional structure play an important role in symmetric cryptography, both for achieving strong cryptographic properties and for enabling efficient implementations. Recent works on homomorphic-friendly symmetric primitives, especially in the context of Hybrid Homomorphic Encryption, highlighted the interest of Boolean functions whose evaluation can be decomposed according to structured partitions of the Boolean cube. A classical example is given by Hamming-weight decompositions, which underlie symmetric and weightwise degree-d Boolean functions. In this work, we generalize this viewpoint by replacing the Hamming weight with a general integer linear form. Given a vector v in Z^n, we partition the Boolean cube (F_2)^n by grouping the Boolean vectors x in (F_2)^n according to the value of <v,x> into so-called v-slices, and study functions that have bounded degree on each of them. We study how many such slices are needed to describe a given function, and provide bounds and structural properties for the partitions induced by integer vectors. We also show how this representation leads to a homomorphic evaluation strategy in a GSW-like setting, together with noise estimates for the resulting ciphertexts. Finally, we generalize several symmetric and weightwise degree-d Boolean functions using different vector families, and experimentally evaluate their algebraic degree, algebraic immunity, and nonlinearity. The results show that direct generalizations of symmetric functions often lose cryptographic strength, while generalized weightwise degree-d constructions lead to richer and more promising behavior.
## 2026/1393
* Title: On the Differential Uniformity of Polynomials over Galois Rings
* Authors: Sondre R|+njom, Arne Sandrib
* [Permalink](https://eprint.iacr.org/2026/1393)
* [Download](https://eprint.iacr.org/2026/1393.pdf)
### Abstract
Design of hash functions and pseudo-random permutations over Galois extensions of $\mathbb Z_q$ for prime powers $q$ has recently gained some interest in relation to recent directions in advanced cryptography, such as multiparty computation and zero-knowledge protocol design. Thus investigating optimality of cryptographic properties of S-boxes defined by polynomials over Galois rings is of interest. Of particular interest is the differential uniformity of such functions. To our knowledge, there are very few results on the differential uniformity for polynomials over Galois rings $\mathrm{GR}(p^k,m)$ when $k,m\geq 2$. Motivated by designing secure hash functions and block ciphers over Galois rings, a main contribution of this paper is an investigation into the differential properties of polynomials over Galois rings. Finally, we provide a classification of APN permutations in $\mathrm{GR}(4,2)$ up to affine and CCZ-equivalence.
## 2026/1394
* Title: Adaptor Signatures Meet BLS: Enabling Efficient Blockchain Applications with Unique Adaptor Signatures
* Authors: Javier Gomez-Martinez, Erkan Tairi, Pedro Moreno-Sanchez, Clara Schneidewind
* [Permalink](https://eprint.iacr.org/2026/1394)
* [Download](https://eprint.iacr.org/2026/1394.pdf)
### Abstract
Blockchain-based cryptocurrencies give rise to a plenitude of advanced applications (such as cross-currency transfers or privacy-preserving payments) through blockchain protocols - cryptographic protocols that orchestrate the processing of financial transactions on the blockchain. To enable a modular design and to enhance reusability across different cryptocurrencies, many blockchain protocols are built upon adaptor signatures (AS), a well-studied cryptographic building block, which is natively supported by most digital signature schemes used for authorizing cryptocurrency transactions. An inherent limitation of AS-based blockchain protocols is the known impossibility to realize AS for unique signature schemes, such as BLS signatures. As a consequence, existing AS-based protocols cannot be executed on cryptocurrencies that base transaction authorization on BLS signatures (such as the Chia Network).
For such cryptocurrencies, instead, new custom blockchain protocols need to be created, as recently done for the case of coin mixing (S&P'24) or atomic swaps between two cryptocurrencies with BLS-based transaction authorization (ESORICS'24). To avoid such complex and error-prone redesigns, in this work, we develop a novel notion of AS called Two-Party Asymmetric-Input Solitary-Output Adaptor Signature (2P-AISO-AS) that sidesteps the known impossibility result and that can be realized from both randomized (i.e., plain) and unique signature schemes. We provide efficient instantiations of 2P-AISO-AS from BLS and show that we can obtain performant, BLS-compatible blockchain protocols by replacing AS with 2P-AISO-AS in known AS-based protocols, including zero-knowledge contingent payments, atomic swaps, and coin mixing.
## 2026/1395
* Title: Blind Trace-Only Segmentation of Cipher Implementations Without Algorithm Metadata
* Authors: Hyunjun Kim, Hwajeong Seo, Anupam Chattopadhyay
* [Permalink](https://eprint.iacr.org/2026/1395)
* [Download](https://eprint.iacr.org/2026/1395.pdf)
### Abstract
Blind side-channel analysis (BSCA) can infer keys without known inputs or outputs, but practical use still needs an upstream step that locates repeated computation and candidate points of interest in an unlabeled trace. We address this trace-only structuring problem with a two-stage method that uses only the per-sample mean and standard deviation, without algorithm labels or metadata. Stage1 estimates a repetition scale, start phase, anchor-supported stable core, and period candidates from rank-combined self-similarity. Stage2 stacks the stable core into a representative repetition and partitions it into relative high- and low-score segments. On 16 block cipher implementations across STM32F303 and XMEGA, the method forms consistent repetition windows in most cases. Post-hoc source and assembly comparison separates exact or edge-inclusive count matches from grouped, microperiod, and ambiguous hierarchy relations, while Top-5 candidates often retain body-related hierarchy. In a representative AES/XMEGA case, the trace-only high-score segments cover the strongest S-box CPA hotspots, indicating that the produced coordinates can prioritize, rather than determine, candidate regions for later CPA or BSCA.
## 2026/1396
* Title: Reliable TRNG and its Challenges
* Authors: Raja Adhithan Radhakrishnan
* [Permalink](https://eprint.iacr.org/2026/1396)
* [Download](https://eprint.iacr.org/2026/1396.pdf)
### Abstract
The objective of this work is to investigate methods
for improving the self-tuning mechanism of ring oscillator (RO)
based True Random Number Generators (TRNGs). It also
examines the challenges involved in achieving a reliable and
stable design over long-term operation. Furthermore, this work
analyzes potential approaches to address these challenges and
validates their effectiveness using the NIST statistical test suite.
## 2026/1397
* Title: HANNS: Low-Storage Non-Interactive Approximate Private Nearest Neighbor Search with Sublinear Comparison Complexity
* Authors: Haowen Pan, Ruiqi Gan, Yunhao Fu, Yintai Sun, Zhou Zhang, Yuxiang Wang, Yi Chen, Bo Zhang, Haoyi Zhou, Yongxin Tong, Zhenyu Guan, Jin Dong, Song Bian
* [Permalink](https://eprint.iacr.org/2026/1397)
* [Download](https://eprint.iacr.org/2026/1397.pdf)
### Abstract
With growing concerns over data privacy, private nearest neighbors search (PNNS) attracts increasing research attention. Existing PNNS follow two main approaches: i) interactive PNNS based on secure multi-party computation protocols that leverage index structures to achieve sublinear complexity, and ii) non-interactive PNNS utilizing fully homomorphic encryption to minimize communication bandwid that the cost of superlinear computational complexity.
To address the communication-computation dilemma, we propose HANNS, a non-interactive PNNS protocol with a sublinear number of encrypted comparisons. Our key observation is that, while the full-table scan is inevitable under the non-interactive setting, the number of costly encrypted comparisons can be significantly reduced. Specifically, we develop a cluster ordering scheme over FHE that leverages a segmented rigid transformation to obliviously identify candidate clusters with only a sublinear number of homomorphic comparisons. Furthermore, we introduce a homomorphic product quantization (PQ) scheme that enables coarse search and reranking over PQ-encoded vectors, which
significantly reduces the computational and storage overheads.
In the experiment, we show that HANNS achieves 41x to 277x speedup and a storage reduction of 12x to 31.7x compared to the most recent non-interactive schemes, while reducing communication by 1,258x to 80,536x and achieving a speedup of 8x to 119x over interactive schemes in low-bandwidth scenarios.
## 2026/1398
* Title: How to Encrypt with Random Reversible Circuits
* Authors: Ran Canetti, Ji Luo, Yiding Zhang
* [Permalink](https://eprint.iacr.org/2026/1398)
* [Download](https://eprint.iacr.org/2026/1398.pdf)
### Abstract
This work revisits a natural paradigm for constructing public-key encryption, whereby the public key is an obfuscated block cipher in encryption mode. We show that if the block cipher is a permutable pseudorandom permutation [ShmuelirCoZhandry, Crypto-arCO25] and the obfuscator is indistinguishability-secure, then the following holds.
1. Applying the obfuscated cipher directly to the message and a short random nonce, without any additional structure or consistency checks, suffices for CCA2 security.
2. Augmenting the scheme with the capability to generate obfuscated decrypt-then-apply-$f$ circuits (for any given function $f$), yields a *functional encryption* scheme that is *simulation-secure against adaptive chosen-ciphertext attacks*.
3. For any length-preserving function $g$, augmenting the public key with an obfuscated decrypt-apply-$g$-reencrypt circuit allows anyone to homomorphically apply $g$ to encrypted data, for an unbounded number of times, while preserving semantic security. (This relies on subexponential security.)
We also show that, under the split-circuit pseudorandomness (SCP) assumption of [CanettirCoChamonrCoMucciolorCoRuckenstein, TCC-arCO24], random reversible circuits form a permutable pseudorandom permutation family. This points to obfuscated random reversible circuits as a potential alternative avenue to public-key encryption with strong security and rich functionality.
## 2026/1399
* Title: CHIP: Efficient Homomorphic Encryption-Based CNN Batch Inference Using Channel-Interleaved Packing with Small Rotation Key Set
* Authors: Huan-Chih Wang, Ja-Ling Wu
* [Permalink](https://eprint.iacr.org/2026/1399)
* [Download](https://eprint.iacr.org/2026/1399.pdf)
### Abstract
As privacy concerns rise, numerous laws require machine learning-based applications to comply with stringent privacy regulations. While Homomorphic Encryption (HE) allows computation directly on encrypted data, existing HE-based inference solutions suffer from significant computational and memory overhead for both single and multiple samples. Additionally, current methods require many rotation keys, which limits their practicality in a broader range of scenarios.
To address these challenges, we propose channel-interleaved packing (CHIP) to embed three-dimensional (3-D) data into 2-D ciphertexts, enabling 3-D HE convolution to be performed as a 2-D HE convolution combined with channel aggregations via ciphertext rotations. To further improve the performance of CHIP-based convolution, we introduce an efficient 2-D convolution that halves the number of HE multiplications. For computationally intensive inference tasks, we employ partial-kernel and mini-batch strategies that iteratively process sliced kernels and subsets of samples, aggregating the results to produce the final output.
Experimental results demonstrate the superior efficiency of our method compared to the state-of-the-art HE-based approaches by Lee et al. (ICML'22) and Cheon et al. (IEEE TDSC'24) in both single-sample and multi-sample scenarios. Using ResNet18, VGG11, and VGG16 with a batch size of 64, our solution achieves speedups of up to 4.7$\times$. When processing a single test sample, the speedup increases to 60$\times$. Moreover, our method requires only 29 rotation keys for evaluation, which is at least 35\% fewer than previous works, resulting in an overall memory reduction of up to 45\%. Code is available at: \url{https://github.com/whcjimmy/chip}.
## 2026/1400
* Title: What Happens When integrating Modulus Switching and Lossy Source Coding: A New Dual Attack Variant on LWE
* Authors: Yechen Li, Qunxiong Zheng
* [Permalink](https://eprint.iacr.org/2026/1400)
* [Download](https://eprint.iacr.org/2026/1400.pdf)
### Abstract
The threat of large-scale quantum computers to classical public-key cryptography has motivated the development of post-quantum cryptographic schemes. Among these, lattice-based constructions have become the mainstream choice in the ongoing NIST standardization process. The security of these schemes typically relies on the hardness of the LWE problem, and the dual-sieve-FFT attack is widely recognized as one of the most effective approaches against it. Recent improvements by MATZOV and Carrier et al. have significantly advanced its efficiency.
In this paper, we propose a new variant of the dual-sieve-FFT attack
that integrates modulus switching and lossy source coding. We provide a theoretical analysis of the integrated approach and show that the enumeration size in the FFT step can be reduced from $q^{n_\text{fft}}$ to $p^{k_\text{fft}}$ (with $p <q, k_{\text{fft}} < n_{\text{fft}}$), leading to lower FFT cost and decoding cost. When applied to KYBER, our variant achieves better total complexity than the attack using only lossy source coding, although the improvement is modest. More importantly, the decoding and FFT costs are reduced by 1rCo6 bits and 2rCo7 bits, respectively, in most parameter settings. These reductions are practically meaningful in scenarios where memory usage or multi-target attacks are of concern.
## 2026/1401
* Title: A New Framework for Efficient Multivariate Functional Bootstrapping
* Authors: Kunyu Wu, Kuiyuan Duan, Dengfa Liu, Hongbo Li
* [Permalink](https://eprint.iacr.org/2026/1401)
* [Download](https://eprint.iacr.org/2026/1401.pdf)
### Abstract
Fully homomorphic encryption (FHE) enables computation on encrypted data without decryption. In TFHE, programmable bootstrapping (PBS) evaluates nonlinear functions through lookup tables (LUTs), but a direct multivariate LUT over a $t$-ary plaintext space has size $t^\ell$. This paper studies LUT compression for multivariate functional bootstrapping via variable separation and additive inner representations.
We first apply this approach to non-negative integer division with remainder. For a dividend $m$, a divisor $d$, and $h=\lfloor m/d\rfloor$, we use a logarithmic transformation to decompose bivariate division into two univariate logarithmic PBS calls, one homomorphic subtraction, and one outer exponential PBS call. To handle integer plaintexts, we introduce a rounded logarithmic function $\operatorname{clog}_{B,M}$ and give a sufficient condition on $M$ for exact quotient recovery. The resulting homomorphic division-with-remainder algorithm achieves $\widetilde{O}(1)$ equivalent blind-rotation complexity under theoretically optimal parameters, and also yields frameworks for modular reduction and truncated division.
We further prove that every finite function $f:[t]^\ell\to[t]$ can be written as $f(x_1,\ldots,x_\ell)=q\left(\sum_{i=1}^{\ell}p_i(x_i)\right)$, and search for small-span representations using simulated annealing with reheating. Experiments show a 3.6x speedup for division with remainder at $t=64$, and a 1.9x speedup for the Hamming-weight interval function, compared with estimates based on [BBR26].
## 2026/1402
* Title: On Extending Integral Distinguishers
* Authors: Dachao Wang, Hosein Hadipour, Simon Gerhalter
* [Permalink](https://eprint.iacr.org/2026/1402)
* [Download](https://eprint.iacr.org/2026/1402.pdf)
### Abstract
Integral cryptanalysis analyzes block ciphers using input structures for which the sum of a chosen function of the output bits becomes key-independent. However, most methods still test one output expression at a time, so they can miss distinguishers that emerge only when several outputs are combined, either linearly or nonlinearly. They are also not designed to capture key-dependent integral combinations, which may hold deterministically on part of the key space.
In this work, we develop Split-and-Cancel, a method that combines exact expansion in a short final part with an oracle on the preceding rounds to determine which suffix monomials can survive from the chosen structure and records them in a binary matrix. Key-independent combinations are then extracted from the left kernel of this matrix. We first apply the method in a reduced model with omitted boundary key additions, where linear dependencies in this matrix yield certified key-independent sum combinations among output bits and higher-degree output products.
When the omitted boundary key is restored, the same combinations yield deterministic weak-key distinguishers.
We apply the method to SIMON, SIMECK, SPECK, PRESENT, and GIFT. Our strongest deterministic results add one round to the best integral distinguishers for SIMON-32, SIMON-48, SIMON-64, SIMON-96, SIMON-128, all standard SIMECK variants, and SPECK from block sizes 32 to 128. For PRESENT and GIFT, we obtain one-round improvements for deterministic weak-key integral distinguishers. In each case, the exact weak-key class covers at least a quarter of the key space: $2^{78}$ of $2^{80}$ keys for PRESENT-80, $2^{126}$ of $2^{128}$ keys for PRESENT-128, GIFT-64 and GIFT-128. These results show that exact modeling of a short final part can reveal key-independent and weak-key integral behavior missed by single-observable searches.
## 2026/1403
* Title: A polynomial-time key recovery attack of Facto-DSA
* Authors: Simon Abelard, Ludovic Perret, Hao Shi
* [Permalink](https://eprint.iacr.org/2026/1403)
* [Download](https://eprint.iacr.org/2026/1403.pdf)
### Abstract
This work introduces a polynomial-time attack on the signature scheme Facto-DSA. We provide an implementation that breaks all proposed parameter sets, including the largest, in under one minute on a standard laptop. These results question the suitability of multivariate polynomial factorization as a foundation for robust cryptographic schemes.
--- Synchronet 3.22a-Linux NewsLink 1.2