From Newsgroup: sci.crypt

## In this issue
1. [2026/273] Weighted Cryptography with Weight-Independent ...
2. [2026/341] Syndrome Decoding with Hints
3. [2026/749] Divide-and-Pair: Faster subgroup membership testing ...
4. [2026/990] Single-Trace Power Analysis of LESS Key Generation
5. [2026/1153] Search-Efficient Public-Key Authenticated ...
6. [2026/1201] Silentium revisited: Pseudorandom Beaver Triple ...
7. [2026/1405] AsymSAE: Verifier-Based Asymmetric SAE Protocol for ...
8. [2026/1406] An $n^{n+o(n)}$-Time Algorithm for the Lattice ...
9. [2026/1407] HACC: A Scalable Hierarchical Accumulator with ...
10. [2026/1408] Statistically Undetectable Backdoors in Deep Neural ...
11. [2026/1409] Accelerating FAEST Signing on GPU via Fused AES ...
12. [2026/1410] A Memory-Efficient and Assembly-Optimized ...
13. [2026/1411] Improved Quantum Circuits for Information Set ...
14. [2026/1412] Quantum Implementation and Analysis of Rijndael
15. [2026/1413] Optimizing ARIA-GCM on GPUs
16. [2026/1414] Evaluating Hybrid KEM/DSA for KpqC and NIST PQC on ...
17. [2026/1415] Optimized Implementation of Warp-Cooperative GPU ...
18. [2026/1416] Beyond Size: Do Hybrid PQC Certificates Actually ...
19. [2026/1417] Accelerating the AIMer Post-Quantum Signature with ...
20. [2026/1418] CT-KAT: A Multilayer Analysis Platform for ...
21. [2026/1419] ML-QED-Lite: A Lightweight Machine Learning-Based ...
22. [2026/1420] An Optimized Native Rust Implementation of the KpqC ...
23. [2026/1421] A Cryptographic Perspective on California's Delete ...
24. [2026/1422] LESS on the Cortex-M4: Characterizing the ...
25. [2026/1423] CMALU: Compact Fault-Tolerant Modular Arithmetic ...
26. [2026/1424] Repeated Masks, Predictable Splices: Breaking ...
27. [2026/1425] Simultaneous-Message and Succinct Secure ...
28. [2026/1426] Coupling Leakage in Theory and Practice - Unveiling ...
29. [2026/1427] SPiRiT: Verifiable Contact Tracing for Balanced ...
30. [2026/1428] Highly Efficient Consistent Broadcast Encryption
31. [2026/1429] Structured Search for a Separable Subclass of ...
32. [2026/1430] TRAPGC-DV: Trapdoor Garbled Circuit Designated ...
33. [2026/1431] The Isogeny Problems
34. [2026/1432] ReedrCoSolomon Mutual Correlated Agreement Beyond the ...
35. [2026/1433] Shuffled-ArgMax: Securing ArgMax Decisions Against ...
36. [2026/1434] BeeKEM: Decentralized, Secure and Efficient Group ...
37. [2026/1435] FiltrumVote: Scalable, Verifiable, and Coercion- ...
38. [2026/1436] Verifiable and Collusion-Resistant Multi-Party ...
39. [2026/1437] SoK: On the Design of Secure Ranking-based E-voting ...
40. [2026/1438] Vela and Carina: Fast Pairing-Based Multilinear ...
41. [2026/1439] ABE for Unbounded Depth Circuits from the Doubly ...
42. [2026/1440] Rarus: A Succinct and Efficient Range Proof for ...
43. [2026/1441] RainHash2.0: Hardware- and Arithmetization-friendly ...
44. [2026/1442] CoSecRAG: Efficient Private Retrieval with Database ...
45. [2026/1443] SENTRA:Privacy-Preserving Training in Outsourced ...
46. [2026/1444] Compressed Post-Quantum Silent OT from Isogenies
47. [2026/1445] Sublinear-Communication Layered MPC from HSS
## 2026/273
* Title: Weighted Cryptography with Weight-Independent Complexity
* Authors: Aarushi Goel, Swagata Sasmal, Mingyuan Wang
* [Permalink](https://eprint.iacr.org/2026/273)
* [Download](https://eprint.iacr.org/2026/273.pdf)
### Abstract
Cryptographic primitives involving multiple participants, such as secure multiparty computation (MPC), threshold signatures, and threshold encryption, are typically designed under the assumption that at least a threshold number of participants remain honest and non-colluding. However, many real-world applications require more expressive access structures beyond simple thresholds. A prominent example is the weighted threshold access structure, where each party is assigned a weight and security holds as long as the total weight of corrupted parties does not exceed a specified threshold.
Despite the practical relevance of such access structures, our understanding of efficient constructions supporting them remains limited. For instance, existing approaches for weighted MPC and weighted threshold encryption incur costs that scale with the total assigned weights to all parties or rely on non-black-box use of cryptography.
In this work, we present the first black-box constructions of the following weighted cryptosystems with weight-independent complexity in the trusted setup model: (i) a weighted MPC protocol with guaranteed output delivery, (ii) a semi-honest weighted threshold encryption scheme and (iii) a semi-honest weighted threshold Schnorr signature scheme.
At the heart of our constructions is a new succinct computational secret sharing scheme with linear homomorphism for weighted threshold access structures. We provide two concrete instantiations of this primitive, based on the Decisional Composite Residuosity (DCR) assumption and the Learning With Errors (LWE) assumption, respectively. Furthermore, our constructions extend to any general access structure that can be represented efficiently as a monotone Boolean circuit.
## 2026/341
* Title: Syndrome Decoding with Hints
* Authors: Letizia D'Achille, Andre Esser, Nicolai Kraus
* [Permalink](https://eprint.iacr.org/2026/341)
* [Download](https://eprint.iacr.org/2026/341.pdf)
### Abstract
We study the syndrome decoding problem (SDP) in the presence of side information. The SDP asks, given a binary parity-check matrix $\mathbf{H}$ and a syndrome $\mathbf{s}$, to find a low Hamming weight binary error $\mathbf{e}$ such that $\mathbf{H} \mathbf{e} = \mathbf{s}$ over $\mathbb{F}_2$. Recent work (Cayrel et al., Eurocrypt '21) exploits a fault injection attack to reveal syndrome entries over the integers, referred to as perfect hints. Subsequent works considered side-channel scenarios to reveal similar, but noisy, information (approximate hints).
Both types of hints have been shown empirically to allow for solving the SDP once enough of them are available. However, fundamental questions about the impact of these hints on the hardness of the SDP, such as thresholds for a collapse into the polynomial-time regime or how to exploit arbitrary amounts of hints, remain open.
In this work, we show that both types of hints effectively allow one to transform the SDP instance into a soft-decision decoding instance. We then adapt Information Set Decoding (ISD) algorithms, the best known technique to solve generic SDP instances, to this setting. In contrast to previous work, we obtain non-trivial speedups for any amount of available hints, interpolating smoothly between the complexity of standard ISD (no hints) and polynomial time (sufficient hints). Furthermore, our practical simulations show that Hint-ISD achieves the polynomial-time regime generally under fewer hints than previous approaches.
We then provide an explicit bound on the number of hints required to reach the polynomial-time regime. This bound confirms earlier practical observations that higher error weights, such as those found in the McEliece cryptosystem, exhibit higher resistance against hint exposure than schemes using smaller error weights, such as HQC.
## 2026/749
* Title: Divide-and-Pair: Faster subgroup membership testing for elliptic curves
* Authors: Yu Dai, Youssef El Housni, Dimitri Koshelev, Krijn Reijnders
* [Permalink](https://eprint.iacr.org/2026/749)
* [Download](https://eprint.iacr.org/2026/749.pdf)
### Abstract
Subgroup membership testing (SMT) on an elliptic curve with non-trivial cofactor is essential to prevent small-subgroup attacks in cryptographic protocols. In the existing literature, there exist two non-trivial methods for SMT on elliptic curves with modest cofactor (typically a power of $2$): Pornin's approach tests membership by repeatedly dividing by prime divisors of the cofactor (mostly halving), finishing with a Legendre symbol; Koshelev's approach replaces all divisions with Tate pairings (possibly in the quadratic extension of the base field), but requires non-degeneracy conditions that are not always met. In this paper, we observe that both approaches sit at the extremes of a single division-pairing trade-off. The resulting method, \mainalgorithm, is always at least as fast as either Pornin's or Koshelev's method and strictly faster in many cases. We instantiate \mainalgorithm on five curves in widespread use, including Curve25519, Curve448, GC256A, Four$\mathbb{Q}$ and Jubjub. Our Go implementation, built on the open-source \texttt{gnark-crypto} library, achieves significant speedups over state-of-the-art tests, namely of $1.6\times$ on Curve25519, $1.3\times$ on Curve448, $1.4\times$ on GC256A, $10.8\times$ on Four$\mathbb{Q}$ and $7\times$ on Jubjub.
## 2026/990
* Title: Single-Trace Power Analysis of LESS Key Generation
* Authors: S|+leyman Emir Ak-#n, Abdullah Talayhan, |uzcan |uzt|+rk
* [Permalink](https://eprint.iacr.org/2026/990)
* [Download](https://eprint.iacr.org/2026/990.pdf)
### Abstract
This paper presents a side-channel attack on the Linear Equivalence Signature Scheme (LESS) v2.0. LESS derives its security from the Linear Equivalence Problem and was evaluated as a candidate during Round 2 of the NIST post-quantum cryptography standardization process. LESS secret keys are used to generate monomial matrices, which are stored efficiently in two one-dimensional lists: the permutation list and the coefficient list. Recovering the secret monomial matrices is sufficient to forge signatures, as they are the values actually used during signing. We propose a profiled, single-trace horizontal attack on LESS key generation that recovers the full secret monomial matrices. First, the monomial coefficients that are multiplied by the dense part of the public generator matrix are recovered via power analysis of the matrix multiplication function. Next, we attack the reduced row echelon form function to recover the permutation list. We then complete the attack algebraically via two independent paths: the Primary attack and the Secondary attack. The Primary attack uses only the recovered coefficients in matrix multiplication together with their permutation positions, and a known parity-check matrix equation. The Secondary attack is an alternative that relies on another algebraic relation between the secret key and the public key and uses all the recovered values. We validated our attack on an ARM Cortex-M4 microcontroller. On the NIST Category 1 parameter set, the Primary attack achieves a 99.1% exact-recovery rate and the Secondary attack achieves a 99% exact-recovery rate, over 6000 independent keys. We also analyze potential countermeasures and show that independently shuffling the row processing order within each column reduces the success rate of our attack to negligible levels, providing protection against the specific attack vector demonstrated in this paper.
## 2026/1153
* Title: Search-Efficient Public-Key Authenticated Encryption with Keyword Search Made Easy
* Authors: Takeshi Yoshida, Keita Emura
* [Permalink](https://eprint.iacr.org/2026/1153)
* [Download](https://eprint.iacr.org/2026/1153.pdf)
### Abstract
Public-key authenticated encryption with keyword search (PAEKS), introduced by Huang and Li (Information Sciences 2017), was proposed to provide trapdoor privacy, whereby keyword information is protected from being revealed through trapdoors. To prevent the keyword guessing attack, however, a trapdoor needs to be generated separately for each sender, and the search complexity linearly grows with the number of senders even when searching for a single keyword. To address this inefficiency, we propose a generic construction of search-efficient PAEKS. We revisit the group-oriented approach of Wang et al. (IEEE Transactions on Information Forensics and Security 2024), in which senders are organized into sender groups. Our construction is simple yet effective where all senders belonging to the same group share a single public-secret key pair, and the search complexity depends only on the number of sender groups rather than the number of individual senders. We further introduce ciphertext indistinguishability against insiders, which ensures that no keyword information is revealed from ciphertexts, even if they are generated by other members of the same sender group. We also take into account an impossibility result by Yoshida and Emura (IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, 2026), which shows that trapdoor privacy against sender-group members cannot be achieved in the scheme of Wang et al. To address this limitation, we introduce trapdoor indistinguishability against outsiders, which guarantees that no keyword information is revealed from trapdoors generated for non-group members. Our generic construction yields search-efficient group-oriented PAEKS schemes from pairings and lattices.
## 2026/1201
* Title: Silentium revisited: Pseudorandom Beaver Triple Expansion
* Authors: Vincent Rieder, Enrico Sorbera
* [Permalink](https://eprint.iacr.org/2026/1201)
* [Download](https://eprint.iacr.org/2026/1201.pdf)
### Abstract
In the line of the SPDZ protocol for secure multi-party computation,
the generation of Beaver triples is the most expensive task.
Silentium (Rieder, PrivCryp 25) is the implementation of a Pseudorandom Correlation Generator (PCG) for Beaver triples (Boyle et al.,
Crypto 20). PCGs focus on low-communication costs., e.g. their PCG reduces
the communication by one order of magnitude compared to protocols
in MP-SPDZ. Silentium is an implementation of their PCG, achieving
similar running times than MP-SPDZ. We make three theoretical
contributions to Silentium, including an implementation. First, we make
a practical proposal how to generate Beaver triples over binary fields F2++, which extends the previous setting over prime fields. For this, we propose
a suitable instantiation of the Number Theoretic Transform. Second, we
show how to use the binary triples to construct what we call a Beaver
triple expansion scheme, that is we construct a scheme that expands a
small batch of Beaver triples into a large batch of Beaver triples, in the sense of recently established oblivious transfer extension schemes. This feature enables an efficient preprocessing stage for the PCG, closing a practical issue of Silentium. Finally, we provide details about the Silentium implementation, by clearing a technical bug in the initial theoretical
protocol description.
## 2026/1405
* Title: AsymSAE: Verifier-Based Asymmetric SAE Protocol for Personal Wi-Fi Networks
* Authors: Zhiqiang Zhao, Jingwei Jiang, Xuexian Hu, Wei Guo, Jiahui Gao, Yining Liu
* [Permalink](https://eprint.iacr.org/2026/1405)
* [Download](https://eprint.iacr.org/2026/1405.pdf)
### Abstract
Password-authenticated key exchange (PAKE) remains central to WPA3-Personal, the personal mode of the latest Wi-Fi security standard, where the Simultaneous Authentication of Equals (SAE) protocol enables secure Wi-Fi access via a low-entropy password. However, SAErCOs symmetric password authentication makes all associated stations (STAs) vulnerable once the network-edge access point (AP) is compromised. Although SAE+ (IEEE TIFS 2024) addresses this issue in the clientrCoserver model with verifier-based asymmetric authentication, its weak binding of the password-derived verifier, ephemeral randomness, and protocol transcripts still enables key-compromise impersonation (KCI) attacks and offline dictionary attacks. Therefore, designing a verifier-based asymmetric SAE protocol that preserves the SAE workflow while resisting these attacks remains challenging. To address this challenge, we propose AsymSAE, a verifier-based asymmetric SAE protocol tailored for personal Wi-Fi networks. Following the SAE workflow in IEEE Std 802.11-2024, AsymSAE realizes asymmetric authentication by allowing the STA and AP to use the user password and the password-derived verifier, respectively. We further formulate a verifier-based security model to capture the asymmetric structure, and prove the security of AsymSAE in this model. Heuristic security analysis and ProVerif verification demonstrate that AsymSAE provides forward secrecy, transcript-based offline dictionary attack resistance, AP-side KCI resistance, session-key confidentiality, and mutual authentication. Our performance evaluation, including ns-3-based network simulation, demonstrates that AsymSAE can achieve significant verifier-based security enhancement without incurring extra communication overhead, while introducing minimal additional computational overhead and authentication latency.
## 2026/1406
* Title: An $n^{n+o(n)}$-Time Algorithm for the Lattice Isomorphism Problem
* Authors: Divesh Aggarwal, Kaijie Jiang, Zihan Li, Yinchen Liu
* [Permalink](https://eprint.iacr.org/2026/1406)
* [Download](https://eprint.iacr.org/2026/1406.pdf)
### Abstract
The Lattice Isomorphism Problem asks whether two given lattices $\mathcal L_1$ and $\mathcal L_2$ are related by an orthogonal linear transformation. Haviv and Regev gave a seminal $n^{O(n)}$-time algorithm for this problem based on an isolation lemma (SODA 2014).
We give algorithms for the decision, search, and all-isomorphisms versions of the problem running in time $n^{n+o(n)}$ times a polynomial in the input size. The main new ingredient is a Gaussian heat argument over convex bodies generated by shortest vectors: for $w\sim D_{\mathcal L^*,s}$, the vector $w$ canonically determines $n-o(n)$ independent shortest vectors, leaving a residual instance of rank $o(n)$. The remaining residual dimensions are handled by an $n^{o(n)}$-time canonicalizer obtained by adapting the Haviv-Regev algorithm. We then combine this canonicalizer with a birthday argument to recover all isomorphisms.
For the all-isomorphisms version, this bound is asymptotically optimal in the worst case up to an $n^{o(n)}$ factor. As an extension, we also give, in the QRAM model, a quantum variant running in time $n^{\frac{2}{3}n+o(n)}$. It outputs a representative isomorphism together with generators for the automorphism group, thereby providing a compact description of the entire isomorphism coset.
## 2026/1407
* Title: HACC: A Scalable Hierarchical Accumulator with Sublinear Cost for Large Dynamic Sets
* Authors: Borui Chen, Liang Zhang, Dongliang Cai, Kexin Li, Jiamian Yan, Haibin Kan
* [Permalink](https://eprint.iacr.org/2026/1407)
* [Download](https://eprint.iacr.org/2026/1407.pdf)
### Abstract
Dynamic universal accumulators provide succinct set commitments for evolving datasets, but balancing efficiency and scalability remains challenging. In particular, Bilinear Pairing (BP) accumulators offer constant size witnesses, but their public parameters size and dynamic operation costs grow linearly with the global capacity of the set.
To address this bottleneck, we propose a trapdoorless hierarchical accumulator (HACC) that keeps BP-style efficient witness update and verification while avoiding this linear dependence. For a set of current size $n$ and a pre-defined parameter $t$ ($t \ll n$), HACC requires only $\mathcal{O}(t)$ public parameters, while supporting addition, deletion, and witness generation in $\mathcal{O}(t\log_t n)$ time, which is far more efficient than the $\mathcal{O}(n)$ costs of BP accumulators (Nguyen, CT-RSA'05, Damg\r{a}rd et al., eprint'08, and Srinivasan et al., CCS'22); moreover, HACC has $\mathcal{O}(\log_t n)$ sized witnesses with amortized $\mathcal{O}(1)$ witness updates. We further integrate polynomial multiproofs to reduce witness verification to constant pairing complexity in read-heavy epoch-based settings. We prove correctness and soundness of HACC under the $t$-SDH assumption in the random oracle model. Experimental results show that under comparable parameter budgets, HACC is $9.7\times$ -- $1803.4\times$ faster than BP accumulators for element update and witness generation, and consumes $34.6\times$ -- $3679.4\times$ smaller public parameters size.
## 2026/1408
* Title: Statistically Undetectable Backdoors in Deep Neural Networks
* Authors: Andrej Bogdanov, Alon Rosen, Neekon Vafa
* [Permalink](https://eprint.iacr.org/2026/1408)
* [Download](https://eprint.iacr.org/2026/1408.pdf)
### Abstract
We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under LWE) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.
## 2026/1409
* Title: Accelerating FAEST Signing on GPU via Fused AES Constraint Generation and Batched Leaf Hashing
* Authors: Ha-Gyeong Kim, Si-Woo Eum, Seung-Won Lee, Ui-Jae Kim, Min-Ho Song, Hwa-Jeong Seo
* [Permalink](https://eprint.iacr.org/2026/1409)
* [Download](https://eprint.iacr.org/2026/1409.pdf)
### Abstract
FAEST is a symmetric-key post-quantum digital signature scheme and a third-round candidate in the NIST Additional Digital Signatures standardization process. Its signing path concentrates cost in two operations: round-wise constraint generation, which proves in zero knowledge that the AES circuit is computed correctly, and finite-field multiplication, which computes the leaf nodes of a vector commitment. This paper accelerates both operations on a CUDA-enabled GPU, with AES round constraint generation as the main contribution. Specifically, we fuse the three consecutive stages that make up constraint generation into a fused GPU path and keep the intermediate results between stages resident in device memory, thereby reducing hostrCodevice data transfer. As a supporting measure, we batch independent finite-field multiplications for leaf nodes, jointly improving end-to-end signing performance. We verify the correctness of the implementation through byte-level output agreement with the CPU reference implementation. Combining fused constraint generation with batched leaf hashing, the full GPU path achieves up to roughly a 3|u end-to-end signing speedup over the CPU reference. Furthermore, when AES constraint generation fusion is added on top of leaf hashing that is already performed on the GPU, an additional reduction in signing latency is observed in five of the six evaluated AES s/f variants. The magnitude of this effect does not scale monotonically with the security parameter; rather, it is determined by the per-variant bottleneck structure.
## 2026/1410
* Title: A Memory-Efficient and Assembly-Optimized Implementation of NTRU+
* Authors: SuBeen Cho, Jiwon Bang, Minjoo Sim, Hwajeong Seo
* [Permalink](https://eprint.iacr.org/2026/1410)
* [Download](https://eprint.iacr.org/2026/1410.pdf)
### Abstract
This paper presents a memory-efficient and high-speed implementation of NTRU+, one of the key encapsulation mechanisms (KEMs) selected by KorearCOs post-quantum cryptography project (KpqC), on the ARM Cortex-M4. NTRU+ is small enough to run on its own on a Cortex-M4 class microcontroller, yet in real embedded environments, the peak stack occupied by polynomial buffers and the running time dominated by the NTT become key constraints. To address this, in the proposed technique, we reduce memory by analyzing when each polynomial buffer is actually live and restructuring the algorithm so that only a single buffer is resident during computation, and we significantly improve speed by rewriting the NTT for the mixed-radix structure of NTRU+ in Cortex-M4 assembly. By doing so, the assembly NTT acceleration compensates for the recomputation overhead introduced by the memory optimization, so that the combined implementation is both smaller and faster than the reference. Experimental results show that, relative to the KpqClean_ver2[1] reference implementation, the proposed technique reduces the peak stack by 83rCo84% while improving the speed of all three operations by up to 1.8|u.
## 2026/1411
* Title: Improved Quantum Circuits for Information Set Decoding with Application to Code-Based Cryptography
* Authors: Hyunji Kim, Kyungbae Jang, Hwajeong Seo
* [Permalink](https://eprint.iacr.org/2026/1411)
* [Download](https://eprint.iacr.org/2026/1411.pdf)
### Abstract
Information set decoding (ISD) is the standard generic decoding attack considered for code-based cryptography. A concrete quantum-resource estimate for Grover-accelerated ISD requires an oracle whose dominant component is GaussrCoJordan elimination.
We improve the elimination circuit of Perriello et al. [25] and Jang et al. [15] by not updating the entries that no later pivot or the final weight predicate reads. The required result vector is recovered by a parallel back-substitution on the syndrome register. For the target schemes, our elimination circuit improves the qubit count by about 22% compared to [15]. The Toffoli count improves by about 20% compared to both [25] and [15]. The Toffoli depth improves by about 67% compared to [25] but degrades by about 0.3% compared to [15].
We report logical resource estimates for the quantum ISD attack on HQC and Classic McEliece. The product of the total gate count and the full depth exceeds the NIST post-quantum security thresholds, and the full depth exceeds the MAXDEPTH upper bound.
We also provide fault-tolerant estimates of the physical qubit count and the runtime under a surface-code model with magic-state distillation. As one example, HQC-128 requires about $2^{43}$ physical qubits and about $2^{53}$ years at a 1 ++s code cycle.
## 2026/1412
* Title: Quantum Implementation and Analysis of Rijndael
* Authors: Gyeongju Song, Hwajeong Seo
* [Permalink](https://eprint.iacr.org/2026/1412)
* [Download](https://eprint.iacr.org/2026/1412.pdf)
### Abstract
We present a quantum resource estimation of the Rijndael variants
\[
N_b = N_k \in \{4,5,6,7,8\}, \qquad N_r = N_b + 6,
\]
under the NIST MAXDEPTH quantum cost model. Extending the AES quantum encryption oracle~\cite{ref5} parametrically to arbitrary $N_b = N_k$,
we generalize the in-place key schedule, including the single- and double-\texttt{SubWord} cases, the \texttt{ShiftRows} offsets, and the
round constants. We implement and verify the resulting oracles using
ProjectQ. The verified variants range from 1,624 qubits at a full depth
of 1,090 for Rijndael-128/128 to 3,240 qubits at a full depth of 1,839
for Rijndael-256/256. Under the NIST PQC MAXDEPTH bounds
$\{2^{40}, 2^{64}, 2^{96}\}$, the Grover key-recovery qubit cost in
$\log_2$ units ranges from $\{80.15, 32.15, 10.67\}$ for
Rijndael-128/128 to $\{210.65, 162.65, 98.65\}$ for
Rijndael-256/256. The standardized analogues at Categories 1, 3, and 5,
namely Rijndael-128/128, Rijndael-192/192, and Rijndael-256/256, meet
the corresponding AES-based bounds. The intermediate Rijndael-160/160
and Rijndael-224/224 variants provide reference points between the
standardized AES key lengths.
## 2026/1413
* Title: Optimizing ARIA-GCM on GPUs
* Authors: Min-Ho Song, Si-Woo Eum, Seung-Won Lee, Ha-Gyeong Kim, Hwa-Jeong Seo * [Permalink](https://eprint.iacr.org/2026/1413)
* [Download](https://eprint.iacr.org/2026/1413.pdf)
### Abstract
This paper proposes an optimized GPU implementation of the ARIA-GCM authenticated-encryption pipeline (CTR keystream, GHASH authentication, and their AEAD composition): ARIA-CTR uses a packed 32-bit S-box staged in shared memory, GHASH is optimized separately with a fixed-key 4-bit Shoup lookup table, the two stages are integrated as both a two-kernel and a fused single-kernel AEAD, and the same aria_gcm.cu source is tuned for Ampere and Pascal through compile-time parameters. For ARIA-CTR, the four distinct S-box tables are merged into one 1 KiB shared-memory table (R=1 staging) and each thread encrypts CTR_IPT counter blocks in parallel to fill the ALU-bound diffusion layer. For GHASH, each thread owns one segment of sblk blocks, applies W-way Horner interleaving with precomputed powers of H, and keeps the reduction table in shared memory. Experiments on an RTX 3090 and a GTX 1080 Ti show that packed S-box staging improves naive ARIA-CTR by 14.5|u, the Shoup LUT improves bit-serial GHASH by 21.5|u, and the tuned pipeline reaches 924 Gb/s (CTR), 2,865 Gb/s (GHASH), and 622 Gb/s (fused AEAD) on the RTX 3090. Using a simple sequential-composition model, we show that the GHASH optimization is what shifts the AEAD bottleneck onto ARIA-CTR: without it the pipeline would be GHASH-bound near 120 Gb/s, whereas the tuned GHASH makes CTR account for about three quarters of the per-byte cost. We back the analysis with Nsight Compute measurements of register usage, achieved occupancy, shared-memory bank conflicts, and DRAM traffic.
## 2026/1414
* Title: Evaluating Hybrid KEM/DSA for KpqC and NIST PQC on ARM Cortex-M4
* Authors: Minjoo Sim, Minwoo Lee, Subeen Cho, Yulim Hyoung, Hwajeong Seo
* [Permalink](https://eprint.iacr.org/2026/1414)
* [Download](https://eprint.iacr.org/2026/1414.pdf)
### Abstract
Primitive-only PQC benchmarks are insufficient for attributing composed hybrid costs on Cortex-M4 because shared hash backends, randomized-signature behavior, and fixed classical/wrapper work affect measured performance. We implement a common bare-metal Cortex-M4 harness for representative KpqC/NIST families, measuring uniform Hash-CT hybrid KEM benchmark rows with X25519 and Bindel et al. hybrid-signature AND-combiner rows. The goal is composed-cost attribution under a uniform benchmark transcript rather than primitive-only ranking.
Our measurements show three attribution effects. First, replacing only Keccak-f[1600] changes SHAKE-heavy signing by up to 2.16|u, while SPHINCSrU|-SHA2 and FN-DSA control rows remain at 1.00|u. Second, median-only signature tables can change deployment conclusions. In the nominal level-5 signing rows, HAETAE5 beats FN-DSA-1024 by median and mean latency, but its observed maximum reaches 4.53|u its median while FN-DSA-1024 remains essentially flat. Third, a local SMAUG-T backend improves standalone SMAUG-T by 1.79rCo1.82|u, but the visible gain drops to 1.42rCo1.65|u inside SMAUG-T+X25519 hybrids. Supporting KEM rows place lattice hybrids at 3.7rCo8.8 M cycles and HQC hybrids at 19.6rCo74.5 M cycles. Together, the results motivate reporting composed-cost attribution, backend provenance, and variance alongside primitive timings.
## 2026/1415
* Title: Optimized Implementation of Warp-Cooperative GPU HCTR2-ARIA Wide-Block Encryption
* Authors: Siwoo Eum, Minho Song, Seung-Won Lee, Hagyeong Kim, Hwajeong Seo
* [Permalink](https://eprint.iacr.org/2026/1415)
* [Download](https://eprint.iacr.org/2026/1415.pdf)
### Abstract
HCTR2 is a wide-block encryption mode that encrypts one fixed-size message as a single unit, so that flipping a single plaintext bit re-randomizes the whole ciphertext. Its main use is disk encryption, where the message is a disk sector. We instantiate it with ARIA, the Korean national block-cipher standard, and implement it on an NVIDIA RTX 4080 GPU. With many independent messages, assigning one thread per message keeps the device occupied. At low queue depth, however, most of the GPU sits idle, and encrypting one 16 KiB message is several times slower than a single CPU core. The reason is that one HCTR2 message is internally sequential, so it cannot simply be split across threads.
We present a fine-grained kernel in which one 32-thread warp cooperates on a single message. The kernel exploits the linearity of POLYVAL. It splits the long hash computation into contiguous per-thread pieces, has each thread compute a partial result, and combines the partials with warp shuffles to obtain exactly the same value as the sequential computation. This brings the latency of one message down to parity with a single CPU core (ARIA-256: 222 ++s on the GPU vs. 209 ++s on the CPU). Moreover, the number of threads per message and of messages per block acts as a knob that trades latency for throughput, spanning 222 ++s/30 GB/s to 1774 ++s/49 GB/s. With as few as four messages in flight the GPU already beats the CPU. We validate correctness for all three key sizes.
## 2026/1416
* Title: Beyond Size: Do Hybrid PQC Certificates Actually Enforce the ClassicalrCoPQC Binding? A Cost-and-Security Study
* Authors: Minwoo Lee, Minjoo Sim, Siwoo Eum, Subeen Cho, Yulim Hyoung, Hwajeong Seo
* [Permalink](https://eprint.iacr.org/2026/1416)
* [Download](https://eprint.iacr.org/2026/1416.pdf)
### Abstract
As TLS 1.3 migrates to post-quantum cryptography (PQC), hybrid X.509 transition strategiesrCoalternative-signature (Catalyst), Composite, Chameleon, and signature combinersrCoare compared on cost but rarely on whether they actually enforce the classicalraoPQC binding they promise. We show they often do not, and that the failure persists even in stacks that do check the binding. The same BouncyCastle library accepts a Catalyst certificate carrying a forged ML-DSA signature on its default path yet rejects it via an opt-in call; and wolfSSL, the only stack that checks a present alternative signature by default, cannot require one, so a stripped certificate is silently accepted (a path whose experimental build also shipped CVE-2026-5393). That no stack can mandate the binding is the surprise; that an ignored non-critical extension is skipped by nine verifiers is the expected X.509 baseline, which we reproduce with an independent non-BouncyCastle generator. Composite, by contrast, binds structurally (three verifiers across three OID families reject corruption of either half). Folding this measured enforcement axis into a four-axis cost model (strategy sizes differ by under 4.4%) overturns the cost-led recommendation: once enforcement is priced in, the compatibility winner Catalyst is displaced by a structurally-bound encodingrCoa combiner where the operator controls both endpoints, or Composite once a like-for-like P-256 pairing ships. A compatibility-led ranking can thus recommend a strategy whose PQC protection no deployed verifier enforces.
## 2026/1417
* Title: Accelerating the AIMer Post-Quantum Signature with AVX-512: A FieldrCoKeccak Speedup Analysis
* Authors: Seung-Won Lee, Si-Woo Eum, Hwa-Jeong Seo
* [Permalink](https://eprint.iacr.org/2026/1417)
* [Download](https://eprint.iacr.org/2026/1417.pdf)
### Abstract
AIMer is a post-quantum digital signature scheme with a conservative design. Its security relies only on the symmetric-key one-way function AIM2 and an MPC-in-the-Head (MPCitH) zero-knowledge proof. AIMer is a Korean post-quantum cryptography (KpqC) standard. However, the AIMer standard code released in January 2026 is a portable C reference implementation. It does not include processor-specific optimizations. As a result, it does not exploit AVX-512, a 512-bit vector instruction set available on modern processors. This paper presents an AVX-512 optimized implementation for all six AIMer variants. We parallelize binary-field multiplication with VPCLMULQDQ. The implementation processes four MPC parties per 512-bit register. We also handle conditional XOR accumulation in the linear layer with a single VPTERNLOGQ instruction. In addition, we accelerate the Keccak permutation using AVX-512VL. Our implementation is 1.60rCo1.84|u faster than the AVX2 implementation for signing. We further analyze the source of this speedup. Contrary to common intuition, most of the improvement comes from Keccak. In the 128-bit and 192-bit variants, Keccak accounts for about 86% of the total improvement. Only in the 256-bit variants does the field-arithmetic contribution increase to about 42%, due to the wider field size. These results show that vectorizing symmetric primitives is as important as binary-field arithmetic in MPCitH signatures. In some cases, it is even more important.
## 2026/1418
* Title: CT-KAT: A Multilayer Analysis Platform for Automated Screening of Constant-Time Risks in PQC C Implementations
* Authors: Seung-Won Lee, Min-Seo Kim, Su-Min Jeong, Hwa-Jeong Seo
* [Permalink](https://eprint.iacr.org/2026/1418)
* [Download](https://eprint.iacr.org/2026/1418.pdf)
### Abstract
Following the standardization of major post-quantum cryptography (PQC) algorithms, C implementations of ML-KEM, ML-DSA, and SLH-DSA have been rapidly deployed. However, known-answer tests (KATs) verify only functional correctness and do not establish the absence of timing leakage caused by secret-dependent branches, memory accesses, or variable-latency instructions. This paper presents CT-KAT, an integrated screening platform for assessing constant-time risks in PQC C implementations. CT-KAT is configured through a single YAML file. Using this configuration, it validates the build and KAT execution. It also automatically generates harnesses for the functions under analysis. It then performs several analyses within a unified pipeline. These include Valgrind/Memcheck-based structural checks, a ct-matrix over compiler and optimization-level combinations, and an assembly-level asm-scan. When configured, the pipeline also runs dudect-based timing tests. CT-KAT aggregates the results of these checks into a single verdict drawn from a nine-class taxonomy. CT-KAT does not treat a PASS result as proof of constant-time behavior. Instead, it applies a default-deny policy when assigning verdicts. It also provides supporting evidence to guide manual triage. When applied to a PQClean-based PQC corpus, CT-KAT produced four main classifications. The baseline ML-KEM target was classified as robust. The KyberSlash reproduction was flagged as a secret-dependent variable-latency risk, labeled varlat-secret-risk. The variable-time behavior of ML-DSA and SLH-DSA/SPHINCS+ was accepted under the label accepted-variable-time. Falcon-512 was retained for further analysis and labeled needs-analysis. These results show that CT-KAT provides a screening framework that integrates signals from multiple analysis layers while making the limitations of each tool explicit.
## 2026/1419
* Title: ML-QED-Lite: A Lightweight Machine Learning-Based Tool for Supporting Post-Quantum Cryptography Migration in Executable Binaries
* Authors: Seung-Won Lee, Hwa-Jeong Seo
* [Permalink](https://eprint.iacr.org/2026/1419)
* [Download](https://eprint.iacr.org/2026/1419.pdf)
### Abstract
To initiate migration to post-quantum cryptography (PQC), it is necessary to identify whether deployed software uses quantum-vulnerable (QV) public-key cryptographic schemes such as RSA, ECDSA, and DiffierCoHellman (DH). However, many ELF executables are distributed without source code, making it necessary to directly screen executable binaries for QV candidates. A prior tool, Quantum-vulnerable Executable Detection (QED), provides high precision but incurs substantial analysis cost, whereas its lightweight variant, QED-Lite, is faster but produces more false positives (FPs).
This paper proposes ML-QED-Lite, a machine learning-based approach designed to retain the efficiency of QED-Lite while reducing FPs. Unlike a post-filter that merely reclassifies candidates selected by QED-Lite, ML-QED-Lite directly takes all ELF executables in a target directory as input. For each file, it extracts function symbols, library dependencies, and binary-level attributes, and then uses a trained classification model to determine whether the file is a candidate for PQC migration.
The evaluation results show that ML-QED-Lite detects the same five positive executables as QED-Lite on the network dataset while reducing FPs from two to zero. On the synthetic dataset, ML-QED-Lite retains the same six positive executables while reducing FPs from four to zero. These results indicate that ML-QED-Lite preserves the true positives (TPs) identified by QED-Lite while reducing FPs, thereby improving the practicality of lightweight screening for PQC migration.
## 2026/1420
* Title: An Optimized Native Rust Implementation of the KpqC Algorithms
* Authors: Yu-Lim Hyoung, Do-Yun Park, Hyun-Ji Kim, Hwa-Jeong Seo
* [Permalink](https://eprint.iacr.org/2026/1420)
* [Download](https://eprint.iacr.org/2026/1420.pdf)
### Abstract
This paper presents a native Rust implementation of the Korean post-quantum cryptography algorithms (i.e., NTRU+, SMAUG-T, HAETAE, AIMer). We optimize the implementation in Rust for speed and memory usage, and compare our implementation with the C reference code (KpqClean) and unoptimized Rust implementation (baseline).
For speed, we use AVX2 and PCLMULQDQ to accelerate NTT- and ToomrCoCook-based polynomial multiplication, 4-way SHAKE, and carry-less GF(2^++) multiplication. Compared to the C reference, the speed-optimized version reduces the execution time by 32rCo76% across all target schemes.
For memory, we reduce large temporary buffers through on-the-fly approach, two-pass sampling, and transcript recomputation. Against the C reference, the memory-optimized implementation reduces the total memory usage by 1rCo94% across all target schemes.
Overall, these results show a speedrComemory trade-off, letting an implementation be chosen according to whichever resource is more constrained.
## 2026/1421
* Title: A Cryptographic Perspective on California's Delete Request and Opt-out Platform
* Authors: Aarushi Goel, Gabriel Kaptchuk, Peihan Miao, Phuoc Van Long Pham, Satvinder Singh, Rachel E. Thomas
* [Permalink](https://eprint.iacr.org/2026/1421)
* [Download](https://eprint.iacr.org/2026/1421.pdf)
### Abstract
The California Consumer Privacy Act (CCPA) grants consumers the right to request deletion of personal data held by registered data brokers. CaliforniarCOs 2023 Delete Act provides a new mechanism through which consumers can exercise this right by leveraging a centralized Delete Request and Opt-out Platform (DROP), enabling users to submit a single request that must be periodically processed by all registered data brokers. Since this platform aggregates sensitive user information, it is intentionally designed with safeguards against information leakage and unauthorized disclosure. This legislation, and the system it introduces, are positioned to serve as a template for wider deployment, with copy-cat legislation already introduced in many US states.
In this document, we evaluate the privacy architecture of the first-generation DROP system from a cryptographic perspective. The proposed design relies on hash-based record linkage---a widely used technique that offers heuristic rather than rigorous privacy guarantees. We begin by analyzing the inherent risks of this approach and identifying simple, lightweight modifications that can modestly improve its privacy guarantees by making it more difficult for malicious actors to exploit these vulnerabilities.
We then contrast this approach with Private Set Intersection (PSI), a class of provably secure cryptographic protocols that only reveal the intended matching records and nothing more. For future iterations of DROP, we propose a comprehensive PSI-based redesign, arguing that it would substantially reduce the risk of accidental information leakage while incurring only moderate additional computational overhead. Next, we highlight how DROP presents a compelling application for advanced variants of PSI with extended functionalities and stronger security guarantees, and we outline several research directions for the cryptography community, motivated by the unique requirements of such systems. Finally, we identify systemic risks that cannot be mitigated by PSI alone and discuss potential complementary approaches for addressing these broader challenges.
We hope this document serves as a common starting point for the cryptography and policy communities working to design future data deletion systems.
## 2026/1422
* Title: LESS on the Cortex-M4: Characterizing the SpeedrCoMemory Design Space of Code-Equivalence Signatures
* Authors: Minwoo Lee, Minjoo Sim, Subeen Cho, Yulim Hyoung, Hwajeong Seo
* [Permalink](https://eprint.iacr.org/2026/1422)
* [Download](https://eprint.iacr.org/2026/1422.pdf)
### Abstract
LESS is a code-based signature scheme built on the linear equivalence problem and, in its v2.0 round-2 form, a candidate in the NIST call for additional post-quantum signatures. No microcontroller implementation of it has been reported: the official benchmarking effort for the additional signatures excluded it on memory grounds, and an x86-massif cross-check puts the reference's peak stack at up to $\approx 836$~KB---beyond the SRAM of even the largest mainstream Cortex-M4. This paper provides the first such implementation, to the best of our knowledge---a complete characterization of LESS (v2.0) on the Arm Cortex-M4 across all seven parameter sets. NIST did not advance LESS to the third round in May 2026; we develop the implementation techniques and the evaluation methodology to outlast that outcome.
We map the speed--memory design space with three operating points, all byte-identical to the NIST known-answer tests. The primary point is a \emph{balanced} configuration signing $4.1$--$4.3\times$ faster than the platform-normalized reference while using $41$--$59\%$ less peak stack. With double-pass signing at category~5, it is the only configuration whose signing we measured on target across all seven sets---at category~5, the resident-matrix configurations exceed the device's 640~KB of SRAM. It is flanked by a \emph{speed ceiling} at $4.5$--$4.7\times$ (at reference-level memory) and a \emph{memory floor} that signs with about a one-kilobyte measured stack at only $1.2$--$1.5\times$ reference time at category~1, with key generation on par with or below reference cost---so at category~1, memory minimization is nearly free.
The speedups rest on three increasingly platform-specific layers: algorithmic restructuring, intrinsic-free two-lane SWAR (SIMD-within-a-register) arithmetic for $\mathbb{F}_{127}$ with a lazy-reduction scheme, and hand-scheduled assembly kernels---including a rank-2 row-elimination kernel---together with a systematic audit of all kernels against the Cortex-M4 timing rules. Read against the reference's own profile, these results indicate that implementation maturity, not the scheme, accounts for a $>4\times$ swing in achievable microcontroller signing---a data point for standardization-time performance evaluation, offered without revisiting the decision.
We further report a catalog of negative results (techniques that help on desktop SIMD but hurt on the M4) and an alignment-safe transpose that returns $\approx 170$~KB of static memory to the stack under an \texttt{-O3} build. The evaluation methodology---Pareto-monotone adoption criteria, byte-identical correctness gates, and coverage and ablation reporting---transfers to the surviving third-round candidates, for which NIST has explicitly called for constrained-device evaluation.
## 2026/1423
* Title: CMALU: Compact Fault-Tolerant Modular Arithmetic Logic Unit for Post-Quantum Cryptography
* Authors: YoungBeom Kim, Malik Imran, Zain Ul Abideen, Ciara Rafferty, Ayesha Khalid, M|iire OrCONeill, Seog Chung Seo
* [Permalink](https://eprint.iacr.org/2026/1423)
* [Download](https://eprint.iacr.org/2026/1423.pdf)
### Abstract
The rise of quantum computing threatens widely deployed public-key cryptosystems, driving the adoption of post-quantum cryptography (PQC) algorithms that rely heavily on modular arithmetic. Existing hardware accelerators of the PQC algorithms for resource-constrained Internet-of-Things (IoT) devices remain limited and lack integrated fault detection mechanisms. In this work, we present CMALU, a Compact, fault-tolerant Modular Arithmetic Logic Unit supporting six operations on a single reconfigurable datapath, with a 2-bit input selecting Mode-0 (un-protected baseline), Mode-1 (on-the-fly parity and invariant checking with a formal single-bit detection guarantee), and Mode-2 (extending Mode-1 along with hardware-reuse recomputation for deterministic silent data corruption (SDC) elimination without datapath duplication). Under system-level fault injection into CMALU internal registers on an NTT accelerator and an Ibex RISC-V core running ML-KEM-512, Mode-1 achieves 100% single-bit and stuck-at detection at zero latency overhead, and Mode-2 achieves 0% SDC. The synthesis results after the post-place-and-route stage on a field-programmable gate array (FPGA) and application-specific integrated circuit (ASIC) implementations with the NTT accelerator targeting 65nm CMOS and the Ibex RISC-V integration targeting Nangate45 45nm confirm CMALU's suitability for resource-constrained IoT deployment.
## 2026/1424
* Title: Repeated Masks, Predictable Splices: Breaking AESpolyW and Its AE Applications
* Authors: Shuping Mao, Peng Wang, Jiadong Han, Tingting Guo, Yan Jia, Ying Chen
* [Permalink](https://eprint.iacr.org/2026/1424)
* [Download](https://eprint.iacr.org/2026/1424.pdf)
### Abstract
AESpolyW, proposed at IEEE S&P 2026, is a wide-block encryption mode designed to exploit instruction-level parallelism between AES and polynomial hashing. Although AESpolyW achieves high throughput and outperforms HCTR2 and EME on most tested platforms, we show that AESpolyW does not achieve strong tweakable-PRP security. Our attack requires only two encryption queries and one decryption query, and distinguishes AESpolyW from an ideal tweakable permutation with advantage close to one. We further show that this weakness directly compromises Encode-then-Encipher authenticated encryption (AE) instantiated with AESpolyW. For the appended-zero, prepended-zero, and inserted-zero variants, we construct fresh ciphertext forgeries that are accepted with probability one. The same attacks also yield chosen-ciphertext plaintext disclosure and complete IND-CCA breaks. These results are structural and do not rely on any weakness of AES, the polynomial hash, or PHASH.
## 2026/1425
* Title: Simultaneous-Message and Succinct Secure Computation: Reusable and Multiparty Protocols
* Authors: Siddharth Agarwal, Abhishek Jain, Akshayaram Srinivasan, David J. Wu * [Permalink](https://eprint.iacr.org/2026/1425)
* [Download](https://eprint.iacr.org/2026/1425.pdf)
### Abstract
Recently, Boyle, Jain, Servan-Schreiber, and Srinivasan (EUROCRYPT 2025) introduced the notion of simultaneous-message and succinct (SMS) secure computation. In an SMS protocol, after an initial sampling of a common reference string (CRS), two partiesrCoAlice (with a large input) and Bob (with a small input)rCocan simultaneously exchange encodings of their private inputs and obtain additive shares of the output of a function evaluated over their inputs. The key requirement is succinctness: namely, the sizes of the CRS and each input encoding grow only polylogarithmically in the size of Alice's input and the function output. Boyle et al., and independently Abram, Malavolta, and Roy (STOC 2025), constructed SMS for all bounded-depth Boolean circuits from the plain learning with errors (LWE) assumption.
In this work, we extend the study of SMS along two new dimensions:
Reusable SMS: In this setting, the same input encodings can be reused to compute multiple functions.
Multiparty SMS: In the multiparty setting, we consider computations over one large input and multiple small inputs. Succinctness in this case means the size of the CRS and input encodings can grow with the total length of the small inputs (but polylogarithmically with the length of the long input and the size of the function output).
Assuming polynomial hardness of LWE (with a sub-exponential modulus-to-noise ratio), we construct reusable two-party SMS for all bounded-depth Boolean circuits with polylogarithmic communication. By additionally assuming indistinguishability obfuscation, we present a generic compiler from reusable two-party SMS to reusable multiparty SMS.
Our construction of reusable two-party SMS from LWE relies on a new "dual-use" technique where we reuse an LWE secret key between a lattice-based algebraic homomorphic MAC and a lattice-based homomorphic encryption scheme. This dual-use technique allows us to bootstrap a reusable SMS protocol for quadratic functions into one that supports arbitrary (bounded-depth) Boolean circuits. Along the way, we also show how to adapt a previous lattice-based algebraic homomorphic MAC based on ring LWE to obtain one based on the plain LWE assumption.
## 2026/1426
* Title: Coupling Leakage in Theory and Practice - Unveiling (Post-PnR) Security Flaws in Masked FPGA-Mapped Designs
* Authors: Nicolai M|+ller, Daniel Lammers, Simon Osterheider, Amir Moradi
* [Permalink](https://eprint.iacr.org/2026/1426)
* [Download](https://eprint.iacr.org/2026/1426.pdf)
### Abstract
With the widespread adoption of Field Programmable Gate Arrays (FPGAs) in security-critical industries such as defense and telecommunications, ensuring the confidentiality of sensitive data processed by these devices has become paramount. Side-Channel Analysis (SCA) poses a significant threat, necessitating the protection of cryptographic primitives through effective and efficient countermeasures. Within the framework of well-established formal adversary models, Boolean masking offers provable resistance to SCA by randomizing sensitive intermediate computations using ShamirrCOs secret sharing. However, the secure and efficient implementation of Boolean masking in hardware presents a complex and error-prone challenge. Physical effects such as glitches, transitions, and couplings can undermine essential security assumptions, potentially weakening the effectiveness of masking. Although robust masking schemes are designed to maintain their security in the presence of glitches and transitions, and their secure implementation can be verified at the gate level using a wide range of automated verification tools rCo albeit mostly for Application-Specific Integrated Circuits (ASICs) and not FPGAs rCo leakages caused by coupling effects remain undetectable by such tools, as they occur at a lower abstraction level.
In this work, we focus on detecting (low-level) vulnerabilities in masked FPGA designs through experimental and tool-assisted evaluation. The flaws that we target are not detectable at the Register Transfer Level (RTL ) level, and in some cases, not even at the gate level, as they arise from optimizations introduced during synthesis or implementation, or from the specific outcomes of the Place and Route (PnR) process. We demonstrate that these flaws are not only theoretically concerning, but can lead to observable leakages in practical experiments. Furthermore, we show how to formally abstract, unveil, and mitigate such leakages, thereby enabling a security-aware FPGA design flow that spans from the behavioral to the physical level. As an example, we implement all the evaluation steps presented as an extension of PROLEAD and validate its accuracy and effectiveness through practical case studies.
## 2026/1427
* Title: SPiRiT: Verifiable Contact Tracing for Balanced Security, Privacy, and Safety
* Authors: Reyhaneh Rabaninejad, Azra Abtahi, Antonis Michalas, Amir Aminifar
* [Permalink](https://eprint.iacr.org/2026/1427)
* [Download](https://eprint.iacr.org/2026/1427.pdf)
### Abstract
Digital contact tracing systems play a pivotal role in mitigating the spread of infectious diseases during pandemics by identifying individuals exposed to confirmed cases. In decentralized privacy-preserving contact tracing protocols, users broadcast pseudo-random IDs and, upon infection, upload the relevant IDs to a cloud server. Other users can then download these IDs to determine if they have been in proximity to infected individuals.
However, existing protocols often lack verifiability, implicitly assuming honest user behavior when uploading data to the server. This gap creates vulnerabilities, including false positives and false negatives, which hinder the widespread adoption crucial for the effectiveness of contact tracing apps.
This paper introduces SPiRiT, a secure and privacy-preserving verifiable contact tracing protocol, designed to address these shortcomings by introducing verifiability, ensuring the legitimacy of uploaded IDs, while still maintaining user privacy.
Verifiability ensures whether an upload contains a valid set of pseudo-random IDs with respect to the contagious period of the infected individual, and that the individual claiming those IDs is the legitimate owner, in a privacy-preserving manner.
The goal of our design is to maintain a balance between the competing objectives of privacy, security, and decentralization while fostering greater public trust and adoption by addressing the aforementioned vulnerabilities.
Through rigorous evaluation using a face-to-face individual interaction dataset, we demonstrate that SPiRiT not only reduces false alarms but also can be on par with or even outperform existing protocols in detecting high-risk contacts.
## 2026/1428
* Title: Highly Efficient Consistent Broadcast Encryption
* Authors: Konstantin Gegier, Eike Kiltz, Roman Langrehr, Guilherme Rito
* [Permalink](https://eprint.iacr.org/2026/1428)
* [Download](https://eprint.iacr.org/2026/1428.pdf)
### Abstract
Public Key Encryption for Broadcast ($\mathsf{PKEBC}$) is a multi-recipient encryption primitive that guarantees decryption consistency across all designated recipients. Concretely, if a ciphertext $c$ is encrypted for Bob and Charlie, and BobrCOs decryption yields a message $m$, then CharlierCOs decryption of $c$ must also succeed and produce the same $m$. This property, though seemingly natural, is essential in secure group messaging, where consistent message delivery is often implicitly assumed. However, no efficient constructions of $\mathsf{PKEBC}$ currently exist: known approaches achieve consistency through Non-Interactive Zero-Knowledge ($\mathsf{NIZK}$) proofs of generic statements. Not only is the complexity of the $\mathsf{NIZK}$ statements already prohibitively expensive, but, in addition, it is not even clear if these can be turned into purely algebraic statements while retaining linear-sized ciphertexts. This is crucial to enable the use of efficient $\mathsf{NIZK}$ constructions.
This paper presents new generic $\mathsf{PKEBC}$ constructions along with optimized instantiations of each. Concretely, we introduce $\mathsf{PKEBC}_{\mathsf{SM}}$ and $\mathsf{PKEBC}_{\mathsf{FO}[\mathsf{mPKE}]}$, and prove the security of these constructions in the standard and random oracle models, respectively.
rCo $\mathsf{PKEBC}_{\mathsf{SM}}$ achieves consistency via $\mathsf{NIZK}$ proofs. Crucially, we hand-tuned the $\mathsf{NIZK}$ statements of our instantiation to ensure the $\mathsf{NIZK}$ is only used to prove very simple and carefully optimized purely algebraic statements.
rCo $\mathsf{PKEBC}_{\mathsf{FO}[\mathsf{mPKE}]}$ achieves consistency via the Fujisaki-Okamoto ($\mathsf{FO}$)
transform (CRYPTO 1999 and Journal of Cryptology 2013) applied to a Multi-Recipient Public Key Encryption scheme ($\mathsf{mPKE}$). Specifically, $\mathsf{NIZK}$'s ciphertext recomputation during decryption ensures ciphertexts are well-formed, eliminating the need for costly $\mathsf{NIZK}$ proofs. We then give two suitable $\mathsf{mPKE}$ instantiations: one based on KurosawarCOs $\mathsf{mPKE}$ (PKC 2002) and the other from Hash Proof Systems.
For all our schemes and their instantiations, ciphertext sizes and encryption and decryption times grow linearly with the number of receivers. Our constructions therefore enable the first practical group messaging applications with consistency guarantees.
## 2026/1429
* Title: Structured Search for a Separable Subclass of Generalized Integral Properties
* Authors: Dongchen Chai, Shenghu Hu, Thomas Peyrin, Zilong Wang, Trevor Yap, Hongyi Zhang, Liu Zhang, Chunning Zhou
* [Permalink](https://eprint.iacr.org/2026/1429)
* [Download](https://eprint.iacr.org/2026/1429.pdf)
### Abstract
Generalized integral properties extend classical integral distinguishers, but their search is hindered by the size of the generalized function space. In this work, we study a structured and tractable subclass of generalized integral properties by restricting the generalized Boolean function to a separable form. This separable restriction decouples the plaintext side from the ciphertext side, thereby casting the search as the interplay between plaintext-side suppression of propagation sources and ciphertext-side cancellation of unknown monomials. On the plaintext side, we consider a structured space generated by linear combinations of basic plaintext structures; on the ciphertext side, we work in a degree-bounded Boolean candidate space. This yields an explicit and controllable search space while still capturing meaningful extensions of classical integral distinguishers.
Based on this formulation, we develop two matrix-based solving strategies that avoid exhaustive enumeration of the mapping space. The first is a unified MBM (Matrix--Bipartite graph--Matrix) framework, which reduces the joint search to a Boolean constraint system amenable to MILP. The second is a specialized solver for fixed plaintext structures, where the search for ciphertext-side low-degree mappings is reduced to a linear cancellation system and solved by Gaussian elimination. Experiments confirm the practical effectiveness of the proposed methods. For SPECK and SIMON, our search extends the number of rounds covered by mapping-based integral distinguishers. In particular, for SPECK, whose modular-addition structure makes integral modeling considerably more challenging, the proposed framework still yields improved distinguishers. For PRESNET, RECTANGLE, and SKINNY, our methods identify additional balanced integral properties beyond those captured by previous approaches. These results show that structured search provides a practical way to broaden the reach of automated integral analysis across different cipher families.
## 2026/1430
* Title: TRAPGC-DV: Trapdoor Garbled Circuit Designated Verification of Groth16 on Bitcoin
* Authors: Ariel Futoransky, Fadi Barb|ara, Ramses Fernandez, Gabriel Larotonda, Sergio Demian Lerner
* [Permalink](https://eprint.iacr.org/2026/1430)
* [Download](https://eprint.iacr.org/2026/1430.pdf)
### Abstract
Verifying Groth16 proofs on Bitcoin enables a broad class of trust-minimised applications, bridges, light clients, validity rollups, but Bitcoin script lacks the pairing operations required to evaluate the verification equation natively. A recent line of work on Bitcoin-side garbled-circuit SNARK verification (Delbrag, BitVM3, BitVMX-GC, Glock, Argo MAC) has produced practical constructions but does not provide formal universal-composability analysis.
We present $\Pi_{\mathsf{DV\text{-}Groth16}}$, a protocol for designated evaluation of Groth16 proofs on Bitcoin. The prover holds a standard Groth16 proof $\pi_{\mathsf{in}}$ under a public, one-time ceremony SRS. The verifier generates, from a secret seed, a compact per-session trapdoor SRS for a fixed outer circuit, the inner Groth16 verifier, computed natively over a one-layer 2-chain (BLS12-377 inside BW6-761), and proves it well-formed. The prover produces an outer Groth16 proof that her inner proof verifies, and garbles a small circuit that checks the outer proof in scalar form: after the verifier reveals his seed, the prover signs the discrete logarithms of her pre-committed outer proof elements, and the circuit checks them against the commitments together with the scalarized verification identity, releasing a slashing key on failure. Cut-and-choose enforces garbling correctness; deposits and commitments are locked in Bitcoin UTXOs with a three-tier settlement (refund, slash-fast, slash-commit). The per-session SRS has fixed size, independent of the assertion circuit, and all elliptic-curve computation inside the garbled circuit reduces to three fixed-base scalar multiplications.
We prove that $\Pi_{\mathsf{DV\text{-}Groth16}}$ GUC-emulates an ideal functionality $\mathcal{F}_{\mathsf{DV\text{-}Groth16}}$ capturing the three-tier behaviour against static corruption in the GUC-hybrid model, with a concrete bound assembled from named primitive advantages. We make precise how designated evaluation and enforcement differs from designated-verifier deniability, and exhibit a variant achieving the latter at the cost of a per-proof SRS for the assertion circuit itself.
## 2026/1431
* Title: The Isogeny Problems
* Authors: Wouter Castryck, Luca De Feo, Steven D. Galbraith, P|-ter Kutas, Krijn Reijnders, Benjamin Wesolowski
* [Permalink](https://eprint.iacr.org/2026/1431)
* [Download](https://eprint.iacr.org/2026/1431.pdf)
### Abstract
This work contains an exposition of the seven foremost unsolved problems in the domain of isogeny-based cryptography, obtained by asking eleven experts in isogeny-based cryptography what they considered to be the most important unsolved problems in isogeny-based cryptography, and curated down to the seven problems in this document. For each problem, an expert wrote a short write-up giving the precise statements and descriptions per problem.
## 2026/1432
* Title: ReedrCoSolomon Mutual Correlated Agreement Beyond the Johnson Radius
* Authors: Sunghyeon Jo
* [Permalink](https://eprint.iacr.org/2026/1432)
* [Download](https://eprint.iacr.org/2026/1432.pdf)
### Abstract
Mutual correlated agreement (MCA) bounds how many points on an affine line of received words can agree with codewords on many coordinates when the line does not admit a common codeword explanation on those coordinates; the corresponding line parameters are called bad. MCA arises in the soundness analysis of code-based proof systems. For Reed-Solomon codes with arbitrary prescribed evaluation sets, existing deterministic bounds apply only at integer error budgets strictly below the exact Johnson boundary.
Fix integers $r\ge2$ and $h\ge1$. For every sufficiently large $K$, let $L\subseteq\mathbb{F}_q$ be any set of $n=rK$ distinct points and set $C=\operatorname{RS}_{<K}(\mathbb{F}_q,L)$. At error budget $E=\left\lfloor{n-\sqrt{n(K-1)}}\right\rfloor+h$, we prove that every affine line has at most $O_{r,h}(K^6)$ bad parameters. Hence
\[
\varepsilon_{\mathrm{mca}}(C,E)=O_{r,h}(K^6/q).
\] Thus, at each fixed rate $1/r$, any fixed number of integer steps
beyond Johnson admits a deterministic polynomial bound on the number of bad parameters; in relative-radius units, the gain is $O(1/n)$.
We also derive a MCA upper bound for maximum distance
separable (MDS) codes from a sharp lower bound on the number of rejected
local membership tests. For Reed-Solomon codes over sufficiently large
fields, the resulting endpoint bound is exact whenever at most $K+1$
agreements are required. It yields exact $2^{-128}$ thresholds for four explicit smooth-domain codes of length $64$: we identify the largest safe integer budget and prove that the next one is unsafe.
As a concrete application to the Grand MCA Challenge, we exhibit a single prime field $\mathbb{F}_Q$, with $Q<2^{256}$, that supports the required smooth domains at all four target rates. With $K=2^{18}$, the first post-Johnson budget has MCA error below $2^{-128}$ at rates $1/2,1/4,1/8,$ and $1/16$, as does the second such budget at rate $1/8$.
## 2026/1433
* Title: Shuffled-ArgMax: Securing ArgMax Decisions Against Side-Channel-Guided Fault Injection in Edge-AI IoT Devices
* Authors: Le Wu, Liji Wu, Yuyang Pan, Xiangmin Zhang, Jian Wu
* [Permalink](https://eprint.iacr.org/2026/1433)
* [Download](https://eprint.iacr.org/2026/1433.pdf)
### Abstract
Edge-AI Internet-of-Things (IoT) devices increasingly perform local neural-network inference in physically accessible environments. While prior physical attacks on neural networks mainly focus on model extraction, parameter recovery, or intermediate computation, the final decision stage remains insufficiently studied. This paper investigates the physical security of ArgMax-based decision logic, which converts output scores into the final class label in many edge-AI deployments. We show that a sequential ArgMax implementation can expose deterministic power-trace patterns associated with loop iterations and conditional maximum updates. These patterns can be used to recover decision-related timing information and guide voltage fault injection, enabling targeted redirection of the final inference result. We implement the attack on a real MCU-based edge-AI platform using an STM32F407VG device running an X-CUBE-AI-deployed convolutional neural network. Under dual-point voltage fault injection, the unprotected ArgMax achieves targeted redirection to all non-original classes in the MNIST case study. To mitigate this threat, we propose Shuffled-ArgMax, a lightweight software-level defense that combines randomized traversal, loop-integrity checking, and redundant decision verification. Experimental results show that, under the same attack setting, Shuffled-ArgMax reduces the targeted redirection success rate from 56.92% to 0%, demonstrating strong resilience against targeted misclassification attacks. Meanwhile, it introduces only a small end-to-end runtime overhead relative to the complete DNN inference.
## 2026/1434
* Title: BeeKEM: Decentralized, Secure and Efficient Group Key Agreement
* Authors: Derek Yen, Andr|-s F|ibrega, Liangrun Da, Martin Kleppmann, John Mumm, Sunoo Park, Brooklyn Zelenka
* [Permalink](https://eprint.iacr.org/2026/1434)
* [Download](https://eprint.iacr.org/2026/1434.pdf)
### Abstract
Group key agreement protocols are essential for modern secure messaging. Most existing group key agreement protocols assume a centralized model with a semi-trusted service that mediates the communication. This is efficient, but problematic for some important applications, since a central service can be a choke point for surveillance and censorship. There is a nascent literature on decentralized group key agreement that avoids such reliance, but existing proposals either do not scale, with update costs linear or quadratic in the group size, or lack proofs of security. Centralized protocols can offer much lower (logarithmic) cost.
We present BeeKEM, the first decentralized group key agreement protocol with logarithmic update cost in the common case (degrading to linear in the worst case) and proofs of security. We provide an open-source implementation and demonstrate that it is competitive with OpenMLS. BeeKEM opens the door for a range of communication and collaboration applications offering not only end-to-end encryption, but also metadata privacy and censorship resistance.
## 2026/1435
* Title: FiltrumVote: Scalable, Verifiable, and Coercion-Resistant Internet Voting
* Authors: Leonardo Kimura, Dimitri Leskow, Diego F. Aranha, Roberto Ara||jo, Marcos Simplicio
* [Permalink](https://eprint.iacr.org/2026/1435)
* [Download](https://eprint.iacr.org/2026/1435.pdf)
### Abstract
Internet voting can increase voter turnout and reduce operational costs; however, it also facilitates voter coercion. One compelling approach to address this issue is deniable vote updating, which allows voters to cast multiple ballots while counting only their final vote. Despite its intuitive appeal, achieving deniable vote updating together with verifiability and scalability has proven challenging. Therefore, we present FiltrumVote, a scalable, publicly verifiable, and coercion-resistant Internet voting system based on deniable vote updating. It has a quasi-linear cleansing phase, and it is built mainly from zero-knowledge proofs with standard $\Sigma-$protocol techniques. As a result, FiltrumVote is highly scalable: a standard computer takes less than 5 hours to prove all zero-knowledge proofs for one million votes.
## 2026/1436
* Title: Verifiable and Collusion-Resistant Multi-Party Quantum Private Set Operations
* Authors: Zixian Gong, Kun Tian, Yi Zhang, Fengxia Liu
* [Permalink](https://eprint.iacr.org/2026/1436)
* [Download](https://eprint.iacr.org/2026/1436.pdf)
### Abstract
Private set intersection (PSI) and, more broadly, private set operations (PSO) are fundamental primitives for secure multiparty computation (SMC), enabling participants to jointly compute set relations while revealing no information beyond the prescribed output. As quantum technologies advance, PSI have correspondingly evolved toward quantum secure phase. Existing quantum PSI (QPSI) solutions are limited in their threat models and collusion behavior between third party (TP) and participants. In this work, we present a multi-party QPSI (MP-QPSI) protocol that integrates verifiable quantum fully homomorphic encryption (vQFHE) as the verifiable outsourced quantum-evaluation layer and threshold fully homomorphic encryption (TFHE) as the threshold key-management mechanism. We instantiate the intersection computation via a \(C^{\mathsf{AND}}\) circuit accompanied by simulations on IBM Quantum Platform. We analyze correctness and participant privacy against TP, external eavesdroppers, and collusive behaviors, and we further prove verifiability against a malicious TP under the semantic security model. Finally, we present a modular framework perspective with several realizations, show how to extend the construction to quantum private set union (QPSU) via open-controlled operations. Compared with prior schemes, our protocol provides flexible set operations and stronger resilience under the TP model, including TP-participant collusion, thereby offering enhanced security and broader applicability.
## 2026/1437
* Title: SoK: On the Design of Secure Ranking-based E-voting Systems
* Authors: Luke Harrison, Feng Hao, Bowen Zheng, Bingsheng Zhang
* [Permalink](https://eprint.iacr.org/2026/1437)
* [Download](https://eprint.iacr.org/2026/1437.pdf)
### Abstract
Vote privacy and verifiability are two fundamental properties which must be maintained for elections. Studies in e-voting technology have demonstrated how elections may be secured through cryptographic techniques including mix-nets, homomorphic encryption, and Zero Knowledge Proofs (ZKPs). The implications and trade-offs that must be considered when designing an e-voting system using multiple cryptographic techniques for simple majority or plurality voting are well understood in the literature. However, it is less clear how these techniques affect the design process for complex e-voting systems such as those based on ranked voting. Examples include Borda count, Condorcet voting, Instant Runoff Voting (IRV), and Single Transferable Vote (STV). In this paper, we systematically analyse the cryptographic design of ranking-based e-voting systems in the literature and explore how the cryptographic techniques utilised by such systems affect the strength of their security guarantees including vote privacy and verifiability. In addition, we explore how their cryptographic designs impact social choice properties including support for various counting functions as well as flexibility in vote casting. Our findings demonstrate that ranked e-voting systems may be largely classified according to the degree of information leakage present in each solution, and that systems belonging to each of these categories share similar properties and usage of cryptographic techniques. We then discuss an overview of our findings and identify a number of open problems following our analysis. Overall, this paper serves as a comprehensive study on the state-of-the-art for secure ranked e-voting systems in the literature.
## 2026/1438
* Title: Vela and Carina: Fast Pairing-Based Multilinear Polynomial Commitments from Reciprocal Polynomials
* Authors: Yuncong Zhang
* [Permalink](https://eprint.iacr.org/2026/1438)
* [Download](https://eprint.iacr.org/2026/1438.pdf)
### Abstract
Pairing-based multilinear polynomial commitments offer succinct verification for sum-check-based proof systems, but existing schemes trade prover group work against proof size and verifier cost. Building on Mercury's representation of a multilinear evaluation as the constant coefficient of a Laurent polynomial, we construct two schemes with different performance trade-offs. Vela uses inversion symmetry to derive a half-length auxiliary polynomial and opens two polynomials at $z$ and $z^{-1}$ with one univariate KZG proof. It has a $2G_1+4F$ proof, a two-term pairing check, and approximately $2N$ opening MSM scalars, at the cost of $O(N\log N)$ field operations. Carina applies the same constant-term reduction once in each coordinate and jointly proves evaluation claims for the committed bivariate polynomial and two auxiliary polynomials with one grid opening. For $N=2^{\mu}$ and $b=\sqrt{N}$, it has a $4G_1+8F$ proof, a three-term pairing check, $O(N)$ field operations, and exactly $N+2 b-6$ opening MSM scalars.
We prove completeness, commitment binding, and knowledge soundness in the algebraic group and random-oracle models under the standard bilinear $q$-DLOG assumption. Our curve-generic Rust implementation also provides common implementations of six pairing-based baselines. On BLS12-381 at $\mu=20$, Vela gives the smallest measured proof (232 bytes, 1.62x smaller than the next smallest) and the lowest measured verification time (2.09 ms). Carina's opening performance is in the same leading tier as the prover-oriented mKZG and CHOPIN implementations, while its 452-byte proof and 2.81 ms verifier improve on both. Compared with the verifier-oriented Mercury, Carina roughly halves opening time at the cost of a modest verifier slowdown.
## 2026/1439
* Title: ABE for Unbounded Depth Circuits from the Doubly Circular Assumption
* Authors: Shweta Agrawal, Anuja Modi, Anshu Yadav, Shota Yamada
* [Permalink](https://eprint.iacr.org/2026/1439)
* [Download](https://eprint.iacr.org/2026/1439.pdf)
### Abstract
The recent work of Hsieh, Lin and Luo [HLL23] (HLL23) provided the first construction of ABE for unbounded depth circuits from the circular evasive LWE assumption, which they introduced. Unfortunately, this assumption has been recently broken [AMYY25]. Finding a new construction for unbounded depth ABE from a safe assumption, without relying on compact functional encryption or obfuscation, is therefore an important open problem.
In this work, we provide a new candidate for ABE for circuits of unbounded depth as well as unbounded width from a novel, falsifiable ``doubly circular'' assumption which combines circular LWE with key dependent message security of a variant of ElGamal encryption in an inseparable manner. We show that the assumption holds in Shoup's bilinear generic group model, which rules out all non-generic attacks. In particular, this implies that our construction is secure assuming circular LWE in the bilinear generic group model, which has a long history of study. We also show that in a restricted setting, it is implied by the standard SXDH assumption and circular LWE.
## 2026/1440
* Title: Rarus: A Succinct and Efficient Range Proof for Polynomial-based Vector Commitment
* Authors: Xinyang Yang, Wenjie Qu, Yanpei Guo, Jiaheng Zhang
* [Permalink](https://eprint.iacr.org/2026/1440)
* [Download](https://eprint.iacr.org/2026/1440.pdf)
### Abstract
Range proofs enable a prover to convince a verifier that a committed value lies within a specific interval without revealing additional information. They are fundamental to privacy-preserving systems including anonymous credentials, e-voting, e-cash, and cryptocurrencies like Monero and Grin. A critical challenge is efficiently proving that multiple committed values simultaneously satisfy range constraints while minimizing communication overhead.
Vector commitment schemes provide a promising approach to this problem. Missileproof (CCS'24) recently proposed a range proof for vector commitments achieving $O(1)$ proof size and verifier time, but with prover complexity of $O(N\ell \log(N\ell))$ for proving $\ell$ values in $[0, 2^N)$.
We present \textbf{Rarus}, an efficient range proof for polynomial-based vector commitments that achieves optimal asymptotic complexity across all metrics. Our key innovation is replacing binary decomposition with optimized $b$-ary decomposition, coupled with Bi-variate Zero-Test and accelerated Uni-variate Sum-Check protocols. Rarus achieves $O(1)$ proof size and verifier time, while reducing prover time to $O\left(\frac{N\ell}{\log(N\ell)}\right)\mathbb{G} + O(N\ell)\mathbb{F}$, where $\mathbb{G}$ and $\mathbb{F}$ denote group and field operations respectively. In addition, our protocol supports arbitrary ranges $[0,R)$ beyond powers of two. Experimental results demonstrate that Rarus achieves a $20\times$ speedup over both Bulletproofs and Missileproof when proving 16,384 values in $[0, 2^{64})$.
## 2026/1441
* Title: RainHash2.0: Hardware- and Arithmetization-friendly Hash Function
* Authors: Jiamin Cui, Lorenzo Grassi, Katharina Koschatko, Florian Krieger, Shibam Mukherjee, Christian Rechberger, Sujoy Sinha Roy, Markus Schofnegger, Verena Schr||ppel
* [Permalink](https://eprint.iacr.org/2026/1441)
* [Download](https://eprint.iacr.org/2026/1441.pdf)
### Abstract
Zero-knowledge (ZK) proof systems have developed rapidly in recent years, with hash functions as one of their central building blocks. Since these often dominate the prover cost, circuit-friendly hash function design has become an active research area. Most hash proposals target prime fields, although recent protocols such as Binius and VOLE-based ZK operate natively over binary extension fields \(\mathbb{F}_{2^n}\). These binary field protocols reduce the cost of proving widely used binary and bitwise statements, thereby opening up new design opportunities. At the same time, the demand for ZK applications such as zkRollups is pushing towards performant hardware acceleration, a requirement that recent designs have largely neglected. Hence, a modern ZK hash function should also be efficient in hardware and fast in plain evaluation, to avoid new bottlenecks in non-circuit workloads.
In this paper, we introduce RainHash2.0, a cryptographic permutation that addresses both gaps. RainHash2.0 is natively defined over binary extension fields, making it a natural match for \(\mathbb{F}_{2^n}\)-based protocols such as Binius and VOLEitH, while being tailored for efficient hardware and competitive plain performance. To achieve this, we exploit new techniques from Binius to horizontally split the round function - arguably a novelty in itself that is particularly effective when finite fields of different sizes are used simultaneously. We implement RainHash2.0 in the Binius and VOLE-based ZK frameworks, comparing it against SHAKE, recent arithmetization-oriented designs, and its direct predecessor RainHash. Across proof size, prover- and verifier runtime, RainHash2.0 delivers significant improvements. In addition, we prototype RainHash2.0 on FPGA hardware and reach efficiency gains of up to 8.8$\times$ over related circuit-friendly hash functions. These results mark RainHash2.0 a practical choice for modern ZK applications.
## 2026/1442
* Title: CoSecRAG: Efficient Private Retrieval with Database and Query Privacy for RAG
* Authors: Moyang Xie, Jiacheng Gao, Yuan Zhang, Sheng Zhong
* [Permalink](https://eprint.iacr.org/2026/1442)
* [Download](https://eprint.iacr.org/2026/1442.pdf)
### Abstract
Retrieval-augmented generation (RAG) grounds large language models on external knowledge, but its retrieval stage creates privacy risks: user queries may reveal sensitive intents, while retrieval atabases may contain proprietary or confidential records. To address this challenge, we present CoSecRAG, an efficient two-server private retrieval protocol for RAG that protects database and query embeddings under additive secret sharing. CoSecRAG has two core techniques. First, Inner Product Preserving Query Mask (IPQ-Mask) uses one-time correlated masking to transform secure inner-product computation over secret-shared vectors into local linear computation with a public masked-query difference, eliminating online secure multiplications in score computation. Second, Post-Scoring Cluster Pruning (PSCP) reverses the conventional prune-before-score pipeline: it computes secret-shared scores before pruning and privately prunes candidates at the score level, avoiding secure extraction of high-dimensional document vectors and reducing the input size of secure top-\(K\) selection. We implement CoSecRAG and evaluate it on BEIR datasets and large-scale synthetic benchmarks. CoSecRAG preserves retrieval quality while reducing retrieval cost. Compared with the latest two-server private RAG retrieval baseline, it achieves up to \(202\times\) score-computation speedup, \(107\times\) secure top-\(K\) speedup, and \(123\times\) end-to-end online speedup, while reducing communication by up to \(43\times\).
## 2026/1443
* Title: SENTRA:Privacy-Preserving Training in Outsourced Cloud Environments
* Authors: Maryam Zarezadeh, Jana Eisoldt, Bhavish Mohee, Stefan K||psell, Behzad Abdolmaleki
* [Permalink](https://eprint.iacr.org/2026/1443)
* [Download](https://eprint.iacr.org/2026/1443.pdf)
### Abstract
Training machine learning models in untrusted clouds requires strong guarantees of confidentiality, integrity, and correctness, while remaining scalable and resilient to node churn. These challenges are further amplified in emerging agentic AI systems, where autonomous and distributed learning components require trustworthy coordination and secure state management across heterogeneous cloud environments. Existing Trusted Execution Environments (TEEs) lack scalability and remain vulnerable to side-channel attacks for large workloads, while pure secure multi-party computation (MPC) approaches incur prohibitive overhead in practice. SENTRA (Secure ENclave-based TRaining Architecture) addresses these challenges through a hybrid architecture that combines TEEs, secret sharing, and communication-efficient MPC with system level mechanisms that secure the entire training lifecycle. SENTRA introduces a scalable collective attestation protocol that verifies all participating enclaves and enforces hardware exclusivity before any node may store or process secret shares. Training data and model parameters are stored as secret shares in a versioned enclave-backed keyrCovalue store (KVS), providing rollback protection and consistent state under adversarial conditions. SENTRA further supports dynamic, fault tolerant membership through Dynamic Proactive Secret Sharing (DPSS)-based resharing, safe packed-MPC computation under degree bounds, and adaptive handling of node failures. Evaluation of a prototype implementation shows that SENTRA achieves up to 8.89 samples/s throughput and 1.29|u faster training than the CrypTen baseline in software-only mode. In hardware-enclave mode, SENTRA incurs only an 8.3% performance overhead while providing memory-isolated confidentiality, fault-tolerant membership management, rollback protection, and recovery from node failures in approximately 8 seconds.
## 2026/1444
* Title: Compressed Post-Quantum Silent OT from Isogenies
* Authors: Pouria Fallahpour, Arthur Herl|-dan Le Merdy, Mahshid Riahinia
* [Permalink](https://eprint.iacr.org/2026/1444)
* [Download](https://eprint.iacr.org/2026/1444.pdf)
### Abstract
Oblivious transfer (OT) is a foundational tool in secure computation. Random OT-correlated pairs of the form $(r_0,r_1)$ and $(b,r_b)$, where $r_0,r_1,b \stackrel{{}_\$}{\leftarrow} \{0,1\}$, significantly speed up secure computation protocols. Pseudorandom correlation functions (PCFs), introduced by Boyle et al. (FOCS 2020), are an efficient means of non-interactively generating correlated pairs. In a PCF, two parties store short keys that are used to locally generate large amounts of correlated pairs. While pre-quantum PCFs for OT achieve highly compact key sizes (e.g., $30$ kB), a significant gap remains in the post-quantum regime, where existing solutions rely on lattices or learning-parity-with-noise-style assumptions and yield much larger keys.
We construct compact post-quantum PCFs for OT. Our construction has key sizes in the range of $100$ kB, approaching the compactness of pre-quantum PCFs and seven times smaller than the most compact state-of-the-art post-quantum alternatives. The key size of our PCF remains invariant regardless of the target number of OTs, in contrast to prior alternatives. We estimate a throughput of $7$ OTs per second for our PCF. We additionally provide a security proof in the quantum random oracle model, constituting the first such analysis of a post-quantum PCF. The core of our construction is a new, compact constrained pseudorandom function (CPRF) for inner-product membership predicates. Its security is based on a natural extension of the parallelization problem, which we introduce as the parallelization problem with auxiliary inputs. We provide an extensive analysis of this assumption as well as an implementation of our construction.
## 2026/1445
* Title: Sublinear-Communication Layered MPC from HSS
* Authors: Anasuya Acharya, Pierre Meyer, Divya Ravi, Rahul Satish
* [Permalink](https://eprint.iacr.org/2026/1445)
* [Download](https://eprint.iacr.org/2026/1445.pdf)
### Abstract
The server-aided Secure Multi-Party Computation (MPC) model with dynamic participation, where servers may join or leave during the computation is particularly well-suited for practical, long-running applications. Unfortunately, existing protocols supporting dynamic participation either incur communication costs that scale linearly with the circuit size or rely on the heavy hammer of Fully Homomorphic Encryption (FHE). This contrasts with rCLclassicrCY MPC protocols, where sublinear communication can be achieved without FHE. Focusing on the Layered MPC framework (introduced by David, Ishai, Konring, Kushilevitz, and Narayanan, CRYPTO 2023), we show that this overhead is not inherent. We construct sublinear-communication Layered MPC protocols while maintaining a minimal number of online servers rCo only two or three per layer. Our constructions rely on a layered-friendly adaptation of Homomorphic Secret Sharing (HSS), which we formalize as HSS with Layered Resharing.
--- Synchronet 3.22a-Linux NewsLink 1.2