From Newsgroup: sci.crypt

## In this issue
1. [2026/26] A General Randomness Recycling Framework for First- ...
2. [2026/355] Forget-IT: Optimal Good-Case Latency For ...
3. [2026/1453] Celer: A Lookup Argument for Large-Scale Queries
4. [2026/1455] Trout++: Robust Asynchronous Two-Round ECDSA for ...
5. [2026/1456] QuantumScouter: Reinforcement Learning-Based ...
6. [2026/1457] Identity-Based Encryption from Isogenies
7. [2026/1458] A High-Speed Hardware Accelerator for QR-UOV ...
8. [2026/1459] Hybrid hash function based on the DLP and SIS problems
9. [2026/1460] A Practical Key-Recovery Attack on GRAFHEN
10. [2026/1461] The m=n+1 Boundary of EME: A Splicing Distinguisher ...
11. [2026/1462] Power Reveals Timing Conceals - Side-Channel ...
12. [2026/1463] Shortening Bounds for Reed-Solomon MCA
13. [2026/1464] Optimal Distributed Monotone-Policy Encryption for ...
14. [2026/1465] On Reduction Probability Models in Lattice Sieving
15. [2026/1466] Scalable High-Throughput FPGA Architecture for SMAC ...
16. [2026/1467] Quantum-Safe Cryptography: A Migration Framework ...
17. [2026/1468] Side-Channel Attacks Revisited - an Optimization ...
18. [2026/1469] MULTILINEAR POLYNOMIALS VIA TREE-BASED CIRCUIT AND ...
19. [2026/1470] A Complexity-Theoretic Approach to Proofs of Space
20. [2026/1471] Efficient Single-Round Obfuscation of Search and ...
21. [2026/1472] Vordr: Verifiable, Scalable and Anonymous Remote ...
22. [2026/1473] An Exact Four-Wise Framework for Boomerang ...
23. [2026/1474] Mu-qt-PEGASIS: Interactive Aggregate Signatures ...
24. [2026/1475] Partial Derandomization for Leakage-Resilient ...
25. [2026/1476] Constructing new permutation polynomials by the AGW ...
26. [2026/1477] PERSEPHONE: Zero-Knowledge Multiplicative Non- ...
27. [2026/1478] Provable Recovery of RSA Private Exponents below ...
28. [2026/1479] Conjectures and Barriers for RS-MCA
29. [2026/1480] Doubly-Efficient Secret-Key PIR with Low Storage ...
30. [2026/1481] 88-XOR Implementation of the AES MixColumns Matrix
31. [2026/1482] Practical Adaptor Signatures: Security and Applications
32. [2026/1483] MQ on my Hardware: Performance Analysis of MQOM on FPGA
33. [2026/1484] The SecureDrop Protocol: End-to-End Encrypted ...
34. [2026/1485] From PQC to HHE: Reusing a Co-Design Platform for ...
35. [2026/1486] The supersingular isogeny problem in time and ...
36. [2026/1487] LightShark: Actively Secure Machine-Learning ...
37. [2026/1488] Privacy-Preserving Counterfactual Explanations for ...
38. [2026/1489] SwitchFold: Code-Agnostic Succinct Polynomial ...
39. [2026/1490] On the Formal Verification of Polynomial ...
40. [2026/1491] Exploiting Load/Store Leakage of Sparse Vectors for ...
41. [2026/1492] Proof of Demand Is Not Proof of Work: On the Limits ...
42. [2026/1493] Bob DyLean: A Framework for the Symbolic Analysis ...
43. [2026/1494] On $k$-way split multiplication algorithms
44. [2026/1495] Oblivious Sorting under Fully Homomorphic ...
45. [2026/1496] Floor-IT: Information-Theoretic BFT in Partial ...
46. [2026/1497] Updatable Private Set Union: Generic Construction ...
47. [2026/1498] Multilevel Amortized Gaussian Elimination in ...
48. [2026/1499] BF-#: A Bloom-Filtered Brute-Force Framework for ...
49. [2026/1500] How to Define Expected Quantum Polynomial-Time Zero ...
50. [2026/1501] Phishing in the Noise: Analysis of CT-based ...
51. [2026/1502] Efficient Privacy-Preserving LSTM Inference on ...
52. [2026/1503] The Consensus Number of Untraceable Cryptocurrencies
53. [2026/1504] Encifher: A Trusted-Execution Coprocessor for ...
54. [2026/1505] Conditional-Affine Redundant Clauses for SHA-256 ...
55. [2026/1506] SM4th and uBlockith: VOLE-based Post-Quantum ...
56. [2026/1507] Analyzing Cryptography in Context: A Cryptography- ...
57. [2026/1508] ZKPoSP: Post-Quantum Zero-Knowledge Proofs for ...
58. [2026/1509] Efficient Unclonable Encryption from Pauli Eigenstates
59. [2026/1510] Quantum Lazy Sampling and Path Recording for Any Group
60. [2026/1511] Unconditional Unclonable Encryption
## 2026/26
* Title: A General Randomness Recycling Framework for First-Order Masking with Application to AES
* Authors: Junhuai Yang, Feng Zhou, Hua Chen, Si Gao
* [Permalink](https://eprint.iacr.org/2026/026)
* [Download](https://eprint.iacr.org/2026/026.pdf)
### Abstract
Masking is a principal countermeasure against side-channel attacks, yet its practical deployment is often constrained by the high cost of randomness. Existing approaches for reducing randomness overhead generally follow two directions. The first focuses on designing low-randomness gadgets, which often introduces considerable area and latency overheads for complex boolean functions. The second relies on architecture-level randomness reuse, but securely managing the resulting algebraic dependencies typically still requires additional fresh randomness or extra initial randomness. In this work, we introduce a dependency-tracking abstraction, termed unique randomness guard (URG), for reasoning about randomness reuse in masked hardware circuits. We develop a randomness recycling methodology that eliminates historical randomness dependencies before safely reusing the historical randomness to subsequent computations. This enables secure randomness reuse without requiring additional fresh randomness. To demonstrate the practicality of the proposed methodology, we apply it to first-order masked AES hardware implementations in both parallel and serial architectures. The security of these architectures is proven under the robust probing model and practically validated via TVLA on an FPGA platform. Furthermore, hardware synthesis results demonstrate that our implementations achieve highly competitive area and latency performance compared to state-of-the-art low-randomness designs, while using randomness solely for input encoding.
## 2026/355
* Title: Forget-IT: Optimal Good-Case Latency For Information-Theoretic BFT
* Authors: Ittai Abraham, Sourav Das, Yuval Efron, Jovan Komatovic
* [Permalink](https://eprint.iacr.org/2026/355)
* [Download](https://eprint.iacr.org/2026/355.pdf)
### Abstract
The good-case latency of a consensus protocol measures the latency from block proposal by a consensus leader to decision, in the case in which the leader is correct. It is arguably the efficiency metric most pertinent for discussing the practical latency performance of consensus protocols. Well understood in the context of the authenticated setting, with PBFT [Castro 99], Tendermint [Buchman 16] & Simplex [Chan, Pass 23] achieving the optimal good-case latency of 3 rounds, significant gaps remain in the unauthenticated setting. We present Forget-IT, an unauthenticated consensus protocol with optimal good-case latency of 3 rounds. Furthermore, our protocol only requires constant persistent storage, and has $O(n^2)$ message complexity per view.
## 2026/1453
* Title: Celer: A Lookup Argument for Large-Scale Queries
* Authors: Wenjie Qu, Yanpei Guo, Zhen Xuan, Xuanming Liu, Jiaheng Zhang
* [Permalink](https://eprint.iacr.org/2026/1453)
* [Download](https://eprint.iacr.org/2026/1453.pdf)
### Abstract
Lookup arguments are designed to prove that all elements in a query vector appear in a lookup table.
These arguments are critical for efficiently proving ZK-unfriendly statements, such as range checks and the evaluation of complex functions. Most existing lookup arguments are optimized for scenarios where the query size is smaller than the table size.
However, in many real-world applications, the query size $m$ is often much larger than $n$, the table size. This disparity leads to inefficiencies in such schemes.
To overcome this limitation, we propose Celer, a novel lookup argument in which the prover's runtime increases slowly with $m$, thereby providing improved scalability. The efficiency of our lookup PIOP stems from reducing the number of commitments to be sublinear in the query size $m$, while maintaining field operations linear in $m$. Experimental results demonstrate that our lookup scheme significantly outperforms state-of-the-art lookup schemes. For the workload of query size $m=2^{28}$ and table size $n=2^{16}$ (a real world case in proving Llama language model inference), our scheme achieves a 25.9$\times$ prover-time speedup over plookup and is 9.4$\times$ faster than LogUp.
## 2026/1455
* Title: Trout++: Robust Asynchronous Two-Round ECDSA for Arbitrary Thresholds * Authors: Ariel Nof, Luke Parker
* [Permalink](https://eprint.iacr.org/2026/1455)
* [Download](https://eprint.iacr.org/2026/1455.pdf)
### Abstract
We present Trout++, a complete threshold signing suite for ECDSA signatures. Trout++ descends from the recent Trout protocol (Dahari-Garbian, Nof, and Parker, ACM CCS 2025) and inherits its transparent setup, two-round structure, and strong security guarantees, while introducing several significant improvements.
Unlike Trout, Trout++ offers pre-signing, where the first round is key-, signing-set-, and message- independent.
This property is not only important in its own right but also enables us to apply the ROAST transformation (Ruffing, Ronge, Jin, Schneider-Bensch, and Schr||der, ACM CCS 2022) to our protocol, yielding the \textit{first} arbitrary-threshold (including with a dishonest majority), robust, asynchronous signing protocol for ECDSA signatures.
Furthermore, we introduce several optimizations to the building blocks in Trout that reduce both bandwidth and computation.
Our benchmark results show that our implementation of Trout++ is approximately twice as fast \emph{and} twice as small compared to the prior implementation of Trout. We also present a constant-time implementation with running time that is \textit{ten times faster} than Trout's constant-time implementation.
Finally, we show how Trout++ can be composed with an account derivation scheme that does not require additional setups per derivation, enabling more practical solutions for managing key material.
In total, we achieve complexities and functionality comparable to, and closing the gap with, leading solutions for Schnorr signatures (such as FROST).
## 2026/1456
* Title: QuantumScouter: Reinforcement Learning-Based Optimization of Variational Quantum Circuits for Differential Cryptanalysis
* Authors: Gilsang Ahn, Jiwoo Baek, Donggun Lee, Insung Kim, Changmin Lee, Seokhie Hong, Dongjae Lee
* [Permalink](https://eprint.iacr.org/2026/1456)
* [Download](https://eprint.iacr.org/2026/1456.pdf)
### Abstract
Classical deep learning for differential cryptanalysis requires millions of ciphertext pairs, rendering attacks infeasible or easily detectable. This work overcomes this data limitation by introducing quantum differential distinguishers, enabling a practical attacker model where executing few queries is feasible. We design these distinguishers via quantum machine learning based on variational quantum circuits. To address circuit design challenges, we propose QuantumScouter, a reinforcement learning method that discovers compact quantum circuits. Unlike prior work, QuantumScouter explicitly targets metrics like gate count and circuit depth, producing circuits suitable for noisy intermediate-scale quantum hardware. We apply QuantumScouter to the SPECK32/64 and SIMON32/64 ciphers. The models are trained to distinguish ciphertext pairs possessing a meaningful differential from completely random pairs. For SPECK, our approach achieves $0.80$ accuracy, outperforming the $0.53$ of prior work while reducing required qubits from $16$ to $6$. For SIMON, we establish a novel quantum baseline with $0.75$ accuracy. Notably, under a restricted regime of merely $400$ training samples, classical deep learning models struggle. A simple MLP with $361$ parameters fails to capture differential characteristics, resulting in an accuracy of $0.51$, while a deep ResNet with $64{,}737$ parameters overfits to yield an accuracy of $0.55$. In stark contrast, our data-efficient quantum distinguisher extracts meaningful features using only $49$ gates, maintaining $0.80$ accuracy.
## 2026/1457
* Title: Identity-Based Encryption from Isogenies
* Authors: Shweta Agrawal, Andrea Basso, Sikhar Patranabis
* [Permalink](https://eprint.iacr.org/2026/1457)
* [Download](https://eprint.iacr.org/2026/1457.pdf)
### Abstract
We provide the first construction of identity-based encryption from isogeny-based assumptions. Security of our construction relies on a novel assumption called the "CDH with Mismatched TorsionrCY (CD-HwMT) assumption, which we introduce. At a high level, the assumption posits the hardness of solving a CDH-like problem even when the
adversary is given some additional rCLsaferCY leakage. We justify our assumption by showing that, in the Algebraic Isogeny Model, our assumption reduces to well-known assumptions from the literature.
As a bonus feature, our identity-based encryption enjoys anonymity, which means that the ciphertexts hide not only the message but also the target identity. We additionally obtain the first isogeny based constructions of laconic oblivious transfer, as well as public-key encryption that simultaneously satisfies security against high-rate key leakage and key-dependent message/circular security from the CDHwMT assumption. All our constructions can be conjectured to be post-quantum secure.
At the heart of our results lie several new techniques, which we believe will help in building even more advanced cryptography in isogeny-land.
## 2026/1458
* Title: A High-Speed Hardware Accelerator for QR-UOV Signature Scheme
* Authors: Renma Sugai, Hiroshi Amagasa, Rei Ueno, Naofumi Homma
* [Permalink](https://eprint.iacr.org/2026/1458)
* [Download](https://eprint.iacr.org/2026/1458.pdf)
### Abstract
This paper proposes a high-speed hardware accelerator for QR-UOV, a multivariate scheme, that executes all three operations: key generation, signature generation, and signature verification.
QR-UOV utilizes a quotient polynomial ring structure to reduce the public-key size of the original UOV scheme; however, this introduces functional requirements distinct from other multivariate schemes, such as polynomial-matrix operations over $\mathbb{F}_{q^\ell}$, coefficient expansion for the Mersenne prime field $\mathbb{F}_{q}$, and the expansion of symmetric matrices generated in a compressed form.
To accelerate polynomial-matrix multiplication over $\mathbb{F}_{q^\ell}$, the proposed architecture employs a $D \times D$ systolic array ($D$ is the parallelization factor), in which each PE internally contains a polynomial multiply-accumulate unit.
For signature verification, the architecture also incorporates a quadratic-form operation unit without explicitly storing the intermediate vector--matrix products.
In addition, to ensure a regular data supply from key expansion to matrix operations, the architecture incorporates on-the-fly rejection sampling, which exploits the property that AES-CTR output blocks can be generated independently, as well as an expansion process for the symmetric matrices in compressed form.
Furthermore, the architecture enables pipelined processing, overlapping the $i$-th polynomial-matrix operation with the $(i+1)$-th public-key expansion.
FPGA evaluation shows that the proposed hardware executes key generation, signature generation, and signature verification in 0.74 ms, 0.28 ms, and 0.19 ms, respectively, at security level I.
Furthermore, we confirm that the proposed hardware exhibits a lower LUT-time product than that of existing UOV hardware.
## 2026/1459
* Title: Hybrid hash function based on the DLP and SIS problems
* Authors: Dimitri Koshelev, Francesc Seb|-
* [Permalink](https://eprint.iacr.org/2026/1459)
* [Download](https://eprint.iacr.org/2026/1459.pdf)
### Abstract
This short note discusses in detail a folklore but little-known hybrid hash function grounded on both the discrete logarithm and short integer solution problems. In particular, specific satisfactory parameters are provided to ensure the standard $128$-bit security level for the lattice problem with $256$-bit module, which may be useful in its own right. The hash function is a natural generalization of the classical Pedersen and Ajtai ones. Nevertheless, to the authors' knowledge, no one has previously explicitly analysed their hybrid version. Besides, the obtained result is probably prone to significant further optimizations by applying many tricks from elliptic curve and lattice cryptographies. Hashing is known to be a basic operation for constructing more complex and important cryptographic schemes. The authors intend to explore such hybrid ones in future articles. However, the hash function under consideration may be precious by itself due to its double provable security. Thus, this introductory work represents a kind of reincarnation of curve-based cryptography whose development has been severely and unfairly undermined by the potential but still vague quantum threat.
## 2026/1460
* Title: A Practical Key-Recovery Attack on GRAFHEN
* Authors: Jules Dumezy
* [Permalink](https://eprint.iacr.org/2026/1460)
* [Download](https://eprint.iacr.org/2026/1460.pdf)
### Abstract
GRAFHEN is a group-based fully homomorphic encryption scheme in which public rewriting rules hide a permutation representation used for decryption. We give a framework for equivalent-key recovery for GRAFHEN instances based on symmetric groups, together with a practical attack that succeeds on every released challenge, including the recommended semidirect construction based on $S_{11}$ with five generators per copy. The recovered generators are determined only up to simultaneous conjugation, which is the natural isomorphism ambiguity of the public presentation. Known-zero ciphertexts transport the decryption subgroup under this conjugation, so the recovered representation suffices to decrypt the challenge ciphertexts. Our attack, HEnbane, first derives short consequences by two complementary procedures: bounded congruence closure and direct cancellation between public rules with a common right-hand side. The closure also supplies generator-order multiples. It then reconstructs one generator tuple by conflict-driven search over partial permutation tables and recovers the second tuple from the public mixed relations in semidirect instances. The reduction and reconstruction problems are parameterized by the permutation degree and generator count rather than by a particular challenge key. The experiments establish practical success for all released instances, while the analysis makes no distributional running-time claim for larger parameter choices in general. The attack shows that the published count of approximately $2^{101}$ equivalence classes is not an attack-cost estimate at the recommended parameters.
## 2026/1461
* Title: The m=n+1 Boundary of EME: A Splicing Distinguisher for the Unrefreshed EME-Core Extension and Its Linear-Map Generalization
* Authors: Jiadong Han, Peng Wang
* [Permalink](https://eprint.iacr.org/2026/1461)
* [Download](https://eprint.iacr.org/2026/1461.pdf)
### Abstract
EME is a parallelizable encrypt-mix-encrypt wide-block construction proved secure for m-block messages only in the range m <= n, where n is the block length of the underlying block cipher. Halevi and Rogaway justified this restriction by giving a splicing distinguisher for m >= n + 2, but left open the first excluded length, m = n + 1. We resolve that boundary for the direct, unrefreshed EME-core extension beyond its specified m <= n domain: the original formulas are applied to m = n + 1 blocks while continuing to use the same global mask. Under one fixed tweak, two encryption queries and one decryption query distinguish this extension from a random permutation. The result applies to this unrefreshed extension; refreshed variants such as EME* and IEEE EME2-AES are outside the scope of the distinguisher. The boundary attack is not a shortened form of the known zero-sum attack. At m = n + 1, the non-first coefficients have no nonempty zero-sum; instead, they form a basis and therefore uniquely represent the coefficient 1. Combining this representation with the special equation for the first mixed block gives the cancellation needed for a ciphertext splice. The same mechanism applies to Sarkar's EMME framework: when multiplication by the field element x is replaced by a linear operator psi with degree-n minimal polynomial, the minimal-polynomial relation supplies the corresponding operator identity. EME* and IEEE EME2-AES avoid this setting by refreshing the mask at chunk boundaries. The attack identifies the algebraic obstruction that such refresh steps avoid.
## 2026/1462
* Title: Power Reveals Timing Conceals - Side-Channel Attacks and Hiding Countermeasures for HQC's Fixed-Weight Vector Sampling
* Authors: Dina Hesse, Markus Krausz, Raagavan Murugananthan, Tabea Wollinger, Tim G|+neysu
* [Permalink](https://eprint.iacr.org/2026/1462)
* [Download](https://eprint.iacr.org/2026/1462.pdf)
### Abstract
FixedrCaweight sampling is a core primitive in many postrCaquantum schemes, including the HQC key encapsulation mechanism.
An early implementation of fixed-weight vector sampling in HQC was shown by Guo et al. (CHES 2022) to suffer from a timing side-channel vulnerability, leading to complete key recovery.
This timing side-channel was fixed in the current HQC version, however, power side-channel leakage is not addressed.
In this work, we demonstrate that fixed-weight vector sampling in HQC is vulnerable to power side-channel attacks and present two practical attacks.
First, we construct a power-based distinguisher targeting the support-vector generation and employ the strategy developed by Guo et al. (CHES 2022) to recover the shared key.
Our attack recovers the key with a 100% success rate using 900,000 distinguisher calls.
On these grounds, we evaluate hiding countermeasures based on dummy operations and find that they linearly increase the trace requirement for a successful distinguishing attack by the number of dummy operations.
Second, we target a masked software implementation of the fixed-weight vector sampling in HQC and demonstrate a singlerCatrace attack on the support conversion that recovers the secret key, again with a success rate of 100%. We then discuss leakage attribution, specifically how shares are unintentionally recombined.
Finally, we investigate how hiding techniques such as bitslicing, shuffling, and dummy operations can enhance the security of the implementation.
In particular, the use of shuffling can lead to a complete prevention of our attack.
Our results show that fixed-weight vector sampling of HQC is highly susceptible to power side-channel analysis. In particular, our results highlight that a combination of masking and hiding is required to effectively protect the implementations.
## 2026/1463
* Title: Shortening Bounds for Reed-Solomon MCA
* Authors: Przemek Chojecki
* [Permalink](https://eprint.iacr.org/2026/1463)
* [Download](https://eprint.iacr.org/2026/1463.pdf)
### Abstract
We derive an explicit exponent \(\Psi_\rho\) that bounds the Reed--Solomon MCA bad-slope numerator at every fixed relative radius between Johnson and capacity. The resulting positive-relative-radius exponential-budget safe-frontier certificate strictly improves the smallest-test MDS exponent and gives a constant post-Johnson radius for every positive usable budget exponent. An all-test-size MDS circuit-incidence envelope gives exact large-field capacity plateaux, improved adjacent thresholds, and four explicit length-\(512\), \(2^{-128}\)-secure smooth multiplicative certificates beyond Johnson. An exact CA--MCA decomposition gives challenge-restricted, endpoint-exact linear-budget thresholds through asymptotically half the minimum distance, and monomial equivalence transfers the applicable bounds to circle presentations. A Gowers--cube argument proves primitive max-fiber flatness from an image-normalized Sidon payment at an accessible moment order. The unrestricted subexponential-budget smooth/circle frontier remains open because shortening has positive exponential cost and the analytic payment, residual ray compiler, profile add-back, and matching attacks are not yet available.
## 2026/1464
* Title: Optimal Distributed Monotone-Policy Encryption for DNFs and More from Lattices
* Authors: Jeffrey Champion, David J. Wu
* [Permalink](https://eprint.iacr.org/2026/1464)
* [Download](https://eprint.iacr.org/2026/1464.pdf)
### Abstract
Distributed cryptography is a new cryptographic paradigm that enables fine-grained decryption capabilities in a trustless setting. In a distributed monotone-policy encryption scheme, users generate their own public and private keys. Thereafter, one can encrypt a message with respect to an arbitrary set of public keys together with an access policy. Any group of users that satisfies the access policy can recover the message; conversely, the message is computationally hidden from any group of users that does not satisfy the policy. The key requirement is succinctness: the size of the ciphertext should be sublinear in the size of the access policy. Distributed monotone-policy encryption generalizes related notions like distributed broadcast encryption (where the access policy is set membership) and silent threshold encryption (where the access policy is a threshold policy). In this work, we achieve the following:
- First, we give the first optimal distributed monotone-policy encryption scheme for the class of DNF policies from the decomposed LWE assumption in the random oracle model. Here, optimal means that the size of the public parameters, the user public keys, and the size of the ciphertext are independent of the size of the policy. As a corollary, we also obtain a (reusable) succinct computational secret sharing scheme for DNFs from decomposed LWE in the random oracle model.
- Next, we show how to adapt our techniques to obtain a distributed monotone-policy encryption scheme for $k$-DNFs in the plain model where the size of the ciphertext is $k \cdot L^{1/2}$, $k$ is the maximum size of each min-term, and $L$ is the number of min-terms in the DNF. This is the first scheme from the decomposed LWE assumption in the plain model. If we settle for a much weaker notion of selective security, then we also achieve full succinctness in the plain model (i.e., where the ciphertext size is independent of the size of the DNF).
- By specializing our results to the setting of broadcast encryption, we obtain an adaptively-secure distributed broadcast encryption scheme with ciphertext size $|S|^{2/3}$, where $|S|$ is the size of the broadcast set. Security relies on decomposed LWE (with a polynomial modulus-to-noise ratio) in the plain model. This scheme is the first lattice-based scheme with adaptive security that supports an a priori unbounded number of users in the plain model. Previous lattice-based distributed broadcast encryption schemes with adaptive security in the plain model assumed an a priori bound on the number of users (but achieved optimal-size ciphertexts that are independent of the size of the broadcast set).
## 2026/1465
* Title: On Reduction Probability Models in Lattice Sieving
* Authors: Marc Stevens, Michael Yonli
* [Permalink](https://eprint.iacr.org/2026/1465)
* [Download](https://eprint.iacr.org/2026/1465.pdf)
### Abstract
In lattice sieving, the sphere model assumes that sieving elements are distributed close to or on a sphere with uniformly distributed direction.
It is extensively used to predict how lattice sieving behaves.
In the sphere model the probability that a random pair of vectors reduces is asymptotically $p_n={(3/4)}^{n/2}/\sqrt{3\pi n/8}$.
In practice sieving algorithms have been observed to perform better than predicted by the sphere model.
It is an open question how this gap behaves asymptotically: does the gap vanish or grow as the dimension grows?
Our work answers this question by showing that it is asymptotically constant. We generalise the sphere model to uniform ball and non-uniform ball models and analyse reduction probability distributions.
We find that asymptotically the input distribution only affects the total reduction probability, not the shape of the output length distribution.
We show that the reduction probability advantages of our models over the sphere model range from $\times 1.5$ up to $\times 8$.
## 2026/1466
* Title: Scalable High-Throughput FPGA Architecture for SMAC Message Authentication Code
* Authors: Ahmet MALAL, Hakan G|+ler, Bahad-#r Aydo-fan, O-fuz Yayla
* [Permalink](https://eprint.iacr.org/2026/1466)
* [Download](https://eprint.iacr.org/2026/1466.pdf)
### Abstract
SMAC is a recently proposed by Wang et al.~stand-alone Message Authentication Code (MAC) constructed from repeated applications of the AES round function and featuring an aggregation mode, SMAC-1$\times n$, for scalable parallel processing. Although originally designed for high-throughput CPU implementations leveraging AES-NI instructions, its structural properties suggest strong compatibility with hardware parallelism. However, no systematic FPGA-oriented architectural study of SMAC has been reported. This paper presents a scalable FPGA architecture of SMAC implemented on a Xilinx Kintex UltraScale+ KCU116 platform. The $\Pi$ transformation is evaluated in a single clock cycle using fully combinational AES rounds, and throughput scaling is achieved through physical replication of aggregation lanes. All SMAC-1$\times n$ configurations up to $n=16$ are implemented and evaluated. Post-implementation results achieve maximum operating frequencies up to 526\,MHz and peak throughput of 731\,Gbps for SMAC-1$\times 16$. The design exhibits near-linear throughput scaling up to eight lanes and reaches a maximum efficiency of 24.5\,Mbps/slice. These results demonstrate that SMACrCOs round-based construction is well suited for FPGA parallelism and enables competitive high-throughput hardware MAC acceleration.
## 2026/1467
* Title: Quantum-Safe Cryptography: A Migration Framework for Legacy Systems Toward NIST PQC Standards with the Crypto-Agility Readiness Score
* Authors: Allan D. B. Costa
* [Permalink](https://eprint.iacr.org/2026/1467)
* [Download](https://eprint.iacr.org/2026/1467.pdf)
### Abstract
Post-quantum cryptography (PQC) standardisation reached a pivotal milestone in August 2024 with the release of NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA), yet the vast majority of deployed public-key infrastructure continues to rely on RSA-2048 and Elliptic Curve Diffie-Hellman (ECDH), both vulnerable to Shor's algorithm on a cryptographically relevant quantum computer. The Harvest Now, Decrypt Later (HNDL) threat renders this risk operationally present: adversaries may archive ciphertext today for future decryption once a Cryptographically Relevant Quantum Computer (CRQC) becomes available.
This paper proposes the Crypto-Agility Readiness Score (CARS), a five-dimension weighted composite index for assessing PQC migration readiness in legacy systems across PKI, TLS, and HSM environments. CARS operationalises five dimensions -- Inventory Completeness, Algorithm Compliance, Architectural Decoupling, Toolchain Readiness, and Governance & Compliance Alignment -- with weights derived via a two-round Delphi process with 12 senior migration engineers.
In an empirical evaluation of 43 open-source cryptographic software repositories, mean CARS values were 24.9 +/- 9.5 (Legacy Crypto Libraries), 25.8 +/- 8.2 (PKI/Certificate Management), 39.7 +/- 15.2 (HSM/PKCS11 Middleware), 47.2 +/- 16.5 (TLS 1.3 Hybrid), and 47.5 +/- 11.1 (PQC Native; overall 34.1 +/- 15.0, n=43). A notable result is that PQC reference implementations score in the At-Risk range despite high Algorithm Compliance (d2 >= 0.61), because Architectural Decoupling (d3) is near zero, confirming that algorithmic presence alone does not imply organisational migration readiness.
Category differences are statistically significant (Kruskal-Wallis H(4) = 17.55, p = 0.0015, epsilon^2 = 0.357, large effect). Construct validity is supported by a moderate convergent Spearman correlation between Algorithm Compliance and Toolchain Readiness (rho = 0.558, p < 0.001, n = 43) and discriminant independence from Architectural Decoupling (rho = -0.031, p = 0.843). A longitudinal case study on oqs-provider (v0.3.0 to v0.6.0) demonstrates that CARS tracks real migration progress (Delta CARS = +21 pts). Microbenchmarks show ML-KEM-768 completes a full KEM cycle in 0.28 ms versus 2.87 ms for RSA-2048 (10.2x faster); authors' own measurements on Apple M1 Pro ARM64 (liboqs-python v0.15.0, n=10,000) confirm the ratio is preserved (M1 Pro: 0.051 ms full KEM cycle). A hybrid TLS 1.3 handshake (X25519MLKEM768) adds approximately 1.29 ms incremental overhead over ECDHE-only. CARS may support structured prioritisation of migration efforts; external predictive validation against migration outcomes remains future work.
## 2026/1468
* Title: Side-Channel Attacks Revisited - an Optimization Problem Perspective: Bootstrapping and Space Reduction
* Authors: Erez Tamir, Osnat Keren, Itamar Levi
* [Permalink](https://eprint.iacr.org/2026/1468)
* [Download](https://eprint.iacr.org/2026/1468.pdf)
### Abstract
Side-channel analysis (SCA) attacks rely on leakage from a target device. It is common to assume that linear operations implemented by XOR gates produce symmetric leakage and carry negligible side-channel information. In practice, leakage from XOR gates produces complex, non-independent, and time-varying asymmetric behavior.
The paper introduces Feature Estimation based Attacks (FEbA) -- a dedicated profiling attack that exploits these asymmetries. The attack is versatile; it was demonstrated to be successful against the sharing and refreshing phases in masking-based implementations by greatly narrowing the guessing key space, with no access to intermediate values.
Such attacks have implications for designs such as ASCON, GIBBON, and ACE, where XORs that utilize the key are vulnerable to attacks regardless of the inherent SCA protection levels used in them (e.g., sponge $rate$, the leak-free components for re-keying, and masking order $d$).
Experimental results indicate that the entropy of a $32$-bit key can be reduced below $1$ bit using (up to) $20,000$ traces from a standalone XOR without any access to intermediate values, or below $500$ traces with access to intermediate values.
## 2026/1469
* Title: MULTILINEAR POLYNOMIALS VIA TREE-BASED CIRCUIT AND THE SUMCHECK PROTOCOL
* Authors: ALI MKHIDA, Adil Iguider
* [Permalink](https://eprint.iacr.org/2026/1469)
* [Download](https://eprint.iacr.org/2026/1469.pdf)
### Abstract
The Sumcheck protocol is a cornerstone of modern proof systems, yet its prover remains a performance bottleneck. Even in the multilinear case, the repeated construction
of round polynomials leads to significant overhead, limiting scalability in practice.
We take a different approach: instead of modifying the protocol, we rethink the representation
of multilinear polynomials. We show that any multilinear polynomial admits a simple and structured binary-tree circuit representation, where each node follows a clean
recursive rule. This perspective is not merely conceptual; it directly translates into faster
algorithms.
Our circuit view unifies three core operations: evaluation, summation over the Boolean
hypercube, and Sumcheck round generation within a single framework. Construction from
the coefficient vector costs exactly nN field operations, and evaluation via bottom-up
folding requires exactly N reA 1 multiplications rCo optimal for this class of algorithms.
A key structural property of the circuit is its regularity: fixed depth, local recurrences,
and no data-dependent branching. This is not incidental rCo it is a direct consequence of
the recursive decomposition, and it is precisely what makes the representation amenable to
parallel execution and hardware acceleration.
We implement our approach in Rust on the BN254 scalar field and benchmark it against
ark-poly with parallelism enabled on both sides. At n = 20, our parallel evaluation kernel
achieves a 3.4|u speedup over ark-poly (14 ms vs 48 ms). The verifier completes in under
1 ++s across all tested dimensions, yielding a prover-to-verifier ratio exceeding 105 at n = 20.
Our results suggest that revisiting polynomial representations is a promising direction
for accelerating fundamental primitives in proof systems.
## 2026/1470
* Title: A Complexity-Theoretic Approach to Proofs of Space
* Authors: Marshall Ball, Jiaxin Guan
* [Permalink](https://eprint.iacr.org/2026/1470)
* [Download](https://eprint.iacr.org/2026/1470.pdf)
### Abstract
A Proof of Space, PoS, as introduced by Dziembowski et al. [CRYPTO'15], is a two-phase protocol that enables a Prover to convince an efficient Verifier that it has allocated a large amount of persistent memory to storing some information.
To our knowledge, all existing PoS protocols are only known to be secure in the random oracle model (or under ad hoc assumptions about cryptographic assumptions). We provide an elementary framework for constructing PoS from a combination of derandomization assumptions and cryptographic assumptions.
We provide a few simple instantiations of the framework. We show that non-trivial PoS follow from (a) $\mathsf{E}=\mathsf{DTIME[2^{O(n)}]}$ is hard for exponential-size nondeterministic circuits (an assumption introduced to show $\mathsf{AM}=\mathsf{NP}$), and (b) collision-resistant hash functions. We also show that PoS with nearly optimal parameters and interaction pattern follows from assumption (a) above and (c) SNARGs for $\mathsf{P}$.
## 2026/1471
* Title: Efficient Single-Round Obfuscation of Search and Result Patterns in Searchable Encryption
* Authors: Tung Le, Thang Hoang
* [Permalink](https://eprint.iacr.org/2026/1471)
* [Download](https://eprint.iacr.org/2026/1471.pdf)
### Abstract
Searchable Symmetric Encryption (SSE) enables data owners to securely store encrypted data on untrusted cloud servers while retaining the ability to perform secure searches and retrieve relevant documents. However, standard SSE schemes expose search patterns (whether two queries are identical), and result patterns (which documents are returned), making them susceptible to leakage-abuse attacks that can infer sensitive information such as the queried keywords and/or document contents. While Oblivious RAM (ORAM) and Private Information Retrieval (PIR) can hide these patterns, their high computation and communication overhead often render them impractical for real-world search workloads. A more efficient alternative is to obfuscate search and result patterns using Differential Privacy (DP). Unfortunately, existing DP-based SSE schemes either provide insufficient query privacy protection, or still incur substantial performance overhead.
In this paper, we propose FROST, a novel differentially private SSE scheme that efficiently obfuscates both search and result patterns, while providing strong resilience against all known statistical leakage-abuse attacks. The core component of FROST is our new rerandomized PIR (RePIR) scheme designed for private databases, which allows server-side rerandomization of encrypted PIR query responses. In FROST, we also introduce a novel method for applying DP noises to SSE for search result obfuscation using only simple arithmetic operations. An important property of FROST is that it requires only a single round of communication, with small user-side storage as an additional benefit. We fully implemented FROST and conducted extensive experiments over real-world datasets to rigorously assess its practical performance and resilience. Our experiments showed that FROST not only effectively mitigates pattern-leakage attacks while maintaining reasonable utility, but also achieves up to four orders of magnitude faster keyword search and three orders of magnitude lower bandwidth overhead than prior DP-based SSE schemes.
## 2026/1472
* Title: Vordr: Verifiable, Scalable and Anonymous Remote Attestation for Confidential Virtual Machines
* Authors: Nirajan Koirala, Kevin Vuong, Micah Brody, Jihye Kim, Hyunok Oh, Taeho Jung
* [Permalink](https://eprint.iacr.org/2026/1472)
* [Download](https://eprint.iacr.org/2026/1472.pdf)
### Abstract
Confidential virtual machines (CVMs) provide hardware-rooted attestation and isolation, protecting data in use from untrusted cloud infrastructure. However, current CVM attestation frameworks are limited to a two-party trust model between the cloud provider and the CVM owner, and primarily guarantee only the boot-time state.
As CVMs increasingly host public-facing workloads (e.g., LLM inference APIs, web applications) that process end-user data, this creates a three-party trust mismatch among the cloud provider, the CVM owner, and end users. Once a workload is deployed, end-users lack cryptographic assurance of runtime integrity and must implicitly trust the CVM owner for any post-launch modifications. Furthermore, extending continuous runtime attestation to a large number of end users introduces severe scalability bottlenecks and is vulnerable to co-location-based attacks.
Existing methods either enforce static post-launch lockdown or rely on CVM owner-maintained software logs that are not hardware-anchored.
We present Vordr, a framework that removes the CVM owners from the end-user's trust domain across the full CVM lifecycle while still allowing workload-level updates/installations with auditability. We introduce a novel architecture that establishes an exclusive administrative binding between a process-based TEE (Warden Enclave (WEN)) and the CVM. This binding strictly blocks the CVM owners (or cloud) from directly manipulating the CVM. Vordr continuously tracks runtime integrity via a hardware-rooted Linux IMA event log anchored to PCR 10, serving time-bounded, platform-unlinkable cached or audit-ready quotes for independent end-user auditing. We optimize the costly IMA-log extraction via a novel incremental attestation design leveraging the IMA log's append-only structure and the WEN's sealed state. We implement Vordr, validate it across several workloads, and show that it provides up to 60.8x speedup for runtime monitoring with huge communication reductions in steady-state incremental rounds compared to prior methods. Vordr delivers highly scalable and verifiable runtime attestation, providing substantially stronger guarantees for runtime integrity and platform unlinkability.
## 2026/1473
* Title: An Exact Four-Wise Framework for Boomerang Cryptanalysis
* Authors: Chengcheng Chang, Kai Hu, Shuo Peng, Haoyang Wang
* [Permalink](https://eprint.iacr.org/2026/1473)
* [Download](https://eprint.iacr.org/2026/1473.pdf)
### Abstract
Boomerang cryptanalysis is inherently a four-point phenomenon, yet its recent geometric formulation relies on a 3-wise representation imposed by a quartet-sum-zero assumption. This simplification makes the transition matrices tractable, but it also removes boomerangs with unequal paired differences and prevents the framework from modeling impossible boomerang distinguishers.
We propose an exact 4-wise geometric framework for boomerang cryptanalysis that is a \emph{strict generalization} of the 3-wise framework: it recovers the 3-wise framework as the equal-difference $a=a',\,b=b'$ specialization, and at the same computational cost additionally covers the unequal-difference boomerangs and impossible boomerang distinguishers that the 3-wise representation cannot reach.
By choosing bases adapted to the two value coordinates and two difference coordinates of a boomerang quartet, our framework removes the 3-wise assumption and gives a unified transition-matrix description for both impossible boomerang distinguishers and fixed-key boomerang probabilities.
The framework has two concrete applications. First, it yields a positive (satisfiability) model for searching for impossible boomerang distinguishers from the difference coordinates in the 4-wise representation. Using this model, we find new impossible boomerang distinguishers for \present, \ascon, \skinny, and \gift.
Second, it computes fixed-key boomerang probabilities as sums of \emph{quasi-boomerang quartet characteristic} correlations. For the 13- and 17-round boomerang distinguishers of \skinny-64-128 and \skinny-64-192, respectively, the resulting probabilities match the experimental results and explain the gap left by the 3-wise framework through contributions from unequal-difference boomerangs.
## 2026/1474
* Title: Mu-qt-PEGASIS: Interactive Aggregate Signatures from Effective Isogenies in the Programmable Random-Oracle Model
* Authors: Nouhou Abdou Idris, Mustapha Hedabou
* [Permalink](https://eprint.iacr.org/2026/1474)
* [Download](https://eprint.iacr.org/2026/1474.pdf)
### Abstract
We present Mu-qt-PEGASIS, a mathematically precise con-
ditional compiler for interactive aggregate signatures built from the qt-PEGASIS effective class-group action. Our central observation is that
the torsor structure of the public-key space blocks the standard Schnorr-
or BLS-style verification equations used in conventional aggregate sig- natures. We resolve this by separating verification into two layers: a proof-authentication layer that certifies public-key registration and round- robin key aggregation, and a transcript-consistency layer that verifies the final aggregate signature relative to an authenticated aggregate key.
The resulting framework is formulated in the programmable random-oracle
model. Public-key registration and linked aggregation are authenticated
via FiatrCoShamir compilations of explicit public-coin +u-protocols for the relations Rreg and Rlink . Under the hardness of the Group Action Inverse Problem (GAIP), together with the random-oracle assumptions for Hnizk
and Hsig , we prove MU-EUF-CMA security against static corruptions.
At the protocol level, for a fixed FiatrCoShamir repetition parameter t, the aggregate signature has size O(t) and is independent of the number of
signers n, while the authenticated registration and aggregation transcript remain linear in n.
## 2026/1475
* Title: Partial Derandomization for Leakage-Resilient Shamir's Secret Sharing over Composite Order Fields
* Authors: S. Venkitesh
* [Permalink](https://eprint.iacr.org/2026/1475)
* [Download](https://eprint.iacr.org/2026/1475.pdf)
### Abstract
We make progress on the question of constructing explicit evaluation places for leakage-resilient Shamir's secret sharing, over composite order fields. Previously, Maji et al. (EUROCRYPT 2024) showed that random evaluation places yield Shamir's secret sharing over the composite order field $\mathbb{F}_{p^d}$ that is statistically secure against physical-bit leakage. Later, Nguyen (EUROCRYPT 2025) established a "dichotomy" that linear code-based secret-sharing scheme over the field $\mathbb{F}_{p^d}$ is either statistically secure or completely insecure against such leakage.
Building upon Nguyen's dichotomy, we present a partial derandomization of evaluation places, improving upon the Maji et al. result for a restricted regime of parameters. We replace the random choice of $n$ independent evaluation places by the iterates $x_j = \Phi^j(x_0)$ of a simple fixed rational function $\Phi$, where the initial point $x_0 \in \mathbb{F}_{p^d}^*$ is randomly chosen. The randomness in the evaluation places thus drops from $nd \log p$ bits to $d\log p$ bits. Our construction is valid for the regime $n = O(d/\log_p d)$, and any reconstruction threshold $k \ge 2$; in fact, the scheme attains perfect security (statistical distance exactly zero) against single-block leakage. Our technique is a partial fraction nondegeneracy argument that exploits the distinct poles of the rational iterates.
## 2026/1476
* Title: Constructing new permutation polynomials by the AGW Criterion
* Authors: Qian Liu, Liwei Fang, Zhengbang Zha, Jing Zhang
* [Permalink](https://eprint.iacr.org/2026/1476)
* [Download](https://eprint.iacr.org/2026/1476.pdf)
### Abstract
In this paper, we propose several classes of permutation polynomials having the form $\sum\limits_i(x^{2^m}+x+\delta)^{s_i}+ax$ for $i=1$ or $i=2$, where the exponent $s_i$ satisfies $s_i\equiv 2^j\pmod{2^m+1}$ or $s_i \equiv 2^j\pmod{2^m-1}$ for some different integers $j$, $a\in\mathbb{F}_{2^m}^*$ and $\delta\in \mathbb{F}_{2^{2m}}$. More precisely, by applying the AGW criterion and determining the number of solutions to certain equations over $\mathbb{F}_{2^{2m}}$, several classes of permutation polynomials of the form $(x^{2^m}+x+\delta)^s+ax$ over $\mathbb{F}_{2^{2m}}$ are presented. In addition, we construct some classes of permutation polynomials of the form $(x^{2^m}+x+\delta)^{s_1}+(x^{2^m}+x+\delta)^{s_2}+ax$ over $\mathbb{F}_{2^{2m}}$. Our results generalize some known constructions of permutation polynomials. Finally, we demonstrate that the permutation polynomials proposed in this paper are not quasi-multiplicative equivalent to known ones.
## 2026/1477
* Title: PERSEPHONE: Zero-Knowledge Multiplicative Non-Negative Proof for Sequential Private Range Verification
* Authors: Ivan Tjuawinata, Yann Fraboni, Darian Gunamardi, Jun Jie Sim, Zhenghao Wu, Hasventhran Baskaran, Chi-Hung Chi, Pu Duan, Kwok-Yan Lam
* [Permalink](https://eprint.iacr.org/2026/1477)
* [Download](https://eprint.iacr.org/2026/1477.pdf)
### Abstract
Numerous real-world systems in the FinTech space rely on zero-knowledge proof (ZKP) to verify information without revealing it. For example, range verification is an essential component of transaction systems to ensure that a payment amount does not exceed the payer's wallet balance. However, this verification requires to access the payer's account balance and transferred amount, which they may want to keep confidential. This drives the need for private range verification.
In its simplest form, private range verification can be achieved with a zero-knowledge range proof (ZKRP) to verify that a secret value lies within public bounds. When the bounds are also private, ZKRP can still be used, but multiple ZKRPs are needed for each private range verification.
This causes a considerable slowdown in the transaction system, which can not only delay transactions but also cause system failures when delays build up beyond control.
To address this limitation, we consider the problem of Sequential Private Range Verification, which involves verifying in a sequence that a series of values fall within sequentially-linked private bounds, rather than verifying each private range independently.
We propose a novel ZKP, which we call zero-knowledge multiplicative non-negative proof (ZK-MultNNP), and use it in our proposed framework PERSEPHONE to address this problem. We demonstrate experimentally that PERSEPHONE outperforms a ZKRP-based solution by 3x. Furthermore, we observe in a realistic digital payment system that transaction requests are always processed within the Doherty threshold of 400ms with the PERSEPHONE-based system, against only 9% for the ZKRP-based solution.
## 2026/1478
* Title: Provable Recovery of RSA Private Exponents below \(N^{11/42-\varepsilon}\)
* Authors: Yiming Gao, Honggang Hu
* [Permalink](https://eprint.iacr.org/2026/1478)
* [Download](https://eprint.iacr.org/2026/1478.pdf)
### Abstract
Wiener's continued-fraction attack gives the classical provable bound \(d<N^{1/4}\) for balanced RSA. Boneh and Durfee reached the exponent \(1-\sqrt{2}/2\approx0.2929\), but their argument relies on a heuristic independence assumption. We prove the first fully provable improvement beyond Wiener's \(1/4\) exponent: for every fixed \(\varepsilon>0\), balanced RSA with \(e=\Theta(N)\) can be factored deterministically in polynomial time whenever \(d\leq N^{11/42-\varepsilon}\).
## 2026/1479
* Title: Conjectures and Barriers for RS-MCA
* Authors: Przemek Chojecki
* [Permalink](https://eprint.iacr.org/2026/1479)
* [Download](https://eprint.iacr.org/2026/1479.pdf)
### Abstract
As a companion to the proved bounds in "Shortening Bounds for Reed-Solomon MCA", we formulate the complete finite Reed-Solomon mutual correlated agreement (MCA) problem and a pole-aware conjectural positive-density profile envelope. An exact first-match compiler and realized-image moment and incidence inequalities isolate the payments required for a safe certificate without confusing supports, pairs, rays, and affine slopes. We prove a ceiling-normalized moment obstruction, a projective incidence theorem and benchmark dimension diagnostic, and a moving-scale consequence of the previously proved implication from a Sidon payment through the Balog-Szemer\'edi-Gowers theorem and Boolean-cube growth. Exact unsafe edges, repository audits, and numerical margins lead to four direct adjacent conjectures - two MCA and two auxiliary list inequalities - whose safe sides still require primitive-fiber, residual-projection, algebraic-routing, and add-back payments. In a collision-nonbinding, subexponential-budget identity-candidate branch, we conjecture a non-oracular exhaustive atlas whose exact unsafe--safe bracket, through a proved crossing reduction, yields \(\delta^*_{C_n,\mathrm{off,sup}}=1-\rho_n-g^*(\rho_n,\log_2 |{\mathbb B_n}|)+o(g_n^*)\); the general identity lower route instead uses an exact pole-adjusted target, and no matching bracket is claimed for the unrestricted smooth or circle problem.
## 2026/1480
* Title: Doubly-Efficient Secret-Key PIR with Low Storage Overhead
* Authors: Caicai Chen, Yuval Ishai, Aayush Jain, Tamer Mour, Alon Rosen, Chaoping Xing
* [Permalink](https://eprint.iacr.org/2026/1480)
* [Download](https://eprint.iacr.org/2026/1480.pdf)
### Abstract
In secret-key private information retrieval, a client with a short secret key retrieves a database item while hiding the requested index, and possibly also the database, from the server. The server answers using an encoded version of the database, generated via one-time preprocessing. Secret-key PIR provides an attractive "stateless" alternative to stateful PIR and oblivious RAM, and can be viewed as strengthening the standard notion of searchable symmetric encryption by not allowing any access pattern leakage.
We give the first candidate doubly-efficient secret-key PIR schemes that achieve a constant multiplicative storage overhead, asymptotically approaching 1 in natural regimes, together with $k^{o(1)}$ communication and online server work for a database of size $k$. The best previous online server work with constant storage overhead was $k/\textrm{polylog}(k)$.
Our constructions follow the permuted-code blueprint for doubly efficient sk-PIR (Boyle-Ishai-Pass-Wootters and Canetti-Holmgren-Richelson, TCC 2017), and are based on similar assumptions. The main novelty is that we instantiate this blueprint using new families of "$t$-smooth" locally decodable codes with improved tradeoffs between rate, locality, and smoothness. This includes a new $t$-smooth local decoder for Reed-Muller codes using concatenated curves, as well as a construction based on curve-lifted codes that has attractive concrete efficiency features.
We perform extensive cryptanalysis of the underlying assumptions and benchmark performance under realistic parameters, demonstrating the practicality of our schemes. A representative instantiation encodes a $37$ GB database of $18$-bit records with only $4.2$|u storage overhead, while requiring the server to read less than $600$ KB from the encoded database per query.
## 2026/1481
* Title: 88-XOR Implementation of the AES MixColumns Matrix
* Authors: J|-r|-my Jean
* [Permalink](https://eprint.iacr.org/2026/1481)
* [Download](https://eprint.iacr.org/2026/1481.pdf)
### Abstract
We give in this short note a circuit implementing the matrix-vector product with the 32x32 binary matrix of the AES MixColumns using 88 XOR gates. Previously known circuits minimizing this metric have been published in the past years and achieved 94 XOR, 92 XOR, 91 XOR, and 89 XOR. As far as we can tell, a circuit with 88 XOR was previously unknown.
## 2026/1482
* Title: Practical Adaptor Signatures: Security and Applications
* Authors: Pavel Hub|i-iek, Krist|+na Ma+ikov|i, Berenika Richterov|i
* [Permalink](https://eprint.iacr.org/2026/1482)
* [Download](https://eprint.iacr.org/2026/1482.pdf)
### Abstract
Adaptor signatures allow a signer to publish a prerCasignature that can be transformed into a valid signature by anyone once a secret witness is learned. Poelstra first suggested this primitive to bypass the limited scripting capabilities of Bitcoin. These schemes were later formalized by Aumayr et al. (ASIACRYPT 2021) and refined by Dai et al. (INDOCRYPT 2022) and Gerhart et al. (EUROCRYPT 2024). In this work, we revisit the constructions of adaptor signatures deployed in practice without any formal proof of security.
First, we demonstrate that the current security model does not capture the ECDSA adaptor signature that underlies most realrCaworld systems. Second, we propose a relaxed definition and prove that it is satisfied by the ECDSA adaptor construction under the strong unforgeability of ECDSA. Finally, focusing on oraclerCabased conditional payments, we formulate the first security model for adaptorrCabased Discreet Log Contracts (DLCs) and show that our relaxed notion suffices for their security.
## 2026/1483
* Title: MQ on my Hardware: Performance Analysis of MQOM on FPGA
* Authors: Stelios Manasidis, Quinten Norga, Suparna Kundu, Ingrid Verbauwhede * [Permalink](https://eprint.iacr.org/2026/1483)
* [Download](https://eprint.iacr.org/2026/1483.pdf)
### Abstract
Recent algorithmic advancements in the Multi-Party Computation-in-the-Head (MPCitH) paradigm have resulted in more efficient post-quantum digital signature schemes. MQOM is a MPCitH-based digital signature scheme and candidate in the ongoing NIST Post-Quantum Cryptography (PQC) standardization effort, offering performance competitive with lattice- and multivariate-based schemes in software.
In this work, we develop a dedicated hardware accelerator for MQOM and analyze the impact of recent algorithmic modifications on hardware performance. This is achieved through the careful co-design of high-throughput symmetric primitive engines and highly-optimized polynomial arithmetic cores, minimizing stalling and supporting entirely on-the-fly computations of all polynomial arithmetic. As a result, no intermediate buffers are required and re-computation or sampling is avoided. Secondly, we analyze MQOM's use of correlated GGM trees for generating MPC party shares, which reduce computational cost at the cost of increased signature size. We observe that this choice leads to increased design flexibility and significantly reduces on-chip memory requirements for hardware designs. Furthermore, MQOM proposes several parameter sets per security level. We analyze the impact of different MQOM parameter sets on hardware cost and performance. Our design with NIST L1 parameters only requires 15 812/9 384 LUTs/FFs and 4.5 BRAMs on FPGA, while performing the signature generation in 0.46 ms and signature verification in 0.38 ms. Compared to state-of-the-art hardware implementations of other MPCitH-based DSAs, we improve the area-time-product (ATP) by a factor $3.5\times$ up to $66.4\times$. Compared to the lattice-based ML-DSA scheme, our MQOM hardware design is only outperformed by a factor $1.5\times$. Our results show that MQOM and the correlated GGM tree structure are hardware-friendly designs, leading to one of the highest HW-vs-SW speedup ratios among similar PQC DSAs, while also attaining the smallest on-chip memory footprint among high-performance hardware implementations.
## 2026/1484
* Title: The SecureDrop Protocol: End-to-End Encrypted Whistleblowing for All
* Authors: Giulio Berra, Felix Linker, Luca Maier, Cory Francis Myers, Kenneth G. Paterson, Rowen Shane, Shannon Veitch
* [Permalink](https://eprint.iacr.org/2026/1484)
* [Download](https://eprint.iacr.org/2026/1484.pdf)
### Abstract
Confidential sources are vital for investigative journalism and thus for holding those in power to account. However, sources often face great risks to their privacy and safety. SecureDrop is a system that enables sources to anonymously contact journalists, including at major news organisations around the world. Despite its widespread use, the current design requires physical servers hosted on premises. While cloud-based deployment would alleviate this burdensome requirement and improve SecureDrop's usability and accessibility, it would also introduce new threats to security that are not addressed by the current design. In particular, a lack of end-to-end encryption presents serious risks in the event that a cloud service provider is coerced into revealing information.
In this work, we present and formally analyse a new protocol for SecureDrop which addresses the challenges of off-premises deployment. Our protocol composes an encryption scheme with hybrid post-quantum guarantees and an identity-hiding message-fetching mechanism to provide strong anonymity guarantees. In contrast to existing systems, we minimise incriminating evidence against whistleblowers by providing message-level deniability and by having sources remain stateless. Our formal security analysis combines the Tamarin prover for symbolic analysis and game-based proofs for computational analysis. Finally, our benchmarks demonstrate that the protocol achieves practical levels of performance in a browser context. The Freedom of the Press Foundation plans to deploy the new protocol, with integration efforts beginning in 2026.
## 2026/1485
* Title: From PQC to HHE: Reusing a Co-Design Platform for Side-Channel-Protected PASTA
* Authors: Ahmet Malal, Tolun Tosun, O-fuz Yayla, Erkay Savas
* [Permalink](https://eprint.iacr.org/2026/1485)
* [Download](https://eprint.iacr.org/2026/1485.pdf)
### Abstract
Hybrid homomorphic encryption (HHE) lets a constrained client send compact symmetric ciphertexts while a server transciphers them into homomorphic ciphertexts, making HE-friendly ciphers such as PASTA a practical choice. Efficient and side-channel-secure execution of PASTA on embedded devices, however, remains challenging, since existing hardware relies on dedicated cipher cores and provides no side-channel protection. We present a hardware/software co-design of PASTA on RISQrypt, an existing post-quantum cryptography (PQC) platform, without adding any cipher-specific RTL. The affine layers, S-boxes, and SHAKE128 sampling are executed by the platform's arithmetic and Keccak accelerators under software control. We further integrate first-order arithmetic masking by reusing the masking accelerator for share refreshing and masked-multiplication randomness, requiring no additional hardware while keeping arithmetic on secret shares off the processor datapath. The masked multiplication shows no first-order leakage in a TVLA evaluation with $100\,000$ traces on an Artix-7 FPGA. Compared with a software-only baseline on the same core, the co-design achieves speed-ups of $9.68\times$ and $9.85\times$ in the unmasked and masked configurations, respectively. To the best of our knowledge, this is the first side-channel-protected, hardware-accelerated implementation of PASTA.
## 2026/1486
* Title: The supersingular isogeny problem in time and memory $p^{1/3+o(1)}$
* Authors: Benjamin Wesolowski
* [Permalink](https://eprint.iacr.org/2026/1486)
* [Download](https://eprint.iacr.org/2026/1486.pdf)
### Abstract
We prove that under a plausible heuristic assumption (on the smoothness of certain random integers), the supersingular isogeny problem can be solved in time and memory $p^{1/3 + o(1)}$. This improves upon the previous best complexity of $p^{1/2} \cdot(\log p)^{O(1)}$.
This problem is arguably the central hard problem underlying isogeny-based cryptography, and the cost of its resolution is a major (and often the only) factor in the choice of secure parameters. The impact on concrete parameter sets remains to be clarified, as the asymptotic advantage of the new algorithm is mitigated by a superpolynomial overhead hiding in the $o(1)$ exponent, and by its high memory requirement.
## 2026/1487
* Title: LightShark: Actively Secure Machine-Learning Inference Based on Lightweight Authenticated Distributed Comparison Function
* Authors: Chenkai Zeng, Qi Feng, Debiao He, Min Luo
* [Permalink](https://eprint.iacr.org/2026/1487)
* [Download](https://eprint.iacr.org/2026/1487.pdf)
### Abstract
Recently, Shark (S\&P'25) considered the problem of actively two-party secure machine learning inference using an authenticated distributed comparison function (DCF). This is the state-of-the-art work in this setting. On the other hand, Grotto (CCS'23) built a variant DCF with the key size half that of classic DCF. Unfortunately, as Shark states, \textit{it is not known how to extend Grotto to the malicious setting}. In this paper, we present the first actively secure Grotto-style DCF scheme. Our authenticated DCF is deliberately designed on the correlated GGM tree and maintains the key-size advantage of semi-honest Grotto. We further implement an actively secure ML inference framework, named LightShark, which supports efficient primitives (e.g., ReLU, spline, and truncation) and ML models (e.g., VGG-16, GPT, BERT). Compared with Shark, our LightShark outperforms by $1.49 \times \sim 2.69\times$ and reduces communication costs by $66.7\%$ for Bert-base inference. Surprisingly, for larger LLM models, the experimental evaluation demonstrates that our framework works vastly well.
## 2026/1488
* Title: Privacy-Preserving Counterfactual Explanations for Federated AI
* Authors: Sjoerd Berning, Vincent Dunning, Thijs Veugen, Kevin Witlox
* [Permalink](https://eprint.iacr.org/2026/1488)
* [Download](https://eprint.iacr.org/2026/1488.pdf)
### Abstract
As the usage of Artificial Intelligence (AI) for sensitive purposes increases, there is a growing need for privacy-aware explainable AI (XAI) tools. In this paper, we present a privacy-preserving counterfactual explanation algorithm. Our starting point is a decision-support model that is able to operate on vertically partitioned datasets, meaning that each party holds a different subset of datapoint attributes. The goal of a counterfactual algorithm is to find, given an observation, a datapoint from the (virtual) dataset that is closest to the observation but has a different label. Our algorithm fully preserves the privacy of the n datapoints belonging to the different parties by combining the strengths of homomorphic encryption and secret sharing. Through a number of experiments, we demonstrate the added value of combining multiple datasets in a realistic scenario and show that the privacy-preserving solution does not affect the accuracy. We fully implement our solution and demonstrate that it scales as to thousands of datapoints.
## 2026/1489
* Title: SwitchFold: Code-Agnostic Succinct Polynomial Commitments via Recursive Code Switching
* Authors: Mingshu Cong, Tsz Hon Yuen, Siu-Ming Yiu
* [Permalink](https://eprint.iacr.org/2026/1489)
* [Download](https://eprint.iacr.org/2026/1489.pdf)
### Abstract
We study large-scale, field-agnostic, hash-based polynomial
commitment schemes (PCSs) with the goal of minimizing prover time while preserving polylogarithmic proof size and verifier time. This setting is motivated by advanced applications of zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs) such as zero-knowledge machine learning (zkML), where committed polynomials may encode billions of parameters and large prime fields are desirable for avoiding wraparound in fixed-point arithmetic.
We introduce SwitchFold, a generic construction of a hash-based multilinear PCS from any sequence of linear codes with geometrically increasing block lengths. The polylogarithmic proof size and verifier time do not rely on any specific algebraic structure of the codes, while the linear prover time follows solely from the linear encoding time. At its core, SwitchFold recursively applies the code-switching technique (Ron-Zewi and Rothblum, JACM rCO24), reducing each multilinear extension (MLE) claim under one code to a simpler MLE claim under a shorter code. The generator-matrix MLE claims produced by code switching are accumulated across repeated PCS openings using an accumulation scheme (B|+nz et al., TCC rCO20), and are then proved through a final recursion. We instantiate SwitchFold with the Brakedown code sequence (Golovnev et al., CRYPTO rCO23), whose recursive code structure aligns naturally with our framework; we call the resulting scheme BrakeFold. In contrast to prior code-switching PCSs such as Blaze (Brehm et al., EUROCRYPT rCO25) and BrakingBase (Nair et al., ASIACRYPT rCO25), SwitchFold does not require an auxiliary foldable code. At the scale of one billion coefficients and 100-bit security, the marginal cost of each additional PCS opening in BrakeFold yields 3.5|u smaller proof size and 20.6|u faster verification than Brakedown, with only a 1.3|u increase in prover time. Its succinctness matches that of BaseFold (Zeilberger et al., CRYPTO rCO24), while reducing prover time by 17.0|u.
## 2026/1490
* Title: On the Formal Verification of Polynomial Commitments: two KZG constructions and the Algebraic Group Model
* Authors: Tobias Rothmann
* [Permalink](https://eprint.iacr.org/2026/1490)
* [Download](https://eprint.iacr.org/2026/1490.pdf)
### Abstract
We formalize the notion of polynomial commitment schemes (PCSs) in the proof assistant Isabelle/HOL and formally verify the security proofs of two variants of the widely popular Kate, Zaverucha, and Goldberg (KZG) construction. Moreover, we formalize the Algebraic Group Model (AGM) by Fuchsbauer, Kiltz, and Loss using a novel constraint-programming-inspired approach. We formalize a reusable abstract definition of polynomial commitment schemes and define games for correctness, binding, hiding, and knowledge soundness/extractability. Based on this, we verify all applicable security proofs for two concrete PCS constructions: the standard (DL-)KZG and a batched KZG, using our AGM formalization in the knowledge-soundness proofs. Our proofs follow ShouprCOs sequence-of-games approach, with machine-checked transitions, and are carried out in the CryptHOL framework for formal verification of cryptography in Isabelle. To our knowledge, this work is the first formalization of polynomial commitment schemes, the first formalization of the AGM, and the first formal verification of the security proofs for any concrete polynomial commitment scheme. This work lays the foundation for the formal verification of advanced cryptographic constructions, such as pairing-based zero-knowledge proofs (ZKPs) and succinct arguments.
## 2026/1491
* Title: Exploiting Load/Store Leakage of Sparse Vectors for Key Recovery in HQC
* Authors: Gustavo Banegas, Benjamin Smith, Jad Zahreddine
* [Permalink](https://eprint.iacr.org/2026/1491)
* [Download](https://eprint.iacr.org/2026/1491.pdf)
### Abstract
Hamming Quasi-Cyclic (HQC) is a code-based key encapsulation mechanism
selected by NIST for standardization,
making its resistance to implementation attacks critically important.
We present a side-channel attack that exploits load/store leakage
in the manipulation of HQC's sparse secret vectors.
Analysing Cortex-M4 assembly generated from the reference
implementation, we identify a leakage surface in which the low and
high 32-bit halves of each 64-bit word leak with different strengths,
due to compiler-generated register spilling.
We exploit this leakage to construct a simple zero-word distinguisher
classifying machine words of the secret vector as zero or nonzero
from electromagnetic measurements.
The recovered zero positions are then translated into decoding hints,
reducing HQC key recovery to a shortened syndrome-decoding problem.
We analyse the resulting decoding complexity for all HQC parameter sets:
at 32-bit granularity an expected $88.7\%$ of the machine words of~$y$ are
zero for HQC-1, cutting the decoding to ${\approx}\,2^{46}$ bit operations.
Experiments on a Cortex-M4 validate the predicted low/high-half
asymmetry---approximately $500$ traces for the stronger low-half channel
and $5{,}000$ for the weaker high-half channel---and recover
the zero words of an HQC-1 key at 32-bit granularity.
Finally, we discuss practical countermeasures that eliminate
the sparsity exploited by the attack.
## 2026/1492
* Title: Proof of Demand Is Not Proof of Work: On the Limits of Demand-Weighted Consensus under Free Pseudonyms
* Authors: |umer Demirel
* [Permalink](https://eprint.iacr.org/2026/1492)
* [Download](https://eprint.iacr.org/2026/1492.pdf)
### Abstract
Proof-of-useful-work (PoUW) certifies computational hardness, not utility: a certified computation need not be anyone's demanded job. We separate three properties of a work receipt rCo work soundness ($\mathsf{W}$), job binding ($\mathsf{B}$), and demand exogeneity ($\mathsf{E}$) rCo and locate the gap at $\mathsf{E}$. Two results are unconditional. First, payments between coalition-controlled requesters and workers are recoverable transfers that contribute no Sybil-resistant cost, so no security lower bound may count them (Lemma 1). Second, under free pseudonyms and endogenous observation a coalition can simulate the receipts of economically independent requesters, so endogenous receipts cannot certify $\mathsf{E}$ (Theorem 1); we lower-bound the cost of evading a stated class of provenance estimators. Building on these, a robustness bound: because a permissionless mechanism must remain live on the zero-demand path, its leader-election floor cannot depend on the demand component of service receipts (Theorem 2), and any admissible receipt boost is quantitatively capped. Fork-independent salvage value of useful outputs can leave security neutral, negative, or positive depending on salvage asymmetry and demand, which we characterize in a stylized free-entry model. Constructively, an irrecoverable tax on every settled payment makes the burn rCo not proof of independence rCo the security resource. Deployed evidence comprises one reported audit (Pearl cuPOW) and a reward-program farming analogue; the election-side failure is, at present, a model prediction. Useful-computation receipts are appropriate instruments for payment, collateral, and loss allocation rCo and a bounded, priced election boost rCo but not the leader-election floor.
## 2026/1493
* Title: Bob DyLean: A Framework for the Symbolic Analysis of Cryptographic Protocols in Lean
* Authors: Th|-ophile Wallez, Cas Cremers
* [Permalink](https://eprint.iacr.org/2026/1493)
* [Download](https://eprint.iacr.org/2026/1493.pdf)
### Abstract
Over the last decades, symbolic (Dolev-Yao) methods for the analysis of security protocols have proven to be effective to analyze and establish strong guarantees for widely deployed protocols and systems, such as TLS 1.3, E-voting protocols, EMV, and MLS. On the one hand, analysis methods like Tamarin and ProVerif provide automation and support for user-defined equational theories. On the other hand, methods like DY* offer more flexible and modular reasoning, but hardcode threat models and do not support custom equational theories.
We present DyLean, a framework for the symbolic analysis of cryptographic protocols in the Lean theorem prover. Our framework comprises both a flexible general-purpose symbolic semantics, as well as a concrete proof methodology.
DyLean allows defining protocols and expected security properties; its semantics and equational theories can be customized by the user. Furthermore, the semantics are agnostic of the specific proof methodology: our goal is to provide a generic framework that can be used by the community as a foundation to develop various proof methodologies.
Moreover, we provide a concrete proof methodology inspired by DY*, based on trace invariants. Thus, DyLean inherits from the qualities of DY*: it is able to analyze protocols involving unbounded loops or datastructures, and is able to compose security proofs in a variety of scenarios. Our proof methodology improves on DY* by allowing for user-defined equational theories and threat models. We exercise DyLean on several focused case studies, which include protocols using merkle trees, ratcheting protocols, post-quantum protocols, and protocols analyzed under different equational theories, which demonstrates that DyLean can effectively analyze protocols with each of these features.
## 2026/1494
* Title: On $k$-way split multiplication algorithms
* Authors: Mehmet |uzg|+n Cihangir, O-fuz Yayla
* [Permalink](https://eprint.iacr.org/2026/1494)
* [Download](https://eprint.iacr.org/2026/1494.pdf)
### Abstract
Efficient polynomial multiplication and matrix-vector operations are fundamental to computational algebra and modern cryptography. In lattice-based post-quantum cryptography (PQC), schemes utilizing Number Theoretic Transform (NTT)-unfriendly rings require highly optimized subquadratic multiplication algorithms. In this paper, we establish a rigorous mathematical framework for generalized $k$-way split polynomial multiplication and Toeplitz Matrix-Vector Product (TMVP) algorithms over arbitrary fields. First, we construct generalized $k$-way Schoolbook and Karatsuba multiplication algorithms, deriving exact closed-form recurrence relations and arithmetic complexities for any integer $k$. Second, we introduce a novel $k$-way TMVP algorithm utilizing optimal evaluation points and matrix row-reversal techniques. We mathematically prove that this generalized formulation strictly achieves the theoretical interpolation lower bound, requiring exactly $2k-1$ subproblems and yielding a subquadratic asymptotic complexity of $O(n^{\log_k(2k-1)})$. Furthermore, we determine the optimal consecutive application sequence of $k$-way Karatsuba and Schoolbook algorithms for any input size $n$, proving that the peak efficiency is driven entirely by the prime factorization of $n$. Finally, we establish exact algebraic crossover thresholds, demonstrating that our generalized TMVP formulas and optimal algorithmic sequences significantly outperform state-of-the-art unequal $k$-way splits and classical combinations in the literature, providing minimum arithmetic operation counts for $k \in \{5, 6, 8, 12\}$ and inputs of power-of-two and power-of-three dimensions.
## 2026/1495
* Title: Oblivious Sorting under Fully Homomorphic Encryption: A Comprehensive Survey and Performance Analysis
* Authors: Omar Ahmed, Rostin Shokri, Nektarios Georgios Tsoutsos
* [Permalink](https://eprint.iacr.org/2026/1495)
* [Download](https://eprint.iacr.org/2026/1495.pdf)
### Abstract
Outsourcing computations to cloud providers raises significant data privacy concerns, making Privacy-Preserving Computation via Fully Homomorphic Encryption (FHE) increasingly vital. However, adapting data sorting routines to the FHE domain introduces severe performance bottlenecks. This survey systematizes the state-of-the-art in FHE-based sorting algorithms. A novel complexity metric, FHE-Effort, is introduced to accurately evaluate homomorphic circuit efficiency. Eighteen algorithms are benchmarked across three major FHE schemes using a unified codebase. The analysis concludes that TFHE is currently the most efficient scheme for sorting applications, and sorting networks like Odd-Even Merge and Bitonic Sort offer the optimal algorithmic architectures.
## 2026/1496
* Title: Floor-IT: Information-Theoretic BFT in Partial Synchrony with Two Round Good Case Latency and Optimal Resilience
* Authors: Ittai Abraham, Yuval Efron, Jovan Komatovic, Alejandro Ranchal-Pedrosa
* [Permalink](https://eprint.iacr.org/2026/1496)
* [Download](https://eprint.iacr.org/2026/1496.pdf)
### Abstract
In the information-theoretic model, parties communicate over sender-authenticated point-to-point channels, but use no digital signatures or other transferable cryptographic certificates; the adversary is otherwise computationally unbounded. We present \name, an information-theoretic Byzantine agreement protocol for partial synchrony with a good-case latency of two rounds that achieves the optimal resilience bound of $n = 5f - 1$ in this setting. When the actual network delay after GST is at most $\delta \le \Delta$, our protocol achieves a \emph{robust} good-case latency of $2\delta$. The protocol proceeds in views and guarantees a worst-case view latency of at most $2\Delta + 2\delta$. Moreover, each party requires only $O(1)$ words of persistent storage, and each view incurs $O(n^2)$ messages of $O(1)$ words each.
## 2026/1497
* Title: Updatable Private Set Union: Generic Construction with Efficient Instantiation
* Authors: Seongbong Choi, Hyung Tae Lee
* [Permalink](https://eprint.iacr.org/2026/1497)
* [Download](https://eprint.iacr.org/2026/1497.pdf)
### Abstract
Private set union~(PSU) allows two parties to compute the union of their private sets without revealing their intersection.
In many real-world applications, parties' datasets undergo frequent updates as elements are added or removed over time.
Existing PSU protocols, however, must recompute the entire union from scratch whenever either party's set changes.
This becomes highly inefficient when updates are small or frequent relative to the original set sizes.
In this paper, we introduce the first updatable PSU~(uPSU) protocol for the standard two-party setting, which supports efficient incremental updates.
We present a systematic classification of all possible update scenarios, which shows that only a small subset of updated elements actually modify the union, and establish the leakage baseline for uPSU.
Based on these classification and leakage baseline, we provide a generic construction for uPSU that uses existing PSI and a tagged variant of PSU as building blocks.
We prove security against semi-honest adversaries in the simulation-based model, and guarantee that incremental updates reveal no more information than a fresh execution of a standard PSU protocol on the updated sets.
We instantiate and implement our generic construction using Kim et al.'s PSU protocol~(ACM SAC 2026) and Raghuraman and Rindal's PSI protocol~(ACM CCS 2022), demonstrating significant performance improvements over full recomputation of the union, even though its cost still depends on the original set size rather than purely on the update size.
For set size $n = 2^{20}$ and update size $t = 2^{12}$, our protocol achieves a 14.1--45.4$\times$ speedup with a 4.8--59.1$\times$ communication reduction over full recomputation using baseline PSU protocols.
## 2026/1498
* Title: Multilevel Amortized Gaussian Elimination in Information-Set Decoding: Applications to HQC and PCG
* Authors: K|-vin Carrier, Val|-rian Hatey, Laura Luzzi, Jean-Pierre Tillich
* [Permalink](https://eprint.iacr.org/2026/1498)
* [Download](https://eprint.iacr.org/2026/1498.pdf)
### Abstract
For cryptosystems whose security relies on the hardness of decoding in the sublinear regime, the best known attacks are based on Information Set Decoding (ISD). In this regime, which is particularly relevant to HQC and Pseudorandom Correlation Generators (PCG), the cost of Gaussian elimination is no longer negligible and significantly affects the overall attack complexity.
In this work, we revisit the Reduce-and-Prange technique of Kim and Lee, which reduces the cost of Gaussian elimination by reusing partial pivots. We refine its complexity analysis using branching-process techniques, thereby obtaining a more accurate assessment of its performance. We then extend partial pivot reuse to Stern's algorithm and introduce MAGE-Stern, a multilevel amortized Gaussian elimination variant of Stern's algorithm.
Under a consistent logic-gate cost model, MAGE-Stern improves upon the best previously known attack against HQC by approximately 3 bits in time complexity, while reducing the memory complexity by about 12 bits. In particular, we estimate the security of the standardized HQC Category I parameter set at approximately 140 bits, about 3 bits below its NIST security target. We further combine multilevel amortized Gaussian elimination with the projective decoding framework of Carrier, Hatey, and Tillich, and investigate its application to regular decoding. Applied to the reference Pseudorandom Correlation Generator (PCG) parameter sets of Boyle, Couteau, Gilboa, and Ishai, the resulting algorithms improve upon the best previously known attacks by up to 6 bits across a broad range of practical parameters.
## 2026/1499
* Title: BF-#: A Bloom-Filtered Brute-Force Framework for Multi-Target Password Recovery
* Authors: Cansu Karakuzu Aslan, Wenzel P|+nter, Christian D||rr
* [Permalink](https://eprint.iacr.org/2026/1499)
* [Download](https://eprint.iacr.org/2026/1499.pdf)
### Abstract
Password-based authentication remains widespread, and large-scale sets of leaked hashes enable practical offline brute-force attacks. Multi-target attacks, which check candidates against large sets of hashes simultaneously, are particularly effective. Understanding the capabilities of low-cost platforms for such attacks is important to assess real-world password security risks.
Therefore, we present BF-#, a modular and scalable FPGArCoCPU framework that accelerates multi-target password recovery. BF-# combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs exact membership check using a perfect hash function. We implement BF-# on the low-cost, \$199 NiteFury II board. With 16 parallel pipelines running at a 100 MHz clock frequency, our FPGA implementation generates $1.6\times10^9$ hashes/s. In our experiments, BF-# demonstrates up to $7.5\times$ higher throughput than John the Ripper, and reduces power consumption by as much as $90\%$ compared to Hashcat on an RTX 5000.
## 2026/1500
* Title: How to Define Expected Quantum Polynomial-Time Zero Knowledge Simulation
* Authors: Zhengnan Lai, Nicholas Spooner, Max Tromanhauser
* [Permalink](https://eprint.iacr.org/2026/1500)
* [Download](https://eprint.iacr.org/2026/1500.pdf)
### Abstract
Zero knowledge is formalized via a simulator rCo i.e., an efficient computation which simulates the view of a (malicious) verifier. The foundational results in constant-round zero knowledge [GMW86,FS90,GK96] all use expected polynomial-time (EPT) simulators, and there is evidence that strict poly-time simulators do not exist for these protocols [BL02]. In the post-quantum setting, we must upgrade the simulator to at least quantum polynomial time (QPT) in order to properly simulate quantum verifiers. Chia et al. [CCLY22] proved a surprising negative result which precludes non-trivial ZK for constant-round protocols with both (strict) QPT and a natural notion of expected quantum polynomial-time (EQPT) black-box simulation. In light of this, Lombardi, Spooner, and Ma [LMS22] introduced a novel EQPT notion, coherent-runtime EQPT or EQPT$_c$, and showed that the [GMW86,FS90,GK96] protocols all allow for EQPT$_c$ simulation.
In this work, we identify a fundamental issue with the definition of EQPT$_c$ simulation, and propose a resolution. In particular, we demonstrate that EQPT$_c$ computation is not necessarily efficient and can, in fact, decide any classical decision problem. This is possible through a freedom of choice in selecting a unitary dilation for an efficient quantum channel. We propose an revised definition which carefully restricts this choice, and prove that the definition preserves the zero knowledge of the [GMW86,FS90,GK96] protocols. Additionally, by upgrading the [GK96] framework to the fully quantum setting, we demonstrate for the first time a constant-round (malicious verifier) zero knowledge proof system for QMA (with EQPT$_c$ simulation).
## 2026/1501
* Title: Phishing in the Noise: Analysis of CT-based Phishing Detection Performance on Free Hosting Platforms
* Authors: Maksymilian Nowak, Wojciech Mazurczyk, Ewa Syta
* [Permalink](https://eprint.iacr.org/2026/1501)
* [Download](https://eprint.iacr.org/2026/1501.pdf)
### Abstract
Free Hosting Platforms (FHPs) let users publish websites with minimal cost and configuration, but the same provider-managed infrastructure can also be used to host phishing websites. We study how this setting affects Certificate Transparency (CT)-based phishing detection by analyzing X.509, CT, and URL features across FHP phishing, FHP benign, non-FHP phishing, and popular benign websites. Reflecting the shared and wildcard certificate practices common in this setting, we analyze the certificate-level and domain-level data separately.
Our measurement study shows that many apparent phishing indicators instead reflect hosting-provider characteristics: in our domain-level correlation analysis,
hosting-platform status is more strongly associated with the extracted X.509, CT, and URL features than phishing status is, with the strongest FHP-associated feature (subdomain levels, $\eta=0.54$) exceeding the strongest phishing-associated feature (certificate validity period, $\eta=0.31$).
We further evaluate two representative CT-based phishing detection frameworks on FHP-only data and discover that provider-managed infrastructure creates challenges for applying them directly. These findings show the need for future work on CT-based phishing detection methods that account for this deployment setting, especially as AI tools lower the effort required to create convincing phishing websites at scale.
## 2026/1502
* Title: Efficient Privacy-Preserving LSTM Inference on Encrypted Sequential Data
* Authors: Qiang He, Jingwei Chen, Wenyuan Wu, Yong Feng
* [Permalink](https://eprint.iacr.org/2026/1502)
* [Download](https://eprint.iacr.org/2026/1502.pdf)
### Abstract
Recent advances in fully homomorphic encryption (FHE) have enabled privacy-preserving machine learning directly over encrypted data. As a representative recurrent architecture, the long short-term memory (LSTM) network is widely used for modeling sequential dependencies, yet existing FHE-based LSTM inference schemes still suffer from high latency and limited scalability. In this paper, we present an efficient privacy-preserving LSTM inference protocol on encrypted sequential data based on FHE. We insert a lightweight normalization module before nonlinear activations to bound the hidden states, thereby enabling accurate low-degree polynomial approximations of the Sigmoid, Tanh, and inverse square-root functions via a hybrid Remez and least-squares strategy. We implement the proposed protocol using the Lattigo library, incorporating ciphertext packing optimization, rotation minimization, and SIMD-based parallelization. Experiments show that on standard text classification benchmarks, our encrypted LSTM achieves competitive accuracy compared with plaintext models and consistently outperforms the state-of-the-art FHE-based method, achieving up to a 4.7x speedup.
## 2026/1503
* Title: The Consensus Number of Untraceable Cryptocurrencies
* Authors: Christian Cachin, David Lehnherr, Juan Villacis, Fran|oois-Xavier Wicht
* [Permalink](https://eprint.iacr.org/2026/1503)
* [Download](https://eprint.iacr.org/2026/1503.pdf)
### Abstract
Sender untraceability hides the account spent by a cryptocurrency transfer among a set of candidates, its masking set. What a transfer does to that set separates two designs: classical schemes retain the whole set and append a nullifier marking the spent account, so the ledger grows with every transfer; constant-state schemes instead consume and replace the entire set. We ask how this choice affects synchronization.
We formalize the two designs as the linear and constant untraceable asset transfer objects (LUAT and CUAT) and locate them in the consensus hierarchy. In LUAT, transfers from distinct accounts commute. Its consensus number is 2, compared with 1 for standard asset transfer, independently of the masking-set size and of the untraceability notion, and LUAT is starvation-free. Partitioning the accounts into fixed masking sets lets exhausted sets be garbage-collected without increasing that number.
In CUAT, a transfer consumes and replaces every account of its masking set, so two transfers whose sets intersect cannot both take effect. We formalize this with the conflict graph on masking sets, whose edges join sets sharing an account. Under weak untraceability, which protects a transaction in isolation, the consensus number is unbounded already for one-round protocols. Under strong untraceability, which protects against an observer of the complete history, untraceability holds on a history exactly when any two accounts sharing a masking set occur in the same number of the masking sets in it. This uniform incidence bounds the conflict graph, and matching constructions attain it, so the consensus number is determined exactly and grows quadratically in the masking-set size. Finally, CUAT is not starvation-free. The two objects therefore pay for the same privacy differently: LUAT in storage, CUAT in synchronization and fairness.
## 2026/1504
* Title: Encifher: A Trusted-Execution Coprocessor for Confidential Computation on Solana
* Authors: Nitanshu Lokhande, Rishabh Gupta, Rachit Chahar, Arun Jangra, Aniket Prajapati, Muskan Kumari
* [Permalink](https://eprint.iacr.org/2026/1504)
* [Download](https://eprint.iacr.org/2026/1504.pdf)
### Abstract
Public blockchains expose all state and computation by default, which is incompatible with financial applications that require confidentiality. Solana achieves high throughput and sub-second confirmation, making it an attractive settlement layer, yet it oN4Cers no general mechanism for computing over encrypted state: fully homomorphic encryption (FHE) remains orders of magnitude too slow for interactive use, secure multi-party computation (MPC) incurs heavy communication, and SolanarCOs native confidential-transfer extension hides only token amounts and supports no programmable logic. We present Encifher, a confidentiality coprocessor for Solana that brings general, programmable computation over encrypted state to a high-throughput chain. Encifher adopts the ciphertext-handle and symbolic-execution interface of confidential-computing coprocessors (e.g., ZamarCOs fhEVM), but resolves it inside a Trusted Execution Environment (TEE) rather than with a fully homomorphic evaluator: on-chain Solana programs manipulate only 128-bit handles to ciphertexts, while an oN4C-chain coprocessor running inside a hardware enclave fetches the corresponding ciphertexts from a public data availability layer, decrypts and computes on plaintext within the enclave, re-encrypts, and commits attested, Merkle-anchored results back on chain. A key observation is that SolanarCOs account model and parallel (Sealevel) scheduler turn the transactionrCOs declared read/write set into the dependency graph of the confidential computation, yielding parallel, correctly-ordered execution of encrypted operations without a bespoke scheduler. To avoid the single-point-of-failure of an enclave holding a master decryption key, Encifher distributes trust across a threshold-decryption committee and verifies enclave attestation on chain. Encifher is deployed in production, powering confidential payments, swaps, and a cross-chain bridge. In production, a confidential swap settles in a single Solana transaction costing 157,000 compute units; the AES-256-GCM symmetric-encryption layer runs at over a million operations per second and threshold decryption completes in single-digit to tens of milliseconds (near-plaintext speed, against the many-orders-of-magnitude overhead of FHE), and Encifher has served over 5,000 users and 50,000 confidential operations. We are explicit about the cost of this design point: Encifher reduces the trust base to TEE integrity, honest threshold key management, and the cloud attestation root, rather
than to cryptographic hardness alone.
## 2026/1505
* Title: Conditional-Affine Redundant Clauses for SHA-256 Differential SAT
* Authors: Jiqiang Feng, Kun Gao
* [Permalink](https://eprint.iacr.org/2026/1505)
* [Download](https://eprint.iacr.org/2026/1505.pdf)
### Abstract
Standard Tseitin encodings of the SHA-256 nonlinear functions Ch and Maj can hide conditioned differential projections from Boolean Constraint Propagation (BCP). We materialize them as short, semantically redundant CNF clauses. A cofactor theorem characterizes all controlled differential linear forms; its implemented unit-vector specialization returns exactly all minimum-control projections, yielding four Ch and twelve Maj clauses per bit. The clauses preserve models, introduce no variables, and strictly strengthen BCP on an explicit gate fragment. We claim neither propagation completeness nor a general affine compiler.
We evaluate mechanism separately from performance and distinguish the production bundle from the proposed layer. Frozen studies show a fixed-formula bundle benefit, but the matched clause isolation fails its effect gate and an unrestricted control is inconclusive. We therefore show neither a solver-independent speedup nor a new cryptanalytic attack. The restricted weight-15 C15 census passes the CaDiCaL rule but not the Kissat rule. In the stratified C16 extension, the frozen decisions are too censored for CaDiCaL and too censored for Kissat; these solver-stratified labels are not pooled. A pinned three-solver replay validates larger-bundle execution but cannot attribute performance to the clauses. A variable-preserving probe exposes all 32 tested implications only after augmentation.
## 2026/1506
* Title: SM4th and uBlockith: VOLE-based Post-Quantum Signature Schemes from Chinese Block Ciphers
* Authors: Weihan Li, Yuchen Wang, Zhelei Zhou, Cheng Hong, Tao Wei
* [Permalink](https://eprint.iacr.org/2026/1506)
* [Download](https://eprint.iacr.org/2026/1506.pdf)
### Abstract
FAEST is a family of post-quantum signature schemes based on VOLE-in-the-Head, and is one of the nine candidates advanced to the third round of the NIST Additional Digital Signature process.
FAEST relies only on symmetric cryptographic primitives, including block ciphers and hash functions, and does not require structured number-theoretic assumptions.
We propose two families of signature schemes, SM4th and uBlockith, targeting 128-bit and 256-bit classical security, respectively.
SM4th and uBlockith follow the FAEST framework but instantiate it with Chinese-designed block ciphers, including SM4, uBlock, and Ballet.
We further design constraint systems tailored to these block ciphers and provide instruction-set-aware optimized implementations.
Our evaluation on two Intel platforms and a Hygon platform shows that the end-to-end performance of the proposed schemes is strongly platform dependent.
On an Intel platform with native SM4 support, the SM4th variants achieve performance comparable to the corresponding FAEST-128 variants, with a gap of less than $1\times$.
On the Hygon platform with native CIS-SM4 support, the SM4th variants are within approximately $3\times$ of FAEST-128.
The SM4th-EM-s (short) variant has a combined public-key and signature size of $3\,850$ bytes, compared with $3\,938$ bytes for FAEST-EM-128s.
The uBlockith variants remain approximately $3$--$4\times$ slower than FAEST-256.
These results demonstrate the feasibility and costs of instantiating VOLE-based signatures with the selected Chinese block ciphers.
## 2026/1507
* Title: Analyzing Cryptography in Context: A Cryptography-Native Approach to Threat Modeling
* Authors: Ran Canetti, Julie Ha, Gabriel Kaptchuk
* [Permalink](https://eprint.iacr.org/2026/1507)
* [Download](https://eprint.iacr.org/2026/1507.pdf)
### Abstract
We observe that the existing norms within cryptography do not expect protocol analysts to document the sociotechnical properties that a deployed system should have. To help close this potential gap, we develop a framework that allows bringing sociotechnical dimensions into analyses of cryptographic systems, and in particular facilitates "in-context" analysis of proposed cryptographic deployments on top of widely-accepted cryptographic modeling techniques. To explore the utility of our framework, we use Apple's 2021 CSAM scanning proposal as a case study. We show how our framework naturally surfaces many of the criticisms of Apple's proposal and helps us identify a previously undocumented property of the proposal.
## 2026/1508
* Title: ZKPoSP: Post-Quantum Zero-Knowledge Proofs for Hierarchical Deterministic Wallets
* Authors: Vincenzo Botta, Michal Pospieszalski, Emanuele Ragnoli, Justus Ranvier
* [Permalink](https://eprint.iacr.org/2026/1508)
* [Download](https://eprint.iacr.org/2026/1508.pdf)
### Abstract
Recent advances in quantum hardware, including Google's Willow processor, have substantially narrowed the timeline to cryptographically relevant quantum computers. In the blockchain setting, where addresses and key derivation standards such as BIP32, BIP44, and SLIP-10 are the dominant infrastructure for wallet management, a quantum computer running Shor's algorithm can recover any elliptic-curve private key from the corresponding public key, threatening every wallet in production today. Migrating to post-quantum signature schemes requires changing the public key format and forcing address migration across all participating networks, a significant problem for blockchain communities.
We present an orthogonal approach: keep the existing address format entirely unchanged and instead replace the classical signing step with a NIZK proof of knowledge of the seed underlying the existing address, where security against quantum adversaries reduces to the conjectured quantum hardness of the underlying hash functions and the soundness of the NIZK against quantum adversaries, requiring no address migration or key registration.
We build on the observation of Baldimtsi et al. that EdDSA's deterministic seed-to-key mapping makes the seed a valid zero-knowledge witness for the public key, and extend their single-level result to the full hierarchical deterministic wallet setting. Starting from BIP32-Ed25519, we replace the classical signing step with a NIZK proof certifying knowledge of the root seed and the full derivation chain, and prove EUF-CMA security for the resulting scheme; post-quantum security is conjectured to hold since all underlying primitives depend only on the hardness of hash functions and the soundness of the NIZK against quantum adversaries.
The existing schemes each derive their quantum-safe witness as an incidental artifact of a curve-specific key format, and none provides a single derivation standard that works uniformly across curves. We therefore introduce QBIP32, a new key derivation scheme based on a keyed function HASH768 (instantiated with KMAC256) that produces the signing scalar, an explicit quantum-safe witness, and the chain code in a single call. QBIP32 is defined for any elliptic curve group of prime order with a fixed generator, requiring no structural change to the derivation or proof system across curves: the same construction covers secp256k1, Ed25519, and any future curve used in blockchain infrastructure. This universality stands in contrast to the BIP32-Ed25519 approach, which relies on the Ed25519 extended key format and has no analogue for other curves.
We then address the efficiency problem: a monolithic proof of the full derivation chain has cost growing linearly with derivation depth. Our main contribution is ZKPoSP (Zero-Knowledge Proof of Seed Provenance), a signature scheme conjectured secure against quantum adversaries that splits the proof into a derivation proof generated once per key pair and a signing proof generated once per message, reducing per-message proving cost to a constant independent of derivation depth. We further characterise exactly when the derivation proof itself can be shortened to cover only the last step of the derivation rather than the full chain from the root seed, and identify the existence of a private value that is bound to the seed by a one-way function and not recoverable from the public key as the precise criterion. This criterion is met by hardened keys but not by non-hardened keys, a structural distinction common to all schemes: BIP32 secp256k1, SLIP-10/Ed25519, BIP32-Ed25519, and QBIP32 all admit a last-step derivation proof for hardened keys, while non-hardened keys require a proof reaching back to the last hardened ancestor. We exploit this for BIP44 paths to prove only one hardened step plus the non-hardened suffix in a single proof, enabling secure deletion of the root seed.
Before Q-day, separating the derivation and signing proofs already reduces per-transaction cost to a constant independent of derivation depth. After Q-day, once networks reject all non-post-quantum signatures, the leaf scalar can be moved to the public statement, removing all elliptic-curve scalar multiplications from the proof circuit and reducing derivation proving time substantially.
We implement all constructions in Rust using RISC Zero as the NIZK backend, instantiate HASH768 with KMAC256, and report benchmarks for monolithic proofs, ZKPoSP across full BIP44 paths, and the post-Q-day variant. Signing proving time is constant at approximately 12-13 seconds and verification time is constant at approximately 9-10 ms across all variants and depths.
## 2026/1509
* Title: Efficient Unclonable Encryption from Pauli Eigenstates
* Authors: Seyoon Ragavan
* [Permalink](https://eprint.iacr.org/2026/1509)
* [Download](https://eprint.iacr.org/2026/1509.pdf)
### Abstract
We give, to our knowledge, the first plain-model, one-time information-theoretically secure, efficient unclonable encryption scheme for one classical bit. Previous work by Bhattacharyya and Culf (Nature Physics, 2026) and Bhattacharyya, Broadbent, and Culf (arXiv:2603.08916) either only showed $1/\mathsf{poly}(\lambda)$ security loss or required inefficient encryption/decryption operations. We avoid both of these caveats; in doing so, we obtain (to our knowledge) the first plain-model construction of many-time secure $1 \to 2$ unclonable encryption for arbitrary polynomial-length messages, assuming the existence of pseudorandom function-like states (Bartusek and Goldin, arXiv:2605.27647).
The key is a uniformly random non-identity phase-free Pauli on $n$ qubits, and bit $a$ is encrypted as a random $(-1)^a$ eigenstate of that Pauli. Encryption and decryption use $O(n)$ single-qubit operations and $O(n)$ time classical computation; key generation uses only $O(n)$ time classical computation. The scheme is exponentially secure; we prove that the probability that both receivers recover the bit is at most $\frac{1}{2}+\frac{1}{2}\sqrt{{2^n}/({4^n-1})} = \frac{1}{2} + O\left(2^{-n/2}\right).$ By a lower bound due to Broadbent, Culf, and Rochette, this is the best probability bound achievable with $n$-qubit ciphertexts (up to the constant hidden in the $O(\cdot)$).
The main conceptual idea is to leverage, in a precise spectral sense, the balanced commutation-anticommutation structure of the Pauli group. The proof is intricate but completely elementary and makes use of standard spectral bound techniques. The main technical workhorse is a standalone linear-algebraic lemma which we present in its own section: informally, it relates the positivity of two different operators, each capturing the intuition that if the two receivers can individually decrypt unusually often then they must also disagree often.
GPT-5.6 Sol Ultra found this proof in an extended conversation with the author and drafted a preliminary version of this paper. The author is fully accountable for the correctness of this paper.
## 2026/1510
* Title: Quantum Lazy Sampling and Path Recording for Any Group
* Authors: Ben Foxman, Alex Lombardi, Fermi Ma, Barak Nehoran, John Wright
* [Permalink](https://eprint.iacr.org/2026/1510)
* [Download](https://eprint.iacr.org/2026/1510.pdf)
### Abstract
A central challenge in quantum algorithm analysis and cryptography is reasoning about algorithms with oracle access to a random group element (e.g. a random function, a random permutation, a random unitary). Can we efficiently simulate such algorithms? Can we determine what they know after $t$ queries? Classically, an important tool for this is lazy sampling, where the oracle does not commit to the full group element at the beginning, but rather samples partial information about it on the fly. We study a quantum analog of lazy sampling: compressed oracles (or recording oracles), which are quantum data structures that allow such on-the-fly simulation for quantum queries.
Compressed oracles were originally introduced by Zhandry (CRYPTO '19) for random functions, were generalized to random unitaries by Ma-Huang (STOC '25) and to permutations by Carolan (STOC '26), and have been employed to great effect in security proofs and query complexity lower bounds due to their interpretability.
In this work, we define and analyze a general-purpose and interpretable path-recording oracle, derived from first principles, that perfectly simulates random elements of any closed subgroup of $U(N)$.
Our path-recording oracle stores superpositions of $t$ input-output pairs $|(x_1, y_1), \dots, (x_t, y_t)\rangle$, which encode a Feynman path explored by the algorithm and thus transparently records the information that the algorithm may have learned from its queries. Our compressed oracle builds on a recent work of Grinko and Yoshida (QIP '26), who proposed a different kind of general-purpose compressed oracle without clear interpretability. Crucially for applications, we derive an operationally useful mathematical description of our update procedure in terms of the commutant of the group's tensor power representation.
One powerful feature of our path-recording oracle is that it enables direct comparisons between compressed oracles for different groups, which gives a new technique for proving pseudorandomness results. For our main application, we formally relate the $S_N$ and $U(N)$ compressed oracles, yielding what is arguably the simplest construction to date of pseudorandom unitaries: the product $PC$ of a pseudorandom permutation and a random Clifford. This improves on the prior $PFC$ construction of (Metger-Poremba-Sinha-Yuen, FOCS '24; Ma-Huang, STOC '25).
## 2026/1511
* Title: Unconditional Unclonable Encryption
* Authors: Prabhanjan Ananth, Amit Sahai
* [Permalink](https://eprint.iacr.org/2026/1511)
* [Download](https://eprint.iacr.org/2026/1511.pdf)
### Abstract
We give an unconditional construction of information-theoretically secure one-time private-key unclonable encryption scheme for one-bit messages, with efficient encryption and decryption and exponentially small unclonable-indistinguishability advantage.
--- Synchronet 3.22a-Linux NewsLink 1.2