From Newsgroup: sci.crypt

## In this issue
1. [2025/1220] RoK and Roll rCo Verifier-Efficient Random Projection ...
2. [2025/1605] Refined Humbert Invariants in Supersingular Isogeny ...
3. [2026/198] ELLMo: Packing- and Depth-Aware Encrypted ...
4. [2026/218] Isochronous Fixed-Weight Sampling in Hardware
5. [2026/289] Zero-Knowledge Proof-Carrying Data from ...
6. [2026/362] Janus-FHE: Reducing Microarchitectural Leakage in ...
7. [2026/363] LazyArc: Dynamic Out-of-Order Engine for High- ...
8. [2026/916] Cryptanalysis of the Subfield Bilinear Collision ...
9. [2026/985] A New Insight into Constructing Cryptographic ...
10. [2026/1183] Validity in Responsive Byzantine Agreement
11. [2026/1207] "Sticking their heads out above the parapets": ...
12. [2026/1512] The McEliece Cryptosystem After Nearly Five ...
13. [2026/1513] STEBR: A Timed-Erasure, Threshold-Gated Backup Ratchet
14. [2026/1514] Distributed Vector Commitments and Their Applications
15. [2026/1515] Exponentially Fewer-Server PIR from Sparser ...
16. [2026/1516] Complex-Multiplication Terminals for Supersingular ...
17. [2026/1517] ConvertInput-Free Vector Homomorphic Secret Sharing ...
18. [2026/1518] Practical Equivalent-Key Recovery in GRAFHEN
19. [2026/1519] Classic Full Plaintext Recovery Attacks on Low ...
20. [2026/1520] Quintus: Two-round Good-case Information Theoretic ...
21. [2026/1521] Beyond Blockchain Ballots: UC-Secure Layer-2 Voting ...
22. [2026/1522] Efficient Ternary Computation of Optimal Ate ...
23. [2026/1523] Catching Many Traitors in Threshold Traitor ...
24. [2026/1524] A Note on Single-Server QPIR from One-Way Functions
25. [2026/1525] NAIBI: Binding Reconciliation KEMs and Ephemeral ...
26. [2026/1526] On the Suitability of Syndrome Decoding for Proof- ...
27. [2026/1527] Shuffling is Not Enough: Breaking Permutation-Based ...
28. [2026/1528] Revisiting Automated Quantum Periodic Distinguisher ...
29. [2026/1529] Generalized Wiener-Type Attacks on Two RSA-Like ...
30. [2026/1530] Rich Input Representations in Neural Differential ...
31. [2026/1531] Toward a Secure Fixed-Point Implementation of the ...
32. [2026/1532] Just-in-Time-OPRFs and a Modular Framework for Fast ...
33. [2026/1533] Correcting the modulus switch error in TFHE ...
34. [2026/1534] Masking, Sequences, and FALCON: A Theoretical Study ...
35. [2026/1535] ViNET: Connecting the Unconnected using Video over LTE
36. [2026/1536] Privacy-Preserving Identity Management and Software ...
37. [2026/1537] UM-PSO: A Unified Multi-Party Framework for Private ...
38. [2026/1538] An Attack on High Rate McEliece Cryptosystems Using ...
39. [2026/1539] Falcon Verify on AVX-512: Speed Records
## 2025/1220
* Title: RoK and Roll rCo Verifier-Efficient Random Projection for $\tilde{O}(\lambda)$-size Lattice Arguments
* Authors: Michael Kloo|f, Russell W. F. Lai, Ngoc Khanh Nguyen, Micha+e Osadnik
* [Permalink](https://eprint.iacr.org/2025/1220)
* [Download](https://eprint.iacr.org/2025/1220.pdf)
### Abstract
Succinct non-interactive arguments of knowledge (SNARKs) based on lattice assumptions offer a promising post-quantum alternative to pairing-based systems, but have until now suffered from inherently quadratic proof sizes in the security parameter. We introduce RoK and Roll, the first lattice-based SNARK that breaks the quadratic barrier, achieving communication complexity of $\tilde{O}(\lambda)$ together with a succinct verification time. The protocol significantly improves upon the state of the art of fully-succinct argument systems established by ``RoK, Paper, SISsors'' (RPS) [ASIACRYPT'24] and hinges on two key innovations, presented as reductions of knowledge (RoKs):
- Structured random projections: We introduce a new technique for structured random projections that allows us to reduce the witness dimensions while approximately preserving its $\ell_2$ norm and maintaining the desired tensor structure. In order to maintain succinct communication and verification, the projected image is further committed and adjoined to the original relation. This procedure is recursively repeated until dimension of the intermediate witness becomes $\mathsf{poly}(\lambda)$, i.e. independent of the original witness length.
- Unstructured random projection: When the witness is sufficiently small, we let the unstructured projection (over coefficients $\mathbb{Z}_q$) be sent in plain, as in LaBRADOR [CRYPTO'23]. We observe, however, that the strategy from prior works to immediately lift the projection claim to $\mathcal{R}_q$, and into our relation, would impose a quadratic communication cost. Instead, we gradually batch-and-lift the projection a the tower of intermediate ring extensions. This reduces the communication cost to $\tilde{O}(\lambda)$ while maintaining a succinct verification time.
These two techniques, combined with existing RoKs from RPS, yield a succinct argument system with communication complexity $\tilde{O}(\lambda)$ and succinct verification for structured linear relations.
## 2025/1605
* Title: Refined Humbert Invariants in Supersingular Isogeny Degree Analysis
* Authors: Eda K-#r-#ml-#, Gaurish Korpal
* [Permalink](https://eprint.iacr.org/2025/1605)
* [Download](https://eprint.iacr.org/2025/1605.pdf)
### Abstract
We focus on refined Humbert invariants of principally polarized superspecial abelian surfaces, introduced by Kani in 1994. The main contributions are to enumerate principal polarizations on a superspecial surface, and for each polarization, to compute the refined Humbert invariant of a principally polarized superspecial abelian surface. Then, we present several applications of computing this invariant for isogeny-based cryptography. First, we provide a decision algorithm to check if two given polarizations are isomorphic. Second, we present an efficient algorithm to determine the geometric type of a principally polarized superspecial surface. Third, we prove an upper bound on the largest minimal isogeny degree among pairs of supersingular elliptic curves, independent of their endomorphism-ring structures, and our experimental evidence verifies this claim up to $p=659$, $p\equiv 11\pmod{12}$. Fourth, we present experimental evidence for a minimum isogeny frequency within the proven upper bounds. Lastly, we provide a different perspective on the fixed isogeny degree problem using refined Humbert invariants and analyze it without explicit endomorphism rings.
## 2026/198
* Title: ELLMo: Packing- and Depth-Aware Encrypted Transformer Inference
* Authors: Seyda Nur Guzelhan, Lohit Daksha, Carlos Agull|| Domingo, Gilbert Jonatan, John Kim, Jose L. Abellan, David Kaeli, Ajay Joshi
* [Permalink](https://eprint.iacr.org/2026/198)
* [Download](https://eprint.iacr.org/2026/198.pdf)
### Abstract
Cloud-based Large Language Model (LLM) inference processes sensitive user inputs, yet current deployments offer limited confidentiality guarantees. Fully Homomorphic Encryption (FHE) can provide strong privacy, but it clashes with transformer architectures, where rigid ciphertext packing demands expensive rotations, and deep polynomial circuits for nonlinearities necessitate costly bootstrapping. Although recent work has reported promising speed-ups, maintaining model accuracy is a challenge. We address these issues with ELLMo, a packing- and depth-aware encrypted transformer design. ELLMo introduces a novel matrix multiplication algorithm to reduce the ciphertext rotations. Further, head-split and merge steps are fused into this new algorithm at no additional cost. To reduce the depth of nonlinear layers, our contributions, Statistical-max Softmax and DelayNorm, help bypass deep comparison trees and homomorphic divisions to reduce bootstrapping by up to 46%. On encrypted BERT-Tiny, ELLMo achieves a $1.4\times$ speedup over state-of-the-art baselines with 0-1.5% accuracy loss across SST-2, MRPC, and RTE downstream tasks.
## 2026/218
* Title: Isochronous Fixed-Weight Sampling in Hardware
* Authors: Adrian Marotzke
* [Permalink](https://eprint.iacr.org/2026/218)
* [Download](https://eprint.iacr.org/2026/218.pdf)
### Abstract
We present hardware implementations of the recently proposed isochronous fixed-weight sampling algorithm by D|-cio Luiz Gazzoni Filho, Tom|is S. R. Silva, Julio L||pez
(CiC vol. 1, 2024) and apply them to the post-quantum cryptographic algorithms NTRU-HPS, Streamlined NTRU Prime and Classic McEliece. We offer multiple implementations, optimized for different targets: A high-area high-performance implementation, a lightweight low-area implementation, as well as a side-channel secure implementation using gadget-based masking. We verify the security of our masked implementation using the PROLEAD leakage detection tool. We show that the sampling algorithm results in highly efficient and effective implementations for the NTRU-like schemes, outperforming existing hardware implementations for fixed-weight sampling.
## 2026/289
* Title: Zero-Knowledge Proof-Carrying Data from Accumulation Schemes
* Authors: Tianyu Zheng, Shang Gao, Xun Liu
* [Permalink](https://eprint.iacr.org/2026/289)
* [Download](https://eprint.iacr.org/2026/289.pdf)
### Abstract
Proof-carrying data (PCD) is a powerful cryptographic primitive for ensuring computational integrity in distributed settings. State-of-the-art PCD constructions based on accumulation schemes achieve practical prover efficiency and support a wide range of applications. However, realizing zero-knowledge for accumulation-based PCD remains challenging, particularly for high-degree relations. Existing solutions often incur substantial overhead due to the need for zero-knowledge in both the underlying non-interactive arguments of knowledge (NARKs) and accumulation schemes. In this work, we present new theoretical and practical improvements for zero-knowledge PCD. First, we propose a novel construction that eliminates the need for zero-knowledge NARKs by separating the compliance predicate and accumulation verification, thereby reducing proof size and improving efficiency. Second, we design an efficient zero-knowledge accumulation scheme for special sound protocols, introducing techniques such as masking vectors and zero-knowledge sum-check protocols to ensure privacy with minimal overhead. The theoretical analysis demonstrates that our construction achieves logarithmic proof size and verification time for d-degree NP relations, and outperforms existing solutions in both asymptotic and concrete complexity.
## 2026/362
* Title: Janus-FHE: Reducing Microarchitectural Leakage in GPU-Based Homomorphic Encryption
* Authors: Kashfia Farheen, Nektarios Georgios Tsoutsos
* [Permalink](https://eprint.iacr.org/2026/362)
* [Download](https://eprint.iacr.org/2026/362.pdf)
### Abstract
Homomorphic Encryption (HE) enables secure cloud computing through computations on encrypted data, but the physical execution of HE workloads on shared GPUs can still expose relevant metadata through microarchitectural behavior. Implementation-level irregularities in key switching, rounding, and modular correction may create observable hardware footprints even when cryptographic confidentiality remains intact. We present a case study of BFV relinearization in a state-of-the-art GPU HE library HEonGPU showing that certain execution patterns exhibit structured, reproducible variation in shared-cache footprint tied to a specific implementation mechanism, creating a setup-specific fingerprinting surface for a co-resident observer. We measure this signal using a controlled diagnostic profiling instrument.
Motivated by this finding, we present JANUS-FHE, a GPU framework for BFV multiplication and relinearization designed around execution regularity as a first-class objective. JANUS reformulates ciphertext multiplication through Kronecker substitution and structured large-integer arithmetic, executed using a Schonhage-Strassen-style pipeline based on the Discrete Galois Transform (DGT); a Stockham formulation regularizes memory access across transform stages, and relinearization is expressed through fixed execution geometry and branchless masked arithmetic, eliminating the class of value-dependent control flow identified in the case study. We evaluate JANUS under the identical shared-cache methodology used to characterize the HEonGPU leak: key-conditioned differences that reproduce consistently across independent measurements for HEonGPU do not reproduce for JANUS, and JANUS' masked arithmetic is confirmed branchless at the compiled-instruction level. JANUS is a mitigation-oriented BFV multiplication-relinearization framework and a first step toward secure GPU-based FHE design, reducing leakage-relevant execution variability in shared-GPU environments while remaining practical across large parameter sizes.
## 2026/363
* Title: LazyArc: Dynamic Out-of-Order Engine for High-Throughput FHE
* Authors: Omar Ahmed, Nektarios Georgios Tsoutsos
* [Permalink](https://eprint.iacr.org/2026/363)
* [Download](https://eprint.iacr.org/2026/363.pdf)
### Abstract
Fully Homomorphic Encryption (FHE) is a modern cryptographic technique that allows performing computations directly on encrypted data. This makes FHE an indispensable method for privacy-preserving applications, where users' data are encrypted and processed by a potentially untrusted third party. Nevertheless, FHE operations are computationally expensive, often rendering them impractical for realistic scenarios. Notably, a major performance bottleneck for FHE is an operation called bootstrapping that allows refreshing the inherent noise of FHE data to support more computations. In this work, we introduce LazyArc, a versatile lightweight dynamic Out-of-Order (OoO) engine that supports higher-throughput FHE computations. Our proposed OoO paradigm improves the performance by masking the latency of bootstrapping via a bespoke instruction-bootstrapping scheduling paradigm. Also, we introduce a novel tool, dubbed RegisterMap Tool, to statically analyze FHE arithmetic circuits and track the noise of each ciphertext to allow proactive bootstrapping scheduling. Our approach is evaluated using linear algebra benchmarks and achieves about 1.20$\times$ speedup compared to in-order baselines, up to about 1.73$\times$ speedup compared to the FHEBooster scheduler, and about 8.74$\times$ compared to the PulpFHE architecture.
## 2026/916
* Title: Cryptanalysis of the Subfield Bilinear Collision Problem
* Authors: Pierre Briaud, Romaric Neveu
* [Permalink](https://eprint.iacr.org/2026/916)
* [Download](https://eprint.iacr.org/2026/916.pdf)
### Abstract
The security of a recent MPC-in-the-Head signature scheme introduced at Crypto 2024 by Huth and Joux required the introduction of a new ad hoc hardness assumption called the Subfield Bilinear Collision (SBC) problem. By relying on the VOLE-in-the-Head framework, the authors further improved the performance of this scheme at Asiacrypt 2025, resulting in a very compact construction.
In this paper, we improve the original cryptanalysis of SBC in several ways. First, we describe a link between the SBC problem and the decoding problem in the rank metric for codes linear over an extension field $\mathbb{F}_{q^m}$, strengthening its theoretical hardness and expanding the range of attacks on the SBC problem. Second, we analyze Gr||bner basis algorithms applied to the bilinear modeling of SBC proposed by Huth and Joux and formulate conjectures on the behavior of this system. Finally, we describe another algebraic modeling of SBC obtained by using the Pl|+cker relations between the maximal minors of a matrix. While we do not threaten the parameters of the proposed signature schemes relying on SBC, our work opens the door to a more accurate analysis. In particular, we were not able to analyze the inclusion of the field equations of $\mathbb{F}_{q}$ in the Gr||bner basis algorithm, which is especially relevant since $q=2$ in these parameters. We leave this task for future work.
## 2026/985
* Title: A New Insight into Constructing Cryptographic Boolean Functions via Walsh Spectral Analysis
* Authors: Shaozheng He, Jiongjiong Ren, Shaozhen Chen, Jiaxin Yan, Jianhua Hou * [Permalink](https://eprint.iacr.org/2026/985)
* [Download](https://eprint.iacr.org/2026/985.pdf)
### Abstract
Given that the Walsh spectrum directly determines key cryptographic properties of Boolean functions, the construction of such functions with desired spectral features has been a major research focus for decades. In this study, we first establish a unified framework for a class of specific Boolean function construction problems corresponding to Walsh transform, which we formally define as \textbf{Problem}. To tackle the \textbf{Problem}, we first designed the Iterative Walsh Recovery (IWR) algorithm as a framework, then added Forgetting and Greedy strategies for heuristic optimization to obtain the FG-IWR algorithm, and finally proved a necessary condition for optimization, ultimately proposing the Optimized Iterative Walsh Recovery (OIWR) algorithm. Through rigorous theoretical analysis and experimental validation, our algorithm simultaneously achieves theoretical guarantees, design flexibility, and computational efficiency. For application, we further present a novel construction method for low-weight correlation immune functions using the OIWR algorithm. Experimental results show that our method successfully addresses two fundamental constraints of Mesnager-Su's approach: limited construction capacity and power-of-two weight restrictions.
## 2026/1183
* Title: Validity in Responsive Byzantine Agreement
* Authors: Diana Ghinea, Simon Holmgaard Kamp, Chen-Da Liu-Zhang
* [Permalink](https://eprint.iacr.org/2026/1183)
* [Download](https://eprint.iacr.org/2026/1183.pdf)
### Abstract
Byzantine Agreement (BA) protocols must ensure not only agreement and termination, but also validity: the value agreed upon should meaningfully reflect the honest parties' inputs. The choice of validity condition can change the exact resilience threshold at which BA is solvable. Tight characterizations for BA with general validity conditions are known in the partially synchronous model (PODC'23), in the synchronous model (PODC'24), and in the network-agnostic model (DISC'25).
We focus on general validity for synchronous BA with responsive termination. Such protocols remain secure against up to $t_s$ byzantine corruptions, but incur a running time that depends on the actual network delay $\delta$, rather than the conservative delay bound $\Delta \gg \delta$, whenever at most $t_r \leq t_s$ parties are corrupted.
We present a tight characterization of the validity properties solvable in this setting. We prove that every non-trivial validity property requires $n>2 t_r+t_s$ in authenticated settings, where a public-key infrastructure and digital signatures are available, and $n>3 t_s$ in unauthenticated settings. These threshold conditions are accompanied by a validity-dependent requirement, the responsive similarity condition: roughly, for any concrete configuration of honest inputs, there is a value that is valid for any view that a protocol could obtain from this initial configuration. We then present matching protocols in both settings, showing that these conditions are sufficient.
The main technical contribution is an authenticated responsive Core-Set Agreement protocol requiring $n>2 t_r+t_s$. This threshold may place the protocol in an honest-minority regime, where prior constructions for general validity do not apply and where standard Synchronous Broadcast is not responsive.
Finally, we instantiate the characterization for several standard validity notions -- weak validity, strong unanimity, convex validity, and honest-input validity.
## 2026/1207
* Title: "Sticking their heads out above the parapets": Lived Experiences of Legal Risks in Research (Extended)
* Authors: Sunoo Park, Daniel R. Thomas
* [Permalink](https://eprint.iacr.org/2026/1207)
* [Download](https://eprint.iacr.org/2026/1207.pdf)
### Abstract
Overbroad computer crime, intellectual property, and other laws are well known to create legal risks that can discourage essential research. Notable examples include the US Computer Fraud and Abuse Act and the UK Computer Misuse Act. Because such laws fail to distinguish malicious hacking from good-faith testing and research, researchers face serious legal risks for public-interest research activity like identifying software or hardware vulnerabilities or scraping data. Despite the research community's broad awareness of these risks, our understanding of their practical impacts is limited, as most of the community's knowledge comes from anecdotal evidence rather than systematic study.
We conduct the first qualitative study focused on researchers' lived experiences, to empirically document the *impacts of legal risks and threats* on research and researchers*, and *how researchers navigate legal risk situations*. Our study engages two participant groups: researchers with legal-risk experiences in the UK or the US ($N_R=36$), who discuss 130 projects and incidents spanning over three decades, and professionals that offer support to researchers navigating legal risks ($N_S=8$), who have collectively supported thousands of researchers. We thus provide an unprecedented big-picture view of researchers' experiences with legal risks. We synthesise actionable strategies for researchers, and our findings provide evidence to support policy reform.
## 2026/1512
* Title: The McEliece Cryptosystem After Nearly Five Decades: A Survey of Security, Cryptanalysis, and Future Directions
* Authors: Shabnam Jafarzade Mojaveri, Adel Khosravi
* [Permalink](https://eprint.iacr.org/2026/1512)
* [Download](https://eprint.iacr.org/2026/1512.pdf)
### Abstract
Almost fifty years after its introduction, the McEliece cryptosystem occupies an unusual place in the post-quantum landscape. Its public keys are far larger than those of most competing schemes, its original parameters no longer provide adequate security, and several compact variants proposed to reduce key size have subsequently been broken. Nevertheless, the binary Goppa-code foundation retained in Classic McEliece continues to resist known practical attacks for the selected Classic McEliece parameter sets.
This survey asks why McEliece has remained relevant despite these limitations. We trace its development from the original 1978 encryption scheme to the modern Classic McEliece key-encapsulation mechanism and organize nearly five decades of cryptanalysis into generic decoding, structural recovery, attacks on compact variants, protocol-level attacks, implementation leakage, and quantum speedups. We emphasize several distinctions that are often blurred in discussions of the scheme: breaking an obsolete parameter set is not the same as recovering the hidden Goppa structure; distinguishing a public code does not necessarily lead to practical key recovery; and compromising a modified or structured variant does not automatically compromise Classic McEliece.
This history does not support either of two simple narratives: that McEliece has remained unchanged or that it has simply been broken. Its longevity reflects a conservative mathematical foundation that has survived repeated reassessment, together with parameters, security models, and implementations that have evolved in response to new attacks. We close by outlining the main questions that will shape its future: whether public-key and key-distribution costs can be reduced without exposing exploitable structure, how far modern algebraic cryptanalysis can be extended, how classical and quantum security estimates should be refined, and how secure implementations can be integrated into practical systems.
## 2026/1513
* Title: STEBR: A Timed-Erasure, Threshold-Gated Backup Ratchet
* Authors: Shaurya Pratap Singh
* [Permalink](https://eprint.iacr.org/2026/1513)
* [Download](https://eprint.iacr.org/2026/1513.pdf)
### Abstract
The Signal ProtocolrCOs Double Ratchet and X3DH/PQXDH handshakes give in-transit messages forward secrecy and post-compromise security: compromising a session key does not expose past traffic, and the protocol self-heals after a fresh DiffierCoHellman step. Encrypted backups, by contrast, are commonly protected by a single static secret, a rCLBackup Recovery KeyrCY generated once and held constant until manually rotated. We show, with an explicit attack, that this baseline design provably fails even a minimal forward-secrecy-style security notion: disclosure of the key at any time exposes the entire backup history, with no self-healing. This is not a hypothetical concern: a June 26, 2026 joint FBI/CISA advisory attributes exactly this exploitation pattern to two Russian intelligence-linked clusters, tracked as UNC5792 and UNC4221, who obtained victimsrCO Backup Recovery Keys through impersonation-based social engineering rather than cryptanalysis. We propose STEBR (Secure Timed-Erasure Backup Ratchet), a backup-key architecture built from three composable layers: (1) a self-erasing hashchain key ratchet so that compromise of the current backup key exposes only a bounded, recent window of history rather than the full archive; (2) (t, n) threshold secret sharing of the current epoch key across independently held devices/guardians so that no single credential extracted in one social engineering interaction is sufficient; and (3) an interactive, rate-limited, out-of-band confirmation gate on any restore request so that possession of valid recovery material is necessary but not sufficient to complete a restore. We give formal security definitions for each property and prove them via standard reductions (PRF security of the key-derivation function, IND-CPA security of the backup AEAD scheme, the information-theoretic secrecy of Shamir sharing, and the authenticity of the existing ratchet-protected control channel). All three layers are composed on top of existing Signal Protocol primitives; none require modifying the Double Ratchet, X3DH/PQXDH, or the wire format of message envelopes. This is a proposal for hardening the backup-key management layer specifically; we make no claim that the Signal ProtocolrCOs transport-layer cryptography is broken or requires replacement the cited advisory itself states plainly that it is not.
## 2026/1514
* Title: Distributed Vector Commitments and Their Applications
* Authors: Rui Gao, Huaqun Wang, Zhiguo Wan, Yuncong Hu
* [Permalink](https://eprint.iacr.org/2026/1514)
* [Download](https://eprint.iacr.org/2026/1514.pdf)
### Abstract
Vector commitment (VC) schemes enable a prover to commit to a vector and later open any position with a short proof. However, existing VC schemes are designed for centralized settings, and cannot work in decentralized systems, where the input vector is distributed across multiple machines. Similarly, traditional VC schemes cannot leverage distributed parallel computation across multiple machines for acceleration.
To tackle this issue, we introduce a new notionrCodistributed VC (DVC), which allows multiple machines, each holding only a subvector of the input vector, to collectively commit to the entire vector and generate position proofs in a distributed manner. To the best of our knowledge, there is no prior work on DVCs and no existing work can trivially derive an efficient DVC scheme. The key challenge is that both commitments and proofs depend on the entire vector, while no single machine holds the complete vector in distributed settings.
We propose the first DVC scheme, HLE-DVC, which leverages $M$ machines to process the distributed vector $\mathbf{v}$ of length $N$ in parallel, with each machine holding a subvector of length $\frac{N}{M}$. HLE-DVC achieves compact proof size-$\text{O}(\log M)$ and allows each machine to generate all its position proofs in a single communication round, with communication cost $\text{O}(\log M)$ and computation cost $\text{O}(\frac{N \log N}{M})$. Moreover, HLE-DVC supports batch proving, proof aggregation, and efficient updates. We conduct the experiments and open-source the code. Using 256 machines to generate all proofs for a committed vector of length $2^{30}$ takes 17,515 seconds. This achieves a $256\times$ parallel speedup over HLE-DVC on a single machine, and is $142\times$ faster than Hyperproofs (a famous single machine VC scheme). The communication cost per machine is 0.768 KB.
## 2026/1515
* Title: Exponentially Fewer-Server PIR from Sparser $S$-Decoding Polynomials
* Authors: Aparna Gupte, Seyoon Ragavan
* [Permalink](https://eprint.iacr.org/2026/1515)
* [Download](https://eprint.iacr.org/2026/1515.pdf)
### Abstract
We show that under a plausible number-theoretic conjecture, for any constant $s$ there exists an $s$-server private information retrieval (PIR) protocol that on an $n$-bit database requires communication $\exp(O((\log n)^{1/s} (\log \log n)^{1-1/s}))$. Previous constructions attaining the same communication required $2^{O(s)}$ servers. Our number-theoretic conjecture is implied by existing conjectures, namely the generalized repunit conjecture and Schinzel's hypothesis H (either one of these conjectures would suffice alone).

Our result builds on the ``matching vector family + $S$-decoding polynomials'' framework pioneered by Efremenko (STOC 2009) and recently refined by Ghasemi, Kopparty, and Sudan (STOC 2025). The main ingredient is a framework for constructing $S$-decoding polynomials with only $k+1$ nonzero coefficients modulo special products of $k$ primes, resolving an open problem posed by Ghasemi and Kopparty (ITCS 2026). By the lower bound shown by Ghasemi and Kopparty, this is the minimum achievable sparsity. We also empirically validate our construction and make our result unconditional for all $s \leq 15$.

We also apply our techniques to regimes where $s$ grows with $n$, showing under a stronger variant of our number-theoretic conjecture that the communication complexity of $s$-server matching-vector PIR can be superpolynomially reduced from the previous state of the art for any $s \leq \exp(o(\sqrt{\log \log n/\log \log \log n}))$.

The main result for $s = O(1)$ and its proof were discovered in a GPT-5.5 Pro conversation prompted by the authors.
## 2026/1516
* Title: Complex-Multiplication Terminals for Supersingular Isogeny Path-Finding
* Authors: Zheng Tao, Zhi Hu, Yijing Zhang, Changan Zhao
* [Permalink](https://eprint.iacr.org/2026/1516)
* [Download](https://eprint.iacr.org/2026/1516.pdf)
### Abstract
We propose a complementary stopping strategy based on complex multiplication (CM) for the subfield-search stage of supersingular isogeny path-finding, a bottleneck in the Delfs-Galbraith/SuperSolver algorithm. The original search performs a non-backtracking walk in the supersingular \(2\)-isogeny graph until it reaches the subfield terminal set \(S_p\). Our idea is to enlarge the set of recognizable terminals, by adding a precomputed set of CM supersingular vertices. For a discriminant bound \(M\), we construct \(S_{\mathrm{CM}}(M)\) from roots of Hilbert class polynomials \(H_D(X)\) over \(\mathbb F_{p^2}\), where \(D\) ranges over inert negative fundamental discriminants with \(|D|<M\). The walk then stops upon reaching \(S_p\cup S_{\mathrm{CM}}(M)\). The only additional per-visit cost is an expected \(O(1)\) hash-table membership query in the precomputed CM terminal table. We estimate the size and preprocessing cost of \(S_{\mathrm{CM}}(M)\), obtaining the heuristic growth \(|S_{\mathrm{CM}}(M)|=\Theta(M^{3/2})\), and show that the overlap \(S_{\mathrm{CM}}(M)\cap S_p\) is lower order. We also give terminal-connection procedures showing how searches that stop at CM vertices can be converted into full isogeny paths under the standard quaternionic and KLPT heuristics. The method does not change the asymptotic exponent of the underlying Delfs-Galbraith search; instead, it provides a complementary technique for existing subfield-search methods by adding efficiently recognizable CM terminals. Experiments on small parameters show that enlarging the terminal union reduces both visited vertices and field multiplications, while lookup benchmarks at SQIsign parameters confirm that the additional table membership test has stable and moderate per-visit overhead.
## 2026/1517
* Title: ConvertInput-Free Vector Homomorphic Secret Sharing and Its Applications
* Authors: Fan Yang, Fucai Luo, Xingfu Yan, Haining Yang, Zheng Gong, Wing W. Y. Ng
* [Permalink](https://eprint.iacr.org/2026/1517)
* [Download](https://eprint.iacr.org/2026/1517.pdf)
### Abstract
This work presents ConvertInput-Free Vector Homomorphic Secret Sharing (Vector-HSS), a novel HSS primitive based on the Decisional Composite Residuosity (DCR) assumption. Our construction enables efficient high-dimensional vector computations while avoiding the costly $\texttt{ConvertInput}$ operation. As a unified framework, Vector-HSS can be used as a building block for Private Information Retrieval (PIR), Secure Multi-Party Computation (MPC), Privacy-Preserving Machine Learning (PPML), etc.
The key idea behind Vector-HSS is to introduce a vector-centric computation paradigm. Unlike traditional approaches, this design allows the server to perform natural and efficient vector computations without the $\texttt{ConvertInput}$ operation while keeping client-side overhead comparable to that of state-of-the-art solutions. To further improve efficiency, we develop a batching mechanism based on the Chinese Remainder Theorem (CRT) that enables parallel computation across multiple vectors. Building on these techniques, we further design a suite of protocol modules to securely support Euclidean/cosine distance computation, comparison, and matrix-vector multiplication in practical applications. Experiments show that our scheme achieves $280\times$ and $70\times$ speedups over prior HSS schemes (EUROCRYPT 2021 and S&P 2026, respectively) for batched inner product evaluation. When applied to privacy-preserving image retrieval, our method achieves sub-second retrieval time, outperforming state-of-the-art solutions under similar security requirements.
## 2026/1518
* Title: Practical Equivalent-Key Recovery in GRAFHEN
* Authors: Remi Geraud-Stewart
* [Permalink](https://eprint.iacr.org/2026/1518)
* [Download](https://eprint.iacr.org/2026/1518.pdf)
### Abstract
GRAFHEN is a group-based homomorphic-encryption proposal whose public key is a rewriting system and whose secret key is a permutation representation. We present Maverick, an equivalent-key recovery attack. Maverick breaks
every released GRAFHEN challenge, including the recommended two-copy
$S_{11}$ instance: it reconstructs an equivalent key from public rules and correctly decrypts all $20{,}000$ supplied labelled ciphertexts. On $12$ independently generated recommended-parameter keys, the median end-to-end
time is $552$ s and the median peak memory use is $11.28$ GB on an Apple M3 Pro.
The attack converts selected public rewrite rules into group relators, reconstructs a regular action by Todd-Coxeter enumeration, recognizes the resulting permutation representations, and aligns the two sides through the public mixed relations. Public labelled encryptions then calibrate an equivalent decryptor. We prove a proof-carrying version of this procedure:
a target-order table with a replayable trace certifies the recovered regular action. The reported $S_{11}$ experiments use target-order closure checks, complete-corpus verification, and decryptor validation. We also give an output-sensitive analysis and state the hypotheses needed to extrapolate
beyond the measured instances.
Following an independent key-recovery attack, GRAFHEN proposed in July 2026
to replace $S_{11}$ by $\mathrm{PSL}_2(343)$. We adapt Maverick to this setting and demonstrate complete public-rule recovery, alignment, certification, and calibration on generated $\mathrm{PSL}_2(169)$ instances. The two-side $q=169$ run decrypts all $5{,}000$ held-out ciphertexts in a $103$~s critical path using $0.93$ GiB peak memory; a $k=2$ admissibility-filtered corpus also succeeds. Under GRAFHEN's stated
worst-case estimate for Dumezy's degree-based search, this degree $170$,
$d=5$ setting already has cost $O(2^{850})$, well beyond the intended reach
of that attack. At the target group, the
post-enumeration recovery path from a generated regular action takes $35.0$ s and $1.92$ GiB peak memory. These results suggest that the proposed platform-group change is insufficient to rule out Maverick; recovery from an admissibility-filtered corpus at $q=343$ remains to be measured because the pre-filter KeyGen enumeration exceeded $32$ GiB of memory before it could produce a corpus.
## 2026/1519
* Title: Classic Full Plaintext Recovery Attacks on Low Round Generalized Feistel Networks
* Authors: Yubing Zhu, Jianhong Shi, Yunteng Yang, Yonghui Yang
* [Permalink](https://eprint.iacr.org/2026/1519)
* [Download](https://eprint.iacr.org/2026/1519.pdf)
### Abstract
The Generalized Feistel Network (GFN) underpins widely standardized block ciphers, yet its resistance to full plaintext recovery remains largely unexplored. This paper extends the full-plaintext attack framework for standard Feistel ciphers to multi-branch scenarios, mainly makes the following $3$ research contributions:
(1) Developed classic full plaintext recovery attacks on $d$-round Type-I GFN ($d\ge 3$) under CPA with $d+1$ encryption queries and $2d$-round Type-I GFN under CCA with $d$ decryption queries. Query complexity depends on d, increasing branches can enhance anti-interference capability.
(2) Developed classic full plaintext recovery attack on 2-round Type-II GFN ($d\ge 4$) under CPA with $3$ encryption queries and 3-round Type-II GFN under CCA with $1$ encryption plus $2$ decryption queries. Query complexity is independent of $d$, increasing branches does not improve resistance.
(3) Finded that all attacks treat round functions as black boxes, confirming that the weakness resides in the GFN topology rather than specific round-function designs. Strengthening S-boxes or diffusion matrices cannot mitigate it, only increasing rounds beyond the security threshold provides effective defense.
## 2026/1520
* Title: Quintus: Two-round Good-case Information Theoretic BFT for $n=5f+1$
* Authors: Chenyang Liu, Dahlia Malkhi, Kartik Nayak, Nibesh Shrestha
* [Permalink](https://eprint.iacr.org/2026/1520)
* [Download](https://eprint.iacr.org/2026/1520.pdf)
### Abstract
We present, Quintus, information-theoretic BFT protocols for tolerating $f < n/5$ Byzantine faults among $n$ parties. We present two protocols:

(1) The first protocol, Quintus-Fixed, is in a fixed view regime where views advance at a cadence $3\Delta$ time. This protocol incurs a good-case latency of $2\delta$ time where $\delta$ indicates actual network delay and message complexity of $O(n^3)$ in a view. % In optimistic cases with good leaders, it incurs $O(n^2)$ message complexity.
(2) The second protocol, Quintus-Responsive, is an optimistically responsive protocol with good-case latency of $2\delta$ time, $O(n^2)$ message complexity, and $2\Delta + 2\delta$ worst-case view latency where $\Delta$ denotes a pessimistic network delay parameter under synchrony.
## 2026/1521
* Title: Beyond Blockchain Ballots: UC-Secure Layer-2 Voting and Governance
* Authors: Raghav Bhaskar, Pooya Farshim, Matthias Fitzi, Aggelos Kiayias
* [Permalink](https://eprint.iacr.org/2026/1521)
* [Download](https://eprint.iacr.org/2026/1521.pdf)
### Abstract
Maintaining a decentralized system requires a collective governance mechanism that allows participants to agree on changes to the system. In particular, the governance mechanism should offer a voting functionality for casting, collecting, and tallying votes in a confidential yet verifiable manner. Scaling this functionality for millions of participants in a cost-effective manner is a critical requirement for permissionless blockchains that remains unmet.
We put forward a "layer-2" approach to meet this requirement in a setting where a permissionless blockchain acts as the fallback "layer-1" mechanism. Specifically, our approach to scalability realizes the protocol in a layer-2 fashion: the bulk of the protocol is executed off-chain, but secured on the blockchain with a minimal footprint.
We prove our protocol secure in the Universal Composability (UC) framework. First, we formalize a governance ideal functionality $\mathcal{F}_{\mathsf{L2Gov}}$. Our definition offers high levels of confidentiality and verifiability. Moreover, in the case of misbehavior, it allows faults to be attributed so that appropriate action (such as the slashing of on-chain funds) can be taken. Second, we demonstrate that our protocol UC-realizes the $\mathcal{F}_{\mathsf{L2Gov}}$ functionality based on a blockchain, an off-chain bulletin board, a distributed homomorphic encryption functionality ($\mathcal{F}_{\mathsf{DHE}}$), and other standard hybrids.
To the best of our knowledge, this work presents the first layer-2 blockchain voting protocol with a rigorous security analysis. We also point out some challenges that arise when applying the UC framework to layer-2 protocols.
## 2026/1522
* Title: Efficient Ternary Computation of Optimal Ate Pairing on BLS27 Curves
* Authors: Walid Haddaji
* [Permalink](https://eprint.iacr.org/2026/1522)
* [Download](https://eprint.iacr.org/2026/1522.pdf)
### Abstract
The computation of optimal Ate pairings on elliptic curves with embedding degree $k=27$ (BLS27) is highly relevant for achieving the 256-bit security level, especially in the context of recent advances in the Number Field Sieve (NFS) and its variants (exTNFS, SexTNFS). Traditional binary approaches fail to fully exploit the degree-3 extension tower of $\Fpk{27}$. In this work, we propose an efficient ternary version of the Miller loop, restricting the seed representation to sparse ternary digits $\{0, 1\}$ to streamline point operations and eliminate costly inversions. Furthermore, we generate two new parameter seeds tailored for exTNFS and SexTNFS security levels. These seeds feature sparse ternary representations that simultaneously guarantee the efficiency of the Miller loop and allow the full exploitation of cyclotomic cubing in $\mathbb{F}_{p^{27}}$ during the hard part of the final exponentiation. Compared to the state of the art binary approach by Fouotsa et al. (2020), our exTNFS seed yields a $22\%$ improvement in the overall optimal Ate pairing computation cost. Concurrently, our proposed SexTNFS seed ensures a higher level of security against the most advanced NFS variants.
## 2026/1523
* Title: Catching Many Traitors in Threshold Traitor Tracing: Lower Bounds and Constructions
* Authors: Dan Boneh, Aditi Partap, Mark Zhandry
* [Permalink](https://eprint.iacr.org/2026/1523)
* [Download](https://eprint.iacr.org/2026/1523.pdf)
### Abstract
A $t$-out-of-$n$ threshold decryption scheme distributes decryption key shares among $n$ parties so that any $t$ of them can jointly decrypt a ciphertext, while fewer than $t$ learn nothing about the plaintext. Traditional threshold schemes provide no accountability: a coalition of $t$ or more parties can combine their key shares and construct a pirate decoder that decrypts arbitrary well-formed ciphertexts, without any risk of being traced. To address this, Boneh, Partap, and Rotem [CRYPTO '24] introduced the notion of threshold traitor tracing (TTT), where a tracing algorithm that is given black-box access to the pirate decoder can identify at least one of the colluding parties. Many subsequent threshold traitor tracing schemes similarly find only a single traitor, even though the decoder must have been constructed using at least $t$ keys. While some constructions can find multiple traitors, they do so at the cost of large ciphertexts or only achieving a weak form of correctness.
In this work, we make the following contributions:
- Lower bounds: We show that for all existing traitor tracing techniques, the ciphertext must be large to allow tracing close to $t$ traitors. In particular, to trace $t-O(1)$ traitors, the ciphertext size must be at least $\Omega(t)$. To trace $a \leq t- \omega(1)$ traitors, the ciphertext size must scale with $\Omega(\frac{a-1}{t-a+1})$. For schemes that rely on fingerprinting codes, we show an even stronger lower bound.
- Upper bounds: We present two generic compilers that construct traitor tracing for general access structures (beyond threshold) from two building blocks: attribute based encryption for general access structures and sufficiently-expressive policies and mixed functional-encryption. We also present two concrete instantiations. Under exponential security assumptions, we construct a pairings-based threshold traitor tracing scheme that can trace $t$ traitors with ciphertext size $O(t^2)$. We also construct an LWE-based traitor tracing scheme for a DNF access structure, that can trace an authorized subset of traitors with ciphertext size $O(\hat{t}^2)$, where $\hat{t}$ denotes the size of the largest unauthorized subset in the access structure.
- A Candidate Theoretical Instantiation: We present a new tracing mechanism that can trace $t(1-1/\lambda^c)$ traitors with $\mathsf{poly}(\lambda)$ size ciphertext, public key, and secret keys. We prove security assuming ideal (black box) obfuscation.
Our work raises several open questions in the context of tracing multiple parties in a threshold traitor tracing scheme.
## 2026/1524
* Title: A Note on Single-Server QPIR from One-Way Functions
* Authors: Prabhanjan Ananth, Divyanshu Bhardwaj, Aditya Gulati
* [Permalink](https://eprint.iacr.org/2026/1524)
* [Download](https://eprint.iacr.org/2026/1524.pdf)
### Abstract
We observe that there exists a single-server quantum private information retrieval with polylogarithmic communication assuming post-quantum one-way functions. Our observation follows immediately from the compilation technique of [Kerenidis-Wolf STOC'03] when combined with distributed point functions by [Gilboa-Ishai EUROCRYPT'14].
## 2026/1525
* Title: NAIBI: Binding Reconciliation KEMs and Ephemeral Key Agreement over Non-Split Commutative Algebras
* Authors: Sidoine Djimnaibeye, Djiby Sow, Mahamat Borgou Hassan, Daniel Tieudjo, Ganga Tchawa
* [Permalink](https://eprint.iacr.org/2026/1525)
* [Download](https://eprint.iacr.org/2026/1525.pdf)
### Abstract
We propose NAIBI-Full, a lattice-based key encapsulation mechanism (KEM) together with its forward-secure ephemeral key-agreement protocols, built on the regular representation EYLi of the non-split commutative algebra \cAEYc+ =\RqrUo[EYaa]/(EYaaEYay reAEYc+)
over \Rq =\ZEYaRrUo[EYaN]/(EYaNEYac +1), EYay ree{2,3}, EYc+ a non-EYay -th power. Each party publishes the full matrix \bft =EYE|rUoEYLirUi(\bfs) +\bfe ree\RqEYay|uEYay ; because EYLirUi(\cAEYc+) is commutative, the cross-product collapses to small noise and a Peikerthint closes the gap to exact agreement, even though the public matrix EYE| is fully generic in EYaCEYayrUi(\Rq). Hardness rests on a single, well-localised assumption: structured-secret Module-LWE \MLWErho, which we identify exactly with a EYLirUi(EYaa)-linked EYay-sample MLWE problem via column decomposition, placing it inside the well-cryptanalysed MLWE landscape of ML-KEM. NAIBI-Full is the conservative member of the family: a clean account in terms of a standard lattice assumption, at the cost of EYay2-element public keys and ciphertexts. We obtain an IND-CCA2 KEM (FOreN, ROM and QROM) plus two forward-secure ephemeral protocols (ephemeral-static and ephemeral-ephemeral) sharing the same algebraic core, and a statistical, decapsulation-level binding correctness guarantee with collision probability ren(2/3+13rUoEYaR)rieEYac/2rie +(8/EYaR)EYac/2 +2reA256 (below 2reA148 at every parameter set). Crucially this binding holds in the malicious-key model on the ciphertext axis (EYu4EYuaEYu2-EYuiEYu?EYu!EYuu-EYu--EYuoEYu|), with no distributional assumption on the adversarial keys --- the property ML-KEM is known to lack. We deliberately do not offer a static-static mode, which would inherit the active key-mismatch attacks of the Ding/Peikert/NewHope family; NAIBI-Full is confined to its key-mismatch-resistant deployments. Parameter sets cover NIST security Categories~1, 3 and~5, all with EYc+ ren2reA128
.
## 2026/1526
* Title: On the Suitability of Syndrome Decoding for Proof-of-Work under Quantum Adversaries: Design and Analysis
* Authors: Aleck Nash
* [Permalink](https://eprint.iacr.org/2026/1526)
* [Download](https://eprint.iacr.org/2026/1526.pdf)
### Abstract
Proof-of-work (PoW) remains a fundamental mechanism for
achieving decentralized consensus, most commonly instantiated using cryptographic hash functions. In such constructions, mining takes the
form of an unstructured search problem over a large input space, where
miners repeatedly evaluate candidate solutions until a valid one is found. While this design has proven effective in practice, it admits a quadratic quantum speedup via GroverrCOs algorithm, raising concerns about the
long-term security of hash-based mining. Motivated by this limitation,
we investigate the use of code-based cryptographic problems as an al-
ternative foundation for proof-of-work. In particular, we focus on the
syndrome decoding problem and examine its classical and quantum com-
plexity based on current state-of-the-art information-set decoding (ISD) algorithms and their quantum variants, comparing the resulting quantum advantage with that of hash-based and lattice-based constructions.
Building on this analysis, we propose a proof-of-work construction based
on the Syndrome Decoding Problem (SDP) with a structured profile
constraint, which enables controlled variation of solution density and difficulty. Under the standard random-instance heuristic, we derive ex- pressions for the expected number of solutions and the probability of successful mining, providing a principled basis for parameter selection.
## 2026/1527
* Title: Shuffling is Not Enough: Breaking Permutation-Based Model Confidentiality in Hybrid FHE Inference
* Authors: Jiseung Kim, Hyung Tae Lee
* [Permalink](https://eprint.iacr.org/2026/1527)
* [Download](https://eprint.iacr.org/2026/1527.pdf)
### Abstract
Hybrid fully homomorphic encryption (FHE) inference improves the practicality of private inference by letting the server evaluate linear layers homomorphically while the client decrypts and applies nonlinearities. Recent schemes attempt to protect model confidentiality by returning noisy, output-permuted responses and appealing to shuffle-model differential privacy (DP). We show that this protection fails in the correctness regime required by hybrid FHE systems. For a $d$-input linear layer, $d+1$ admissible queries suffice for exact recovery of a permutation-invariant layer summary, hence for perfect model distinguishability. We further show that input DP is orthogonal to model confidentiality and that the local-DP premise required for shuffle amplification cannot hold under correctness-bounded noise. We recover all linear layers of a SAFHIRE-style ResNet-20 end-to-end from TFHE transcripts with zero error, using $d+1$ queries per layer for a total of $5{,}712$ direct queries. Under the same query model, we also confirm exact per-layer recovery on pretrained ImageNet-scale CNNs and ViT-B/16. The leaked spectra enable fingerprinting, lineage attribution, and improved logit-based extraction, while suppressing them destroys inference utility.
## 2026/1528
* Title: Revisiting Automated Quantum Periodic Distinguisher Construction
* Authors: Jian Guo, Yiran Yao
* [Permalink](https://eprint.iacr.org/2026/1528)
* [Download](https://eprint.iacr.org/2026/1528.pdf)
### Abstract
Simon's algorithm can detect hidden XOR periods in functions derived from symmetric ciphers. Finding such functions becomes difficult when nonlinear layers and diffusion spread the relevant expressions across many branches, so recent work has used symbolic search to automate the construction. We refine the algebraic SMT model of Liu et al. in two ways. Prefix realization checks whether a symbolic starting state can be reached through preceding rounds and records the round-key nibbles needed to produce it. DDT Filtering restricts a local S-box input to a DDT bucket so that the symbolic path can cross an additional nonlinear layer. The latter condition is key-dependent: the target period need not lie in the translation space of the selected bucket, and our results state this condition explicitly. We report the maximum round counts found for GFS-2F, GFS-4F, Skipjack-B, LBlock, TWINE, CRAFT, and SKINNY, with Liu et al.'s automated model as the main comparison. We also combine selected witnesses with partial round-key guesses in the GroverrComeetrCoSimon setting, yielding reduced-round key-recovery candidates below the corresponding comparison budgets.
## 2026/1529
* Title: Generalized Wiener-Type Attacks on Two RSA-Like Cryptosystems
* Authors: Abdoulaye Faye, Michel Seck, Abdoul Aziz Ciss, Papa Cheikhou Diop, Oumar Niang
* [Permalink](https://eprint.iacr.org/2026/1529)
* [Download](https://eprint.iacr.org/2026/1529.pdf)
### Abstract
In AfricaCrypt 2025, Seck et al. proposed a new generalized Wiener-type attack on an RSA-like cryptosystem proposed by Cotan and Teseleanu (NordSec 2023). In their attack, they studied the generalized key equation $eu - (p^4 - 1)(q^4 - 1)v = w$ and showed that a private exponent $d$ which is too large or too small can be recovered in polynomial time. Another RSA variant based on cubic Pell curves with key equation $ed - (p - 1)^2(q - 1)^2 k = 1$, was examined by Rahmani and Nitaj in AfricaCrypt 2025. Note that these two attacks are valid for a balanced modulus $N = pq$ ($q < p < 2 q$).
In this paper, we extend these two attacks by showing that for a modulus $N=pq$ product of arbitrary primes $p$, $q$, one can efficiently factor $N$ by studying the two key equations $ex - (p^4 - 1)(q^4 - 1)y = \omega$ and $ex - (p - 1)^2(q - 1)^2 y = \omega$ under certain conditions on $x,y$ and $\omega$. Our new attacks are based on Coppersmith method and continued fractions.
## 2026/1530
* Title: Rich Input Representations in Neural Differential Cryptanalysis: A Taxonomy and Survey
* Authors: Alireza Gholizadeh Shahrbejari, Reza Ebrahimi Atani
* [Permalink](https://eprint.iacr.org/2026/1530)
* [Download](https://eprint.iacr.org/2026/1530.pdf)
### Abstract
Neural differential distinguishers have become an active research direction inrCi symmetric-key cryptanalysis since the introduction of deep-learning-based attacks onrCi round-reduced SPECK. Early neural distinguishers typically used a single ciphertext pairrCi or ciphertext difference as input. Recent studies, however, show that richer inputrCi representations can substantially affect the information available to the classifier, the datarCi cost of each labeled sample, and the relevance of the distinguisher to practical attacks.rCi Examples include multi-pair, multi-difference, matrix-style, multi-round,rCi structured-encoding, and score-aggregation based inputs.rCi This paper provides a taxonomy and survey of rich input representations in neuralrCi differential cryptanalysis. We introduce a representation-centric framework that describesrCi an input representation by its difference set, number of observations per sample, sharingrCi structure, encoding function, and ciphertext cost. Using this framework, we organizerCi existing works into representation families and compare their motivations, benefits, andrCi limitations. We also argue that representation-rich distinguishers require cost-awarerCi evaluation: fixed-sample comparisons and fixed-ciphertext comparisons answer differentrCi questions and may lead to different conclusions. Finally, we identify open problems relatedrCi to automated representation search, theoretical explanation of representation gain,rCi cipher-family transferability, interpretability, reproducibility, and key-recovery integration.rCi The survey highlights that rich input representations should be treated as first-classrCi cryptanalytic design choices rather than secondary implementation details.
## 2026/1531
* Title: Toward a Secure Fixed-Point Implementation of the Falcon Signature Scheme
* Authors: Daniel De Almeida Braga, Pierre-Alain Fouque, Bachir Lachguel, Thomas Prest
* [Permalink](https://eprint.iacr.org/2026/1531)
* [Download](https://eprint.iacr.org/2026/1531.pdf)
### Abstract
Falcon was selected by NIST in 2022 for standardization as a post-quantum digital signature scheme. Among all standardized signature schemes, Falcon achieves the smallest signature size. Its main drawback, however, is its reliance on floating-point arithmetic, which plays a critical role in the security analysis. This reliance poses significant challenges for practical implementations: some platforms lack floating-point units, floating-point division is not constant time on many processors, and protecting floating-point computations against side-channel attacks using masking techniques is particularly difficult on embedded devices.
To address portability issues, Pornin (ePrint 2019/893) proposed an implementation of \falcon that emulates floating-point arithmetic using integer operations. While it enables deployment on a wider range of platforms, this approach incurs a substantial performance penalty compared to the native floating-point implementation.
This work studies the theory and practice of implementing Falcon's signing procedure in fixed-point arithmetic. This requires a specific analysis of the boundedness and precision of intermediate variables.
1. Our boundedness analysis revolves around a key fact: almost every intermediate variable arising during key expansion and signing is bounded by a function of four quantities that can be computed at key generation time. Our modified key generation enforces thresholds on these quantities through a light rejection step that rejects less than 50% of initial Falcon keys. This then yields sharp, unconditional bounds on all fixed-point variables.
Establishing these bounds is highly nontrivial, and relies on Gaussian concentration arguments as well as on symplectic pairs, a generalization of symplecticity.
2. Our precision analysis remains, for now, partly empirical. Following a R|-nyi divergence argument, our main theorem proves the security of fixed-point Falcon conditioned on error bounds of certain intermediate values. These error bounds are derived empirically based on extensive experiments.
We provide a C fixed-point implementation. It is approximately a factor of two slower than the original floating-point \falcon implementation, but achieves a speedup of an order of magnitude compared to emulated floating-point implementations.
## 2026/1532
* Title: Just-in-Time-OPRFs and a Modular Framework for Fast Private Set Intersection
* Authors: Mihir Bellare, Rishabh Ranjan, Doreen Riepel
* [Permalink](https://eprint.iacr.org/2026/1532)
* [Download](https://eprint.iacr.org/2026/1532.pdf)
### Abstract
This paper gives a modular and unified framework within which to derive fast protocols for Private Set Intersection (PSI). At the core of this is a new primitive, that we define, and that we call a Just-In-Time OPRF (JIT-OPRF). We show how to obtain PSI generically from any JIT-OPRF, and then how to obtain JIT-OPRFs from Oblivious Transfer (OT) and Vector Oblivious Linear Evaluation (VOLE). We recover as special cases PSI protocols in the literature based on these two assumptions. Our results and proofs throughout are concrete rather than asymptotic, with explicit bounds that allow one to determine security parameters to achieve a desired level (e.g.~128 bits) of proven security in practice. Our results show interesting differences in the concrete security of OT and VOLE based PSI. Beyond the practical contribution of concrete-security, our work adds conceptual simplicity to this area, and opens the door to new PSI protocols via the construction of new JIT-OPRFs.
## 2026/1533
* Title: Correcting the modulus switch error in TFHE bootstrapping for real-valued computation
* Authors: Thomas Crasson, Florian M|-hats
* [Permalink](https://eprint.iacr.org/2026/1533)
* [Download](https://eprint.iacr.org/2026/1533.pdf)
### Abstract
Torus Fully Homomorphic Encryption (TFHE) enables the homomorphic
evaluation of arbitrary functions via Programmable Bootstrapping
(PBS). However, the modulus switching step inherent to bootstrapping
introduces a rounding error that forces the discretization of the
input space, limiting the achievable precision on real-valued inputs.
We propose a correction algorithm based on a first-order Taylor
expansion, applied after bootstrapping, that directly mitigates this
rounding error. Our method leverages the many-LUT technique to
simultaneously recover encryptions of the function and its derivative
within a single PBS, making the correction essentially free in terms
of bootstrapping latency. We support our construction with a
heuristic average-case noise analysis, validated by empirical
measurements, and demonstrate a tenfold reduction in bootstrapping
noise standard deviation. As a proof of concept, we apply our method
to the numerical integration of ordinary differential equations under encryption.
## 2026/1534
* Title: Masking, Sequences, and FALCON: A Theoretical Study on Masking Strategies Using Sequences for Non-Linear Operands in the FALCON Post-Quantum Signature
* Authors: Pierre-Augustin Berthet
* [Permalink](https://eprint.iacr.org/2026/1534)
* [Download](https://eprint.iacr.org/2026/1534.pdf)
### Abstract
Post-Quantum Cryptography is now in its deployment phase. Amongst the threats encountered in real-world applications is Side Channel Analysis, a cryptanalysis branch relying on the study of physical leakages from unsecured implementations. However, the FALCON post-quantum signature includes non-linear functions on real numbers, and applying the generic masking countermeasure to these functions has only been recently studied. In this work, we use convergent sequences to approximate the function and a minimax polynomial to compute the first term of the sequence. The method is applied to the computation of the inverse, the inverse square root and the square root in FALCON. A theoretical analysis of the security in the t-probing model using the NI criterion and its variants is proposed. Compared to the existing state-of-the-art which only covers the inversion for floating-point implementation, this paper is generic and works with any representation and precision for real numbers.
## 2026/1535
* Title: ViNET: Connecting the Unconnected using Video over LTE
* Authors: Manav Mittal, Yogesh Kaushik, Anirudh S Kumar, Mukulika Maity, Sambuddho Chakravarty
* [Permalink](https://eprint.iacr.org/2026/1535)
* [Download](https://eprint.iacr.org/2026/1535.pdf)
### Abstract
Internet shutdowns are used authoritarian regimes to suppress communication that end up crippling essential Internet-driven services, besides the obvious silencing of dissent. Traditional tools like VPNs and Tor, dependent on active Internet connections, falter during these blackouts. Earlier solutions, such as Dolphin, delivered meagre bandwidth and weak privacy safeguards, exposing a glaring weakness in the battle against digital oppression.
ViNET, a system that cleverly repurposes Video over LTE (ViLTE) calls, often operational during shutdowns, into a stealthy conduit for real-time Internet access. By ingeniously embedding network traffic in ViLTE packets, ViNET achieves robust 60 to 400 Kbps transmission rates, matching 2G speeds and surpassing previous solutions like Dolphin by 1500xrCo4000x, while ensuring end-to-end TLSbased confidentiality and integrity. This performance enables text-based web browsing with page loads in seconds to minutes, 1 MByte file downloads in ree30s, and seamless messaging over Telegram.
ViNET also outsmarts machine learning-based traffic classifiers, achieving a remarkable false positive rate, at times as high as 40%, when attempting to detect ViNET using SOTA models. With such standout metrics, ViNET emerges as a formidable ally, offering a performant, reliable and privacy-first lifeline, in the face of Internet shutdowns.
## 2026/1536
* Title: Privacy-Preserving Identity Management and Software Bill of Materials Vulnerability Detection: Practical Use Cases from the PRIVIDEMA Project
* Authors: Mariya Georgieva Belorgey, Benoit Cogliati, Simon Demarty, Lois Huguenin-Dumittan, |uzcan |uzt|+rk, Salma Rasti Samiei, Oana Stan
* [Permalink](https://eprint.iacr.org/2026/1536)
* [Download](https://eprint.iacr.org/2026/1536.pdf)
### Abstract
PRIVIDEMA project (Privacy-Preserving Identity Management for Digital Wallets and Secure Data Sharing and Processing for Cyber Threat Intelligence Data) advances the state of the art in cryptographic and Privacy-Enhancing Technologies (PETs) to enable secure, interoperable, and trustworthy data exchange across sectors, with a focus on the domains of Cyber Threat Intelligence and Digital Identity Management. This paper presents two representative real-world use-cases: (1) privacy-preserving digital identity management based on the European Digital Identity (EUDI) Wallet, and (2) privacy-preserving Cyber Threat Intelligence (CTI) sharing for Software Bill of Materials (SBOMs) and vulnerability datasets. Both use cases showcase how advanced PETs, including Fully Homomorphic Encryption (FHE), Federated Learning (FL), and Differential Privacy (DP), can be composed to protect sensitive data throughout its lifecycle while maintaining analytical and operational utility. Together, these use cases chart a practical course toward more scalable, standards-compliant, and privacy-preserving data ecosystems that align with EuroperCOs vision for secure and trustworthy digital services.
## 2026/1537
* Title: UM-PSO: A Unified Multi-Party Framework for Private Set Operations with Malicious-Majority Security
* Authors: Yaxi Yang, Xiaojian Liang, Weizhan Jing, Ye Dong, Xiangfu Song, Fangyuan Sun, Pu Duan, Tianwei Zhang
* [Permalink](https://eprint.iacr.org/2026/1537)
* [Download](https://eprint.iacr.org/2026/1537.pdf)
### Abstract
Private Set Operations (PSO) enable mutually untrusted parties to securely compute arbitrary functions (e.g., union, intersection, and cardinality) over their private input sets, which have wide applications in many real-world scenarios. Existing PSO protocols fall short of practical deployment for several reasons. (1) \textit{Function-specific}. Real-world privacy-preserving applications often require multiple set operations within the same task, while existing solutions typically address individual functionalities (e.g., intersection or union) in isolation, making it difficult and costly to support diverse set operations in a unified and efficient manner. (2) \textit{Lacking malicious security}. As PSO is commonly employed in highly sensitive applications, it is often necessary to provide strong adversarial guarantees with malicious security. Unfortunately, most of existing works only achieve semi-honest security, which limits their practical applicability. (3) \textit{Restricted settings}. Majority of existing works focus exclusively on the two-party setting. How to extend them to the multi-party setting with malicious majority securely and efficiently is unclear. To date, designing a maliciously secure multi-party PSO (mPSO) framework that efficiently supports diverse set operations remains an open challenge.
This paper presents the \textit{first} maliciously secure mPSO framework, named UM-PSO, that supports a broad range of set operations with practical efficiency. At the core of our framework is a function-independent preprocessing phase that prepares a reusable pool of secret-shared items, which can then be leveraged to securely compute diverse set functionalities in the online phase. To achieve malicious security efficiently, we design verification mechanisms on top of SPDZ-based authenticated secret sharing, along with tailored techniques and optimizations to further improve practical performance. We implement our protocols and report concrete performance results. For a representative setting with 5 parties and a total of $2^{12}$ 128-bit items, our framework achieves an online running time of $0.627$ seconds and incurs $3.35$ MB of communication. Compared to the baselines, our framework achieves up to $51\times$ speedup and $76\times$ lower communication cost.
## 2026/1538
* Title: An Attack on High Rate McEliece Cryptosystems Using Generalized Reed Solomon Codes with Weight 2 Mask
* Authors: Julia Lieb, Abhinaba Mazumder, Michael Schaller
* [Permalink](https://eprint.iacr.org/2026/1538)
* [Download](https://eprint.iacr.org/2026/1538.pdf)
### Abstract
Due to the insecurity of McEliece cryptosystems instantiated with Generalized Reed-Solomon codes, there have been several proposals of McEliece type systems that replace the permutation matrix by a matrix $M$ with larger row and column weight.
In many of them, the secret key is still a GRS code.
There have been successful attacks on some of those schemes with row and column weight between $1$ and $1 + R$, where $R$ is the rate of the code. The case of weight two and larger has been left open in these works.
Subsequently, several authors proposed schemes with weight exactly two and with even higher weight.
We provide distinguishers for the public codes appearing in these cryptosystems in the high rate regime.
In addition, we give a framework to turn a good enough distinguisher into a key-recovery attack.
In the case where the matrix $M$ has row and column weight $2$, we can successfully attack the scheme in the high rate regime using a cube code distinguisher.
## 2026/1539
* Title: Falcon Verify on AVX-512: Speed Records
* Authors: David Rubin, Emanuele Cesena
* [Permalink](https://eprint.iacr.org/2026/1539)
* [Download](https://eprint.iacr.org/2026/1539.pdf)
### Abstract
We present a fast implementation of Falcon (FN-DSA) signature verification with AVX-512. On a modern AMD Zen5 core, it completes a Falcon-512 verification in 3.6 microseconds, 2.6 times faster than an already optimized baseline, with comparable gains on Zen4, and consistent results across clang 21 and gcc 15.
The speedup comes from rewriting the Number-Theoretic Transform (NTT) and from vectorising all other stages of the verification algorithm. The novelty is to use a 32-bit Barrett-style representation, instead of the reference 16-bit Montgomery, and adopt Shoup-Harvey precomputed multipliers for twiddle reduction.
With all optimizations applied, hash-to-point (and specifically Keccak) is the dominant cost. We therefore propose a non-standard Falcon variant that replaces SHAKE256 with KTP256, an XOF based on KangarooTwelve with parallel squeeze. It cuts verification to 2.2 microseconds on Zen5, yielding 4.2 times over the baseline, and is of independent interest for any post-quantum scheme that uses a Keccak sponge to sample large amounts of data from a fixed seed.
All code is open source.
--- Synchronet 3.22a-Linux NewsLink 1.2