From Newsgroup: sci.crypt

## In this issue
1. [2026/314] Structural Tightness of Quadratic Multi-Query ...
2. [2026/1446] Quantum Circuit Optimization with LLMs under a ...
3. [2026/1546] Note on Number-Theoretic Transforms for ...
4. [2026/1552] BORG: Extendable Distributed Vector Commitments ...
5. [2026/1560] Dimension Reduction for SVP in Hawk: A Trace-Zero ...
6. [2026/1570] Anchor-DKG: Distributed Key Generation with ...
7. [2026/1572] SHARMONY: Composing SHA-2 and SHA-3 Hardware for ...
8. [2026/1576] A Systematic Literature Review on Optimising ...
9. [2026/1580] Order Auctions with Private Position Preferences
10. [2026/1582] Privacy-Preserving Inclusion Lists
11. [2026/1583] Cryptanalysis of a Candidate Witness Encryption ...
12. [2026/1584] Beyond Affine Invariants: A Hamming-Weight ...
13. [2026/1585] Proving Threshold Regev PKE from Adaptive Hint- ...
14. [2026/1586] Perturbation of Hankel moment singular values and ...
15. [2026/1587] Solving the Shortest Vector Problem in ...
16. [2026/1588] Strided Frobenius Additive FFT and its Application ...
17. [2026/1589] The Role of Regular Integers Modulo n in RSA ...
18. [2026/1590] Updatable Oblivious Key Value Stores with Access ...
19. [2026/1591] A Polynomial-Time Quantum Algorithm for the ...
20. [2026/1592] Sub-Cubic Homomorphic Matrix Multiplication via ...
21. [2026/1593] HAWK-$n$ Key Recovery Reduces to SVP in Dimension ...
22. [2026/1594] Breaking ADP-Based Witness Encryption
23. [2026/1595] Budget Allocation in Neural Differential Distinguishers
24. [2026/1596] Baker: A Privacy-Preserving, NIZK-free and ...
25. [2026/1597] Solving the Shortest Vector Problem in ...
26. [2026/1598] zk-Cinema: Proving Video Provenance in Zero Knowledge
27. [2026/1599] One Discrete Gaussian Sample in $2^{n/2+o(n)}$ Time
28. [2026/1600] Paras: Actively Secure Two-Server Private Histograms
29. [2026/1601] Power side-channel leakage distinguishers on ...
30. [2026/1602] New Designs of Multivariate-Polynomial Universal ...
31. [2026/1603] Design and Analysis of Quantum Designated Verifier ...
32. [2026/1604] Algebraic Analysis of Homomorphic Trace Evaluation ...
33. [2026/1605] UC, Categorically: Rigorous Diagrammatic Proofs
34. [2026/1606] Verbeth: Secure Messaging with Metadata ...
35. [2026/1607] UFOs: A Very Efficient Multivariate Public Key ...
36. [2026/1608] Efficient Large-Integer Arithmetic for FHE
37. [2026/1609] Distributed Monotone Policy Encryption with ...
38. [2026/1610] Algorithmic Optimization of the Gaussian Sampler in ...
39. [2026/1611] Private Identity-based Bulletin Boards for ...
40. [2026/1612] DYNAFIX: Dynamic FixedrCaPoint Encoding for ...
41. [2026/1613] DuetORAM: Two-Server Distributed ORAM with Constant ...
42. [2026/1614] LFSRs and Boolean Masking: An In-depth Security ...
43. [2026/1615] KORD: Breaking the Key-Generation Bottleneck in ...
44. [2026/1616] Flip a Failure into a Success: Improved Bit ...
45. [2026/1617] Verifiable SelfMix
46. [2026/1618] Two-Limb CRT Ring-LWE Encryption with Exact ...
47. [2026/1619] Relect: Single Secret Leader Election via FHE with ...
48. [2026/1620] Extending the Applicability of Algebraic Key ...
49. [2026/1621] Z-SCAPE: Zero-Knowledge Self-Custodial Credential ...
50. [2026/1622] Formal Security Analysis of the Olvid Messenger
51. [2026/1623] Triple Cryptanalysis of Isogeny-Based VRFs from ...
52. [2026/1624] Code Generation of Faster Formally Verified NTT ...
53. [2026/1625] AES-Based Grinding for MPC-in-the-Head Signatures
54. [2026/1626] Adaptive-Input-Secure Updatable Private Set Union
55. [2026/1627] Adaptively Secure Threshold Decryption from LWE ...
56. [2026/1628] Lattice-based Signature Schemes for Bitcoin
57. [2026/1629] When Does Being Selfish Pay Off? Temporal ...
58. [2026/1630] Quasipolynomial Cryptanalysis of the McEliece ...
59. [2026/1631] Preprocessed Private Function Evaluation: Achieving ...
## 2026/314
* Title: Structural Tightness of Quadratic Multi-Query Bounds for Universal Hashing: Applications to Accordion Modes
* Authors: Jonathan Fuchs
* [Permalink](https://eprint.iacr.org/2026/314)
* [Download](https://eprint.iacr.org/2026/314.pdf)
### Abstract
Universal hashing gives a pairwise guarantee: for two distinct messages, the probability of any fixed keyed-hash output difference is at most $\varepsilon$. Summing over the $\binom q2$ query pairs gives the familiar multi-query upper bound $\binom q2\varepsilon$, but this union bound does not show that one transcript can realize quadratically many useful pairwise events. We study when a single algebraically structured query set can do so by arranging many substantially different key conditions whose solution sets spread across the key space. Catching gives a simple chosen-offset baseline, while action-invariant grouping provides both a general analysis tool and an attack-search methodology based on message transformations, key relabelings, relative actions, and solution-set overlap. For POLYVAL, and for $\operatorname{NH}[w]$ when even $w\geq4$, we obtain zero-offset constructions in which every query uses output offset zero and balanced partial sets already achieve $\Theta(q^2\varepsilon)$ growth up to absolute constant factors. Thus the quadratic phenomenon can be intrinsic to keyed-hash algebra rather than caused by chosen output offsets. We then show that the same key-space coverage principle survives inside complete accordion modes. HCTR2 gives expected-list recovery of its derived POLYVAL subkey: the true subkey is always included and the candidate list has expected size $2$ in the ideal-permutation model. In ddd-AES the consequence is stronger than distinguishability: with $2^{65}$ fixed-tweak chosen plaintexts of length $384$ bits, exactly one observable cross-pair is the internal POLYVAL catch and it deterministically determines the full $128$-bit POLYVAL key $L$.
## 2026/1446
* Title: Quantum Circuit Optimization with LLMs under a Structured Guideline
* Authors: Kyungbae Jang, Hyunji Kim, Hwajeong Seo, Anupam Chattopadhyay
* [Permalink](https://eprint.iacr.org/2026/1446)
* [Download](https://eprint.iacr.org/2026/1446.pdf)
### Abstract
The cost of quantum cryptanalysis is dominated by the quantum circuit of the target cipher. Estimating the quantum attack cost of a cipher thus requires building that circuit and measuring its qubit count, Toffoli count, and Toffoli depth. This is manual work that needs expert knowledge and must be redone for each cipher and each cost target. Large language models handle ordinary programming well, but their use in constructing quantum circuits for ciphers is still limited. In this work, we collect quantum circuit optimization techniques that apply across many ciphers. We write these techniques into a guideline for a general-purpose LLM. Given this guideline and a single target cipher, the model produces two circuits. One minimizes the qubit count, and the other minimizes the Toffoli depth. Each circuit is verified against the test vectors of the cipher before its resources are estimated. Using this approach, we implement quantum circuits of CRAFT, MANTIS, QARMA, mCrypton, EPCBC, and Pyjamask for which quantum circuit implementations have not previously been reported. We further apply the same approach to ciphers with existing implementations. Without access to prior results, the generated circuits reach resource counts comparable to manually optimized ones.
## 2026/1546
* Title: Note on Number-Theoretic Transforms for Implementers -- Butterflies, Twisting, Incompleteness, and Good's Trick
* Authors: Bo-Yin Yang
* [Permalink](https://eprint.iacr.org/2026/1546)
* [Download](https://eprint.iacr.org/2026/1546.pdf)
### Abstract
We develop the radix-2 number-theoretic transform (NTT) and its
butterflies, the twisting trick and why it never changes the
transform, the freedom to use Cooley--Tukey butterflies in both
directions, incomplete NTTs, Good's trick, and the ways all of these
combine---closing with the coefficient-bound bookkeeping that
motivates the whole toolkit. This note is intended to help
implementers of postquantum cryptography, and is compressed from the
author's lecture slides in his Postquantum Cryptography class at
National Taiwan University (2020--2025). It may be otherwise
trivial for FFT experts who know the DIT--DIF equivalence inside
out---except that they tend not to ever encounter incomplete NTTs.
## 2026/1552
* Title: BORG: Extendable Distributed Vector Commitments from Reconfigurable Erasure Codes
* Authors: Nicolas Alhaddad, Eran Tromer, Mayank Varia
* [Permalink](https://eprint.iacr.org/2026/1552)
* [Download](https://eprint.iacr.org/2026/1552.pdf)
### Abstract
Updatable vector commitments let users store and authenticate values contained within an evolving data vector. Existing work on updatable vector commitments studies how clients can store only the values and authentication proofs relevant to them, and can refresh stale opening proofs, with the help of an online maintainer that keeps the current vector and proof state. This work studies the complementary problem: how to decentralize the maintainer, in order to distribute the cost and availability requirements.
We formalize this problem as extendable distributed vector commitments (EDVC). A public control plane, such as consensus or a trusted party, determines batches of updates and extensions of stored vector. Maintainers accept and apply a batch only after validating it against the current authenticated state. The resulting state is stored across many maintainer nodes, each of which holds a publicly assigned coded data fragment and updates it non-interactively. A stale client can obtain the current state, and a fresh authenticated opening, from the current maintainers (without replaying the updates history).
We construct the first EDVC protocol, called Borg, from two components: a sparse vector commitment, and a coded storage layer that can be updated by linear operations. This construction applies when all active positions lie within a known growing prefix of the vector. We then construct a coded storage layer with the operations needed for this setting, including single-position openings, aligned range openings, public updates, adding new nodes, repairing failed nodes, and moving storage responsibilities between nodes. This is then used to flexibly distribute the data alongside a sparse Merkle tree for authentication.
Our construction is particularly simple when the maintained data is an append-only public log (e.g., a blockchainrCOs block archive, or certificate transparency logs). In this setting, distributed updates to the data and its authentication structure can be made just by broadcasting the new log entries, with no coordination across maintainer nodes. We empirically evaluate maintainersrCO cost for various workflows, showing that nodes can process hundreds of thousands of updates per second. We also show that node addition, repair of lost local state, and changes to the proof-serving threshold can all be supported efficiently.
## 2026/1560
* Title: Dimension Reduction for SVP in Hawk: A Trace-Zero Approach
* Authors: Guilhem Mureau, Alice Pellet-Mary
* [Permalink](https://eprint.iacr.org/2026/1560)
* [Download](https://eprint.iacr.org/2026/1560.pdf)
### Abstract
Let $E=\mathbb Q(\zeta_m)$ be a power-of-two cyclotomic field, with maximal totally real subfield $K=\mathbb Q(\zeta_m+\zeta_m^{-1})$. In previous work, Chevignard et al. (Eurocrypt'25) gave a reduction from module-LIP for rank-two module lattices over $\mathcal O_E$ to the norm-reduced Principal Ideal Problem (nrdPIP) in a quaternion algebra. We derive two consequences of this reduction. First, we obtain a polynomial time reduction from rank-$2$ module-LIP over $\mathcal O_E$ to rank-$3$ module-LIP over $\mathcal O_K$. Note that rank-$2$ modules over $\mathcal O_E$ are naturally seen as rank-$4$ modules over $\mathcal O_K$, so this is indeed an improvement. Our second result is specific to the module $\mathcal O_E^2$, underlying the Hawk signature scheme. In this setting, we also obtain a reduction to a rank-$3$ module-LIP instance over $\mathcal O_K$, but we can additionally show that these modules have a simple geometric shape: they are isomorphic to $\mathbb Z^{m/2+1} \perp \sqrt{2}\, \mathbb Z^{m/4-1}$. We then adapt Ducas' result (ePrint'23) to this setting. Putting everything together we obtain an algorithm breaking Hawk's key recovery by making polynomially many exact-SVP calls in lattices of dimension at most $3m/8+1$. This improves upon the previous analysis from Ducas (ePrint'23) which required exact-SVP calls in lattices of dimension at most $m/2+1$.
## 2026/1570
* Title: Anchor-DKG: Distributed Key Generation with Repeating Parties
* Authors: Hanwen Feng, Qiang Tang, Sri AravindaKrishnan Thyagarajan
* [Permalink](https://eprint.iacr.org/2026/1570)
* [Download](https://eprint.iacr.org/2026/1570.pdf)
### Abstract
A party may participate in multiple threshold cryptosystems. For example, it may serve on multiple overlapping threshold committees in a proof-of-stake blockchain or a distributed oracle network, or act as a client of multiple cryptocurrency wallet services built on threshold cryptography. With conventional distributed key generation (DKG), each threshold system independently generates its key shares, imposing significant key-management overhead on such a repeating party. In contrast, modern key-management practice favors deriving all cryptographic material deterministically from a single master key, raising a fundamental question: Can DKG be reconciled with key derivation while preserving security and compatibility with legacy threshold systems?
We present Anchor-DKG, a new DKG protocol that allows up to $t^{\mathsf{rec}}$ (the reconstruction threshold) parties to deterministically fix their secret key shares while retaining standard security guarantees. Anchor-DKG supports concurrent executions with overlapping participants across multiple DKG instances and remains fully compatible with legacy threshold schemes, including ECDSA, BLS, Schnorr, and ElGamal.
At the core of Anchor DKG lies a new technique: fixed-point distributed polynomial sampling (FpDpS). FpDpS allows parties to jointly sample a random $(t^{\mathsf{rec}}-1)$-degree polynomial $f$ such that $f(i) = s_i$ at designated points $i$, where each $s_i$ can be a private input, e.g., a key derived from a master secret. The final secret key remains $f(0)$, ensuring compatibility with existing discrete-log-based threshold systems. We provide an efficient construction of Anchor DKG under standard cryptographic assumptions, which, compared to classical constructions such as Gennaro et al. (J.Cryptol. 2007), only incurs one more point-to-point round and marginal computation. Experimental results show that, for a network size of $n=128$, our protocol incurs a per-party computation cost of $1.59$ s, compared to $1.36$ s for GJKR.
## 2026/1572
* Title: SHARMONY: Composing SHA-2 and SHA-3 Hardware for Crypto-Agile PQC
* Authors: Liga Anwar, Carlos Andres Lara-Nino, Jong-Yeon Park, Michael Hutter * [Permalink](https://eprint.iacr.org/2026/1572)
* [Download](https://eprint.iacr.org/2026/1572.pdf)
### Abstract
This work composes SHA-2 and SHA-3 into a unified hardware architecture, bringing them together as a single, efficient cryptographic ensemble. This need is driven in particular by Post-Quantum Cryptography (PQC), where different standardized schemes rely on either SHA-2 or SHA-3/SHAKE primitives. Rather than enforcing strict round-level unification, the proposed design applies selective sharing across the most area-critical components, including a shared 25x64-bit register bank, shared round-constant storage, and unified padding and control logic while maintaining full compliance with FIPS 180-4 and FIPS 202. In addition, a duet execution mode exploits the otherwise underutilized upper half of the 64-bit datapath to process two independent SHA-224/256 streams in parallel, benefiting Merkle-tree-based constructions in hash-based PQC. The design is implemented and synthesized on an Artix-7 FPGA, occupying 5,873 LUTs and 2,310 FFs. Experimental results show that SHARMONY achieves a throughput of 1,959 Mbps for SHA-256, representing improvements of 100-152% over the SHA-256 engines of SLotH, Sphincslet, OpenTitan, and Caliptra. At the same time, SHARMONY reduces LUT utilization by an average of 40% and FF utilization by an average of 55% compared to combined designs constructed from separate SHA-2 and SHA-3 implementations.
## 2026/1576
* Title: A Systematic Literature Review on Optimising CRYSTALS-Dilithium (ML-DSA) Performance for IoT Devices via Lightweight Hashing
* Authors: Ceasar Njuguna Ngunu, Edward Ombui
* [Permalink](https://eprint.iacr.org/2026/1576)
* [Download](https://eprint.iacr.org/2026/1576.pdf)
### Abstract
Background: The migration to post-quantum cryptography confronts resource-constrained Internet of Things (IoT) devices with a material performance cost. CRYSTALS-Dilithium, standardised as the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) in FIPS 204, fixes the Keccak-based SHAKE functions as its only symmetric primitives, and profiling on embedded platforms identifies hashing as the largest single contributor to the schemerCOs software cost. This review synthesises the performance evidence for ML-DSA on constrained platforms, classifies the optimisation strategies pursued in the literature, and tests whether any
published work substitutes a standardised lightweight extendable-output function for SHAKE within the scheme.
Methods: Following KitchenhamrCOs guidelines and the PRISMA 2020 statement, we searched IEEE Xplore, the ACM Digital Library, Scopus, and SpringerLink for peer-reviewed studies published from January 2020 onwards, complemented by backward and forward snowballing
and by targeted update searches through July 2026. A protocol was prepared in advance of the search. From 115 database records and 22 records identified through other methods, 40 primary studies met the inclusion criteria.
Results: On the ARM Cortex-M4, optimised software implementations of Dilithium3 require 10,667 kilocycles on average for signing and 2,321 kilocycles for verification; on the Cortex-M7, Dilithium-2 verification averages 1,429 kilocycles (6.6ms at 216MHz), with signing spanning 1,835 to 16,440 kilocycles due to rejection sampling. Optimisation efforts fall into four categories: hardware acceleration, platform-specific software optimisation, protocol-level
adaptation, and optimisation of the incumbent Keccak primitive itself. Architecture-specific Keccak optimisation reduces hashingrCOs share of DilithiumrCOs runtime on the Cortex-M4 by only 2.46 to 5.03 percentage points, indicating that the bottleneck largely survives direct attack.
Replacing Keccak with Ascon inside the sibling scheme Kyber yields a 24 to 25% cycle reduction and a 2 to 8% memory reduction on the Cortex-M4. No peer-reviewed study applies this substitution to ML-DSA.
Conclusions: With FIPS 204 and NIST SP 800-232 both final, the cost of ML-DSArCOs primitive choice on constrained platforms is a well-posed and unanswered question on both sides. We specify a per-call-site DilithiumrCoAscon evaluation, including its security constraints and non conformance status, as the priority direction for software-only optimisation of post-quantum signatures on IoT devices.
Keywords: post-quantum cryptography; ML-DSA; CRYSTALS-Dilithium; Ascon; lightweight cryptography; Internet of Things; systematic literature review
## 2026/1580
* Title: Order Auctions with Private Position Preferences
* Authors: Ruijie Wang, Aviv Yaish
* [Permalink](https://eprint.iacr.org/2026/1580)
* [Download](https://eprint.iacr.org/2026/1580.pdf)
### Abstract
We study auctions where two positions are sold to unit-demand bidders with private heterogeneous order preferences: some are specialists who value only the first position, while others are generalists indifferent between the two. First, we consider a first-price rule which allocates the first and second items to the highest and second-highest bidders, respectively. We show that no strategy profile ex-post implements the efficient allocation at every type profile, irrespective of payments, and provide a distribution-free equilibrium welfare guarantee of 1/2. To augment this result, we prove that for deterministic one-round auctions and discrete bids, the efficient allocation requires each bidder to communicate at least one bit more than its bid's binary representation. We next ask what the same bit accomplishes in winner-pays-bid formats where bidders can also specify specific item preferences. In particular, we show that this strengthens our distribution-free equilibrium welfare guarantee to 1-1/e. Finally, we discuss the applicability to priority service, blockchain transaction ordering, and cloud compute and artificial intelligence (AI) marketplaces.
## 2026/1582
* Title: Privacy-Preserving Inclusion Lists
* Authors: Zhengwei Tong, Saba Eskandarian, Kartik Nayak
* [Permalink](https://eprint.iacr.org/2026/1582)
* [Download](https://eprint.iacr.org/2026/1582.pdf)
### Abstract
Blockchains aim to provide open access and censorship resistance, but centralization of block production in blockchains like Ethereum undermines these goals. Inclusion List (IL) protocols mitigate this by requiring block proposers to include transactions selected by an IL committee to enforce the inclusion of transactions that appear to have been censored. However, protecting the confidentiality of individual committee membersrCO contributions is essential to prevent retaliation and ensure robust censorship resistance.
We propose a lightweight, privacy-preserving inclusion list protocol that allows committees to collectively construct transaction lists while hiding individual contributions and ensuring plausible deniability. Our approach builds on multiparty computation (MPC) techniques to achieve strong privacy without relying on heavyweight cryptography or anonymous broadcast channels.
We implement two variants of our protocol design: an optimistic version providing malicious security with abort (latency $\sim 4.0$s) for speed, and a robust variant (latency $\sim 124.7$s) for guaranteed output delivery in the presence of a Byzantine threshold of $t < n/3$ malicious parties.
## 2026/1583
* Title: Cryptanalysis of a Candidate Witness Encryption Scheme for AN4ane Determinant Programs
* Authors: Sunghyeon Jo
* [Permalink](https://eprint.iacr.org/2026/1583)
* [Download](https://eprint.iacr.org/2026/1583.pdf)
### Abstract
At ITCS 2020, Bartusek, Ishai, Jain, Ma, Sahai, and Zhandry proposed a framework for witness encryption based on affine determinant programs and gave a concrete witness encryption candidate. Yao, Chen, and Yu later broke the separate ADP-based indistinguishability-obfuscation candidate, while noting that their attack did not apply to the witness-encryption construction.
More recently, Soukhanov et al. proposed witness encryption from arithmetic affine determinant programs. Soukhanov subsequently described a commutator attack on that construction and noted that the original ADP construction is also subject to the attack for sparse circuits.
The recovery of hidden column spaces in our attack uses this commutator technique. We give a deterministic polynomial-time attack that recovers the encrypted bit from the public ciphertext matrices of this candidate. It covers every $q\geq 1$ in the theorem's recovery range, including $q(n)=\lceil n^\varepsilon\rceil$ for all sufficiently large $n$. Outside a fixed finite set of primes, it applies to every SUBSET-SUM instance whose coefficient vector is nonzero modulo $p$ and that has no Boolean solution modulo $p$. On an explicit efficiently generated family of integer NO instances, the encrypted bit is recovered with probability $1-\mathrm{negl}(n)$ under the field-size convention of the original paper.
## 2026/1584
* Title: Beyond Affine Invariants: A Hamming-Weight Correlation Metric for Template-CPA Leakage in Key-Dependent S-boxes
* Authors: Wies+eaw Maleszewski
* [Permalink](https://eprint.iacr.org/2026/1584)
* [Download](https://eprint.iacr.org/2026/1584.pdf)
### Abstract
Classical selection criteria for cryptographic S-boxesrCononlinearity $\mathrm{NL}$, differential uniformity $\delta$, boomerang uniformity $\beta_{\mathrm{B}}$, algebraic degree $\deg$rCoare invariants of affine equivalence. That property is exactly what blinds them to a class of side-channel weaknesses. The correlation-power-analysis (CPA) template distinguisher is governed by the Hamming-weight functional, and Hamming weight is not affine-invariant; it does not descend to the affine-equivalence quotient on which the classical criteria live. Two S-boxes with identical $(\mathrm{NL},\delta,\beta_{\mathrm{B}},\deg)$ can therefore leak differently under template CPA. We make this precise for the key-dependent family $S^{\mathcal{G}}(x)=A\,\iota(x)\oplus c$, with $\iota$ the multiplicative inverse in $\mathrm{GF}(2^8)$ and $(A,c)\in\mathrm{GL}(8,\mathbb{F}_2)\times\mathbb{F}_2^8$ drawn from a byte stream $\mathcal{G}$. A structural proposition fixes the four invariants at $(112,4,6,7)$ across the entire family; they carry no information about $\mathcal{G}$. We introduce the Hamming-weight template correlation $\rho_{\mathrm{HW}}(\cdot,S_{\mathrm{AES}})$, identify it as the population statistic controlling the AES-template CPA distinguisher, and show that it resolves the fiber the classical invariants collapse. As a stress test we instantiate $\mathcal{G}$ with three sources of contrasting regularityrCoa system CSPRNG, a discretised logistic map, and a $\sin(1/x)$/xxHash hybridrCoand sample $3\times10^{5}$ S-boxes from a single master seed. The classical invariants are identical everywhere, as predicted. The metric is not. The logistic source widens the $\rho_{\mathrm{HW}}$ distribution against $S_{\mathrm{AES}}$ by $12$rCo$13\%$ ($\sigma_\ell=0.0704$ vs. $0.0626/0.0623$; Levene $p<10^{-180}$). The widening vanishes against a uniform-random reference permutation (Levene $p>0.13$), survives an exact Q1.31 fixed-point reimplementation at $3.1\%$, and does not appear for a tent-map control. Propagated through the MangardrCoOswaldrCoPopp trace-budget model and checked against a $2.16\times10^{5}$-attack Monte-Carlo CPA simulation, it yields a $29\%$ relative excess in AES-template success rate at $\mathrm{SNR}=10$, $N=10^3$ (empirical ratio $1.29$, analytic $1.26$). By every standard effect-size measure the widening is small (Cohen's $d=0.128$ on $|\rho_{\mathrm{HW}}|$, Cohen's $h=0.130$ on the attackable fraction); its significance is detectability, not magnitude. The contribution is a measurement axis, not a weak generator: a metric that flags template-CPA leakage where $\mathrm{NL}=112$, $\delta=4$ report perfect scores.
## 2026/1585
* Title: Proving Threshold Regev PKE from Adaptive Hint-MLWE: Efficient, Non-interactive, and CCA Secure
* Authors: Yisol Hwang, Shuichi Katsumata, Seonhong Min, Guilhem Niot, Yongsoo Song
* [Permalink](https://eprint.iacr.org/2026/1585)
* [Download](https://eprint.iacr.org/2026/1585.pdf)
### Abstract
Threshold public-key encryption (tPKE) has recently attracted renewed
interest, largely due to NIST's call for Multi-Party Threshold Cryptography. While classical tPKE has approached a high state of maturity, its post-quantum counterpart has not. Indeed, thresholdizing the celebrated lattice-based Regev PKE, which forms the basis of ML-KEM, remains unsatisfactory. Interestingly, how to thresholdize Regev PKE has not fundamentally changed in over a decade --- the only thing that has gradually progressed is its security analysis. To this day, it remains open whether threshold Regev can be proven secure while simultaneously satisfying a polynomial modulus, non-interactive decryption, and CCA-compatibility, each of which is essential for practical deployment.
We answer this affirmatively, providing the first proof that threshold Regev is secure under the MLWE assumption while satisfying all three requirements. In fact, we prove that it satisfies a very strong form of simulation-based security --- even stronger than what was known under a super-polynomial modulus --- allowing the adversary to obtain partial decryptions even of the challenge ciphertext. At the technical heart of our result is the adaptive hint-MLWE (AHMLWE) problem, an adaptive variant of hint-MLWE where the adversary obtains hints on the MLWE secret with adaptively chosen coefficients. We show that AHMLWE reduces tightly to standard MLWE, which may be of independent interest.
## 2026/1586
* Title: Perturbation of Hankel moment singular values and supersingular endomorphism rings via CVP: a $p$-adic super-resolution law and a fully computed pipeline
* Authors: Radmir Isyanov
* [Permalink](https://eprint.iacr.org/2026/1586)
* [Download](https://eprint.iacr.org/2026/1586.pdf)
### Abstract
We give two rigorous results in post-quantum algebra with a $p$-adic strengthening and a complete reproducible pipeline. Part I proves an explicit sufficient noise bound under which the Hankel matrix of the power moments of supersingular $j$-invariants deterministically recovers the nodes, with the propagation constant written through the Vandermonde condition number (Weyl, Bauer-Fike); non-archimedeanly, the Teichm|+ller lift makes the Vandermonde matrix unimodular ($\mathrm{cond}_p = 1$ for every $L$) and an exact super-resolution law gives the $p$-adic precision loss as $2\sum_{i<j} v_p(x_i - x_j) + \sum_i v_p(c_i)$, a sharp analogue of Moitra's bound. Part II reduces a $\mathbb{Z}$-basis of $\mathrm{End}(E)$ to a rank-4 CVP and recovers the exact Gram matrix of the norm form in $\mathrm{poly}(\log p)$ time via Weil-pairing discrete logs (Shor; in the smooth regime actually run, the logs are classical Pohlig-Hellman), after which fixed-dimension LLL yields a canonical basis and a $\lambda_1$-criterion reads the node type. Both parts are joined by an end-to-end theorem and fully computed on real numbers: node recovery, real V|-lu chains with measured degree, deterministic KLPT construction with the ideal-to-isogeny and smoothing steps, reading the torsion action in $\mathbb{F}_{p^4}$ and via Weil pairing + Pohlig-Hellman without an $O(N)$ table, true LLL + Fincke-Pohst, and the classification of all three nodes of $B_{23,\infty}$. The last KLPT heuristic (polynomial running time) is replaced by an explicit hypothesis PRH and a conditional theorem; PRH is shown to be exactly a Titchmarsh-type shifted-prime divisor sum with positive singular series, provable under GRH for fixed $p$, with uniformity in $p$ an identified open problem. Companion code (23 modules) verifies every numerical claim.
## 2026/1587
* Title: Solving the Shortest Vector Problem in $2^{0.7314n+o(n)}$ Time via Discrete Gaussian Sampling on Superlattices
* Authors: Yiming Gao, Yansong Feng, Honggang Hu
* [Permalink](https://eprint.iacr.org/2026/1587)
* [Download](https://eprint.iacr.org/2026/1587.pdf)
### Abstract
We give a classical randomized algorithm for the exact Euclidean Shortest Vector Problem (SVP) on arbitrary full-rank lattices. It runs in $2^{0.7314n+o(n)}$ time and$2^{n/2+o(n)}$ space. More precisely, it returns a shortest vector with high probability and runs in
$$
2^{E_0n+o(n)}
\quad\text{time and}\quad
2^{n/2+o(n)}
\quad\text{space},
\qquad
E_0=0.73133754\ldots .
$$
This improves the $2^{n+o(n)}$ classical bound of Aggarwal, Dadush, Regev, and Stephens-Davidowitz (ADRS, STOC 2015). It also beats the previous best known worst-case quantum bounds of Aggarwal, Chen, Kumar, and Shen (ACKS, SIAM J.Comp. 2025), namely $2^{0.9497n+o(n)}$ without QRAM and $2^{0.8345n+o(n)}$ with QRAM.
The algorithm constructs a random prime-index superlattice $\Gamma\supset L$ and applies the above-smoothing honest discrete Gaussian sampler of ADRS to $\Gamma$. Then it simply scans the resulting samples and retains the shortest nonzero one that lies in $L$.
The analysis passes to the dual lattice $M=\Gamma^*$. The random codimension-one constraint reduces the expected contribution of vectors outside $pL^*$ by a factor smaller than $1/p$, while the forced Gaussian mass on $pL^*$ is controlled geometrically using the Kabatiansky--Levenshtein sphere-packing bound. Consequently, $\Gamma$ is smooth at the sampling scale and a fixed shortest vector of $L$ is hit with probability at least $2^{-E_0n-o(n)}$ per ideal sample.
## 2026/1588
* Title: Strided Frobenius Additive FFT and its Application to HQC
* Authors: Ming-Shing Chen, Tun-You Chien, Chun-Ming Chiu, Cesare Huang, Han-Hsuan Lin, Chun-Tao Peng, Bo-Yin Yang
* [Permalink](https://eprint.iacr.org/2026/1588)
* [Download](https://eprint.iacr.org/2026/1588.pdf)
### Abstract
Boolean polynomial multiplication is the primary computational bottleneck of the Hamming Quasi-Cyclic (HQC) key encapsulation mechanism. In this paper, we reframe the Frobenius Additive FFT (FAFFT) in ring-theoretic terms, via quotient-ring homomorphisms and the Chinese Remainder Theorem. This perspective shows that a complete decomposition into evaluation points is unnecessary for multiplication, and naturally yields the Strided FAFFT (SFAFFT), which operates over smaller finite fields with fewer butterfly stages and admits a much sparser CRT modulus for the non-power-of-two degrees in HQC. Our SFAFFT implementations outperform all previous FAFFT-based multiplications on every tested platform (x86 AVX2, GFNI, Apple M1, ARM Cortex-A72, and Cortex-M4), and set new overall speed records for HQC in nearly all settings except plain AVX2, where Toom-Cook-Karatsuba remains faster for the two smaller parameter sets.
## 2026/1589
* Title: The Role of Regular Integers Modulo n in RSA Cryptography
* Authors: Klaus Dohmen, Mandy Lange-Geisler
* [Permalink](https://eprint.iacr.org/2026/1589)
* [Download](https://eprint.iacr.org/2026/1589.pdf)
### Abstract
We investigate a multi-prime multi-power generalization of the RSA cryptosystem for arbitrary moduli $n>1$, which under reasonable cryptographic assumptions works correctly for almost all messages $m<n$. Based on a new sharpening of Carmichael's theorem, tailored to regular integers modulo $n$, we prove that this generalization is correct precisely for messages represented by regular integers modulo $n$, thereby generalizing the original RSA correctness theorem. As in the original RSA scheme, decryption can be accelerated by Chinese remaindering, yielding a corresponding generalization of CRT-RSA.
## 2026/1590
* Title: Updatable Oblivious Key Value Stores with Access Control and Application to Multi Key Searchable Encryption
* Authors: Benjamin Fuller, Ariel Hamlin, Arinjita Paul, Maryam Rezapour, Ronak Sahu, Amey Shukla, Mason Stuart
* [Permalink](https://eprint.iacr.org/2026/1590)
* [Download](https://eprint.iacr.org/2026/1590.pdf)
### Abstract
Oblivious Key-Value Stores (OKVS) (Garimella et al., CRYPTO 2021), once encoded, provide indistinguishability over keys and random values. This is an important property in many secure computation applications, such as private set intersection and multi-key searchable encryption. We introduce an Updatable Oblivious Key-Value Store with access control (UOKVS), a dynamic extension of OKVS that supports insertions over time. We provide meaningful security in the presence of updates by equipping UOKVS with fine-grained access control. As a building block in UOKVS, we provide the first analysis of oblivious insertions for Cuckoo hashing, which may be of independent interest.
We show the application of UOKVS to multi-key searchable encryption where a data owner wishes to share parts of a multimap with multiple clients. We construct an oblivious multimap with insertions from UOKVS and private information retrieval (PIR).
Unlike prior multi-key searchable encryption schemes, our construction supports sharing without replicating data across authorized users, substantially reducing storage costs in addition to stronger privacy guarantees.
We implement our multi-key searchable encryption construction on a dataset containing up to 24 million entries using the Enron email dataset. For keywords matching 100 documents on a WAN, query processing completes in $0.6$ seconds using FrodoPIR as the underlying PIR protocol. By comparison, the scheme of Wang and Papadopoulos (Cloud Computing 2023) achieves a query time of $0.6$ seconds and also incurs data replication and leaks access patterns. Our construction reduces leakage, maintains performance, and only requires a $3.1$x storage overhead.
## 2026/1591
* Title: A Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem
* Authors: Daniel R. Simon
* [Permalink](https://eprint.iacr.org/2026/1591)
* [Download](https://eprint.iacr.org/2026/1591.pdf)
### Abstract
We present a polynomial-time quantum algorithm for the Dihedral Coset Problem (DCP). The algorithm is based on Regev's polynomial-time reduction of the Dihedral Subgroup Problem (DSP) to the modular subset sum problem, but uses a different technique to erase sample bits without use of a subset sum oracle. The algorithm can thus combine with Regev's reduction of lattice problems to DCP, improved by Brakerski, Kirshanova, Stehl{\'e} and Wen, to yield polynomial-time quantum algorithms for various lattice problems, such as finding a polynomial-factor approximation to the shortest vector in an $n$-dimensional lattice (SVP), and the ``learning with errors'' problem (LWE). The algorithm can tolerate a faulty sample rate as high as $1/O(\log{n})$, allowing the algorithm-reduction combination to efficiently solve, for example, SVP with a $\sqrt{n}$ polylog($n$) approximation factor, or LWE instances with $\alpha=\sqrt{n}$ polylog($n$).
## 2026/1592
* Title: Sub-Cubic Homomorphic Matrix Multiplication via Self-Dual Normal Bases * Authors: Efe -#zbudak, Kubra Kaytanci, Ferruh Ozbudak, Erkay Savas
* [Permalink](https://eprint.iacr.org/2026/1592)
* [Download](https://eprint.iacr.org/2026/1592.pdf)
### Abstract
This paper analyzes the bilinear embedding of matrix algebras into commutative cyclotomic rings. We apply the Cohn-Umans method. This establishes that single-multiplication bilinear monomial embeddings require a ring degree of $\widetilde{\Omega}(N^3)$. We circumvent this bound by routing Strassen tensor rank decompositions through orthogonal Chinese Remainder Theorem ideals. This reduces the asymptotic complexity to $\widetilde{\Omega}(N^{\log_2 7})$. We optimize the coprime tensor decomposition. Embedding the inner tensor into the maximal real subfield satisfies the Lempel-Weinberger parity constraint. This guarantees the existence of a Self-Dual Normal Basis, reducing the required basis generators to a single element and mathematically halving the homomorphic trace depth. Canonical integer polynomial lifts ensure uniform norm bounds. Type I Optimal Normal Bases bound the trace dual expansions to an $O(1)$ constant. By invoking Kronecker's theorem, we prove that the polynomial power basis minimizes the canonical expansion for the non-evaluated tensor components. A towered evaluation over composite degrees controls noise propagation. This decouples key-switching errors into a logarithmic bound. We generalize the embedding to Galois rings via Hensel's and Nakayama's lemmas to support high-precision integer arithmetic. Furthermore, we extend the architecture to boundless matrices exceeding the fixed ring capacity via a multi-ciphertext block-Strassen decomposition. By deferring the homomorphic trace operator to post-Strassen recombination, we completely eliminate homomorphic basis-switching, achieving an asymptotic complexity of $O(N^{\log_2 7 - 1/\rho})$ multiplications and $\widetilde{O}(N^{2 - 2/(\rho \log_2 7)})$ automorphisms for matrices of arbitrary dimension. Empirical benchmarks over the BGV scheme validate the approach. A multi-threaded towered trace evaluates $32 \times 32$ matrices in $141.3$ milliseconds at a security level of $\lambda=148$ using one ciphertext-ciphertext multiplication. We achieve a speedup factor of $2.49$ over multi-threaded baselines.
## 2026/1593
* Title: HAWK-$n$ Key Recovery Reduces to SVP in Dimension $n/2 + 1$
* Authors: Zygimantas Straznickas, Stephen A. Weis
* [Permalink](https://eprint.iacr.org/2026/1593)
* [Download](https://eprint.iacr.org/2026/1593.pdf)
### Abstract
HAWK is a lattice signature scheme that is currently a third-round candidate in NIST's post-quantum signature competition. We give an unconditional, deterministic polynomial-time reduction from HAWK-$n$ key recovery over $K_n=\mathbb{Q}(\zeta_{2^\ell})$ to $\mathrm{poly}(n)$ calls to an exact Shortest Vector Problem (SVP) oracle in dimension $n/2+1$, where $n=2^{\ell-1}$ is the ring degree. The reduction uses a nontrivial automorphism of the key lattice, supplied by the Galois involution $\tau:\zeta\mapsto-\zeta$ and recoverable as a shortest vector of a public rank-$n$ lattice isometric, up to scaling, to $\mathbb{Z}^{n/2+1}\oplus\sqrt{2}\,\mathbb{Z}^{n/2-1}$. Ducas's block reduction on this near-hypercubic class finds the automorphism, and the descent of van Gent and Pulles recovers the key from it. In the gate-count model, the attack lowers the key-recovery cost of HAWK-512 from $2^{150}$ to $2^{108}$ and of HAWK-1024 from $2^{288}$ to $2^{182}$. We demonstrate this with a practical implementation that recovers a HAWK-256 secret key end-to-end in a few hours on a single server. The construction does not transfer to Falcon. Conductors $m\in\{p^k,2p^k\}$ ($p$ an odd prime), i.e.\ the $m>4$ with cyclic $(\mathbb{Z}/m)^\times$, evade the attack.
## 2026/1594
* Title: Breaking ADP-Based Witness Encryption
* Authors: Muhammad El Gebali, Yaroslav Rebenko, Markus Schofnegger, Lev Soukhanov
* [Permalink](https://eprint.iacr.org/2026/1594)
* [Download](https://eprint.iacr.org/2026/1594.pdf)
### Abstract
Witness encryption (WE) allows one party to encrypt a message under an arbitrary satisfiable circuit, so that anyone holding a satisfying input can decrypt. Efficient WE enables numerous modern applications, such as identity-based and attribute-based encryption.
Recent candidates for efficient WE base their security on rank properties of structured ciphertext matrices, which encode the validity of a given witness. This shrinks ciphertext sizes considerably compared to previous constructions, but rests on heuristic arguments rather than security reductions.
We describe two attacks against two such constructions, namely the affine determinant program (ADP) construction from 2020 and its arithmetic extension, the AADP, from 2026. The first attack observes that for sparse circuits, the natural regime for both schemes, commutators formed from the public ciphertext matrices have unexpectedly low rank. Elementary linear algebra on these matrices then recovers the encrypted message directly from the public ciphertext, without knowledge of any witness, and hence breaks the security of both schemes. The second attack linearizes the nearly-skew-symmetric (NSS) variant of the ADP construction, recovering the encryption randomness and the message. To our knowledge, ours are the first attacks against these WE candidates, and we verify both in practice.
## 2026/1595
* Title: Budget Allocation in Neural Differential Distinguishers
* Authors: Alireza Gholizadeh Shahrbejari, Reza Ebrahimi Atani
* [Permalink](https://eprint.iacr.org/2026/1595)
* [Download](https://eprint.iacr.org/2026/1595.pdf)
### Abstract
Neural differential distinguishers are usually compared at a fixed number of labeled samples. However, different input representations may require different numbers of ciphertexts per sample, making fixed-sample comparisons potentially misleading from a cryptanalytic data-complexity perspective. In this paper, we study neural differential distinguishers under a fixed ciphertext budget. We ask whether the available encryption queries should be spent on more independent plaintext bases, or on richer samples containing more ciphertext-difference rows.
We introduce a shared-base multi-difference representation in which several input differences are applied around the same plaintext base, and compare it with the standard single-difference baseline and an independent-pair control representation. Experiments on GIFT-64, PRESENT-64, RECTANGLE-64, and SPECK-64/128 show that the single-difference baseline is rarely the best fixed-budget allocation. Adding more difference rows often improves the distinguisher even though it reduces the number of independent training samples. At the same time, the optimal number of rows is not universal: logistic regression often benefits from larger representations, while a multilayer perceptron frequently prefers intermediate values due to sample-starvation and overfitting.
We further test several non-adaptive difference sets and observe that the main trend is not tied to a single hand-picked set. The results suggest that the number of differences per sample should be treated as an explicit design parameter in neural differential cryptanalysis, and that fixed-budget evaluation is necessary for comparing richer neural distinguisher inputs fairly.
## 2026/1596
* Title: Baker: A Privacy-Preserving, NIZK-free and Efficient Payment Channel Hub Supporting Bidirectional Channels
* Authors: Wenjing Li, Zi Li, Yuan Zhang, Sheng Zhong
* [Permalink](https://eprint.iacr.org/2026/1596)
* [Download](https://eprint.iacr.org/2026/1596.pdf)
### Abstract
Payment Channel Hub (PCH) improves blockchain scalability by enabling off-chain transactions via an untrusted intermediary known as the tumbler. However, existing PCHs either fail to guarantee the unlinkability privacy or rely on inefficient non-interactive zero-knowledge (NIZK) proofs. Recently, Ge et al. proposed Accio, a privacy-preserving PCH that eliminates the need for NIZK proofs. Nevertheless, Accio only supports unidirectional channels which results in high on-chain costs and routing inefficiencies. In this paper, we present Baker, the first bidirectional payment channel hub that operates without NIZK proofs and guarantees unlinkability. Unlike prior PCH solutions that maintain channel balance using a single state, Baker introduces a novel design in which each non-tumbler user maintains two separate pockets to record the channel balance. To ensure payment atomicity, Baker further designs a novel cryptographic primitive named Aggregatable Adaptor Signature (AAS) to enable atomic signature exchanges and signature aggregation. We implement Baker and empirically demonstrate its advantages over state-of-the-art protocols. Compared to BlindHub, which relies on NIZK proofs for privacy, Baker reduces off-chain communication overhead to 0.0036%. Moreover, the off-chain computation overhead of Baker is 7% of that of BlindHub and 40% of TBPChannel. Relative to Accio, Baker incurs only 80% of its on-chain cost and enjoys a 25% higher average transaction success rate.
## 2026/1597
* Title: Solving the Shortest Vector Problem in $2^{0.6039n}$ Time via Mid-point Hessian
* Authors: Minki Hhan
* [Permalink](https://eprint.iacr.org/2026/1597)
* [Download](https://eprint.iacr.org/2026/1597.pdf)
### Abstract
We present randomized algorithms for the shortest vector problem (SVP). For the $n$-dimensional lattice $\mathcal L$, our algorithms solve SVP in time $2^{0.6039n+o(n)}$ classically and $2^{0.5411n+o(n)}$ quantumly and space $2^{0.5n+o(n)}$, improving the previous best algorithm running in $2^{n+o(n)}$ time and space of Aggarwal, Dadush, Regev, and Stephens-Davidowitz [STOC'15].
Our algorithms heavily use the property of the Hessian of the periodic Gaussian function at the half shortest vector: For a shortest vector $v \in \mathcal L$, the Hessian at $v/2$ has the eigenvector close to $v$, which can be used to recover $v$ using the (preprocessing) bounded distance decoding algorithm. Given the periodicity modulo $\mathcal L$, the candidate midpoints are indexed by the parity classes in $\mathcal L/2\mathcal L$. Our algorithm searches for the class of a shortest vector by estimating the corresponding Hessians using discrete Gaussian samples.
We optimize the algorithm using random sublattice cosets and various sampling technique, achieving the final complexity. The optimization techniques may be of independent interest.
## 2026/1598
* Title: zk-Cinema: Proving Video Provenance in Zero Knowledge
* Authors: Alexander Frolov, Jianfeng Guo, Xinyi Zhao, Trisha Datta, Dan Boneh, Ian Miers
* [Permalink](https://eprint.iacr.org/2026/1598)
* [Download](https://eprint.iacr.org/2026/1598.pdf)
### Abstract
Video provenance is an important problem on the modern internet.
In response, the Coalition for Content Provenance and Authenticity
(C2PA) has developed a standard for verifying video and image
provenance where cameras sign captured videos with an on-device
secret key. Since videos are generally edited and resized before be-
ing posted, the C2PA signature from a camera cannot be used as is
to verify provenance of published videos. Prior work has developed zero-knowledge techniques for verifying provenance of edited im-
ages and videos. In this work, we develop new efficient techniques
for producing such zero-knowledge proofs. First, we show how to
represent common video edits as matrix multiplications in a form
that is particularly friendly for zero-knowledge provers and enables
a number of optimizations. Second, we develop a SNARK-friendly
video representation, which we call sfvr, that reduces prover work
for video editing. Third, we design new efficient methods for incor-
porating signed data into a SNARK proof. To evaluate our designs,
we built an end-to-end system for proving edits to a signed video.
In our end-to-end system, we optimize the NeutronNova folding
scheme for high-arity folding. To scale the size of our Neutron-
Nova proofs, we implement a rCLRead-Write StreamingrCY version of
NeutronNova to take advantage of high-performance storage and
parallel computing resources. Our system achieves competitive
performance and scale relative to prior work.
## 2026/1599
* Title: One Discrete Gaussian Sample in $2^{n/2+o(n)}$ Time
* Authors: Jiseung Kim
* [Permalink](https://eprint.iacr.org/2026/1599)
* [Download](https://eprint.iacr.org/2026/1599.pdf)
### Abstract
Aggarwal, Dadush, Regev, and Stephens-Davidowitz (ADRS; STOC 2015) sample $2^{n/2}$ discrete Gaussians at an arbitrary parameter in $2^{n+o(n)}$ time, and above smoothing in $2^{n/2+o(n)}$ time. They ask whether the latter bound suffices for one sample at an arbitrary parameter. We answer this question affirmatively: for every rank-$n$ lattice $L\subseteq\R^n$ specified by a rational basis and every rational $s^2>0$, we produce one sample from $D_{L,s}$ within statistical distance $\exp(-\Omega(n^3))$ in expected $2^{n/2+o(n)}$ time and $2^{n/2+o(n)}$ space on every execution. The algorithm samples from random superlattices that are smooth at the required scale with constant probability and outputs the first point in $L$; a Gaussian-mass comparison shows that the $2^{n/2}$ samples produced by one ADRS call contain a point of $L$ with inverse-polynomial probability. The factor $2^{n/2}$ is tight in this Gaussian-mass comparison. For every fixed rational $\alpha<1.4697$, the same comparison gives a sub-$2^n$
algorithm for exact CVP on targets satisfying $\dist(y,L)\le\alpha\lambda_1(L)$, without a uniqueness assumption, and an exact-SVP algorithm in $2^{0.7315n+o(n)}$ time.
## 2026/1600
* Title: Paras: Actively Secure Two-Server Private Histograms
* Authors: Dimitris Mouris, Lucas Piske, Pratik Sarkar, Ni Trieu, Mehmet Ugurbil
* [Permalink](https://eprint.iacr.org/2026/1600)
* [Download](https://eprint.iacr.org/2026/1600.pdf)
### Abstract
Private histogram computation is a fundamental building block for many data analytics tasks, enabling frequency analysis without revealing individual inputs. Existing protocols achieving robustness against malicious clients and servers typically require three servers with limited adversarial tolerance, restricting practicality.
In this work, we present Paras, the first two-server protocol for private histogram computation that achieves robustness against collusion between a malicious server and arbitrarily many malicious clients. Paras builds upon distributed point function-based approaches and introduces novel consistency checks leveraging vector oblivious linear evaluation (VOLE) to enforce both input correctness and output integrity. To realize these checks, we design two new cryptographic primitives: (1) aBV, an authenticated bit verification protocol that ensures VOLE committed shares correspond to valid bits, and (2) adIPA, an authenticated double inner product argument that enables secure consistency checks across two different VOLE sessions. These primitives may be of independent interest for other secure computation tasks.
We show that Paras is highly efficient and scalable: clients incur minimal cost independent of domain size, while servers achieve low per-client runtime, communication, and storage even at scale. For example, with 8192 clients over a domain of 128 inputs, each server requires only 14 ms runtime and 24 KB communication per client.
## 2026/1601
* Title: Power side-channel leakage distinguishers on LESSv2.0 - Exploiting sparse columns in Gaussian Elimination
* Authors: Maciej Czuprynko, Rishub Nagpal, Tobias Schneider, Sujoy Sinha Roy
* [Permalink](https://eprint.iacr.org/2026/1601)
* [Download](https://eprint.iacr.org/2026/1601.pdf)
### Abstract
We present the first passive side-channel distinguisher on LESSv2.0, a second-round candidate in NISTrCOs call for additional post-quantum digital signature schemes. We target the Gaussian elimination at the core of LESS and and present a method to exploit algorithmic leakage arising from the manipulation of sparse versus dense columns.
We show that this leakage, while trivially available in non-constant-time implementations, also persists in constant-time implementations and can be exploited using a distinguisher.
Concretely, the proposed attack relies only on distinguishing zero-valued computations from random ones that are repeatedly evaluated during the computation, leading to a large attack surface and making the attack robust to noise. Through simulation, we experimentally show that the required number of observed signatures lies between 300 and 2357 depending on the parameter set. This relatively large number is due to the targeted information being inherently noisy, leading to a correlation-based key recovery attack, even with noiseless leakage. Furthermore, we discuss three common countermeasures: first-order masking, shuffling and blinding.
Finally, we validate our approach on implementations with and without masking by showing the presence of leakage on a physical target.
## 2026/1602
* Title: New Designs of Multivariate-Polynomial Universal Hash Functions
* Authors: Jean Paul Degabriele, Jan Gilcher, J|-r||me Govinden, Kenneth G. Paterson
* [Permalink](https://eprint.iacr.org/2026/1602)
* [Download](https://eprint.iacr.org/2026/1602.pdf)
### Abstract
Universal hash functions (UHFs) are basic building blocks in cryptography, making the topic of designing secure, fast UHFs of longstanding interest. This paper presents an exploration of the design space for multivariate UHFs, that is UHFs that involve the evaluation of a multivariate polynomial over a finite field. We focus on two-level designs, wherein a lower-level hash function produces intermediate values that are consumed by a higher-level one, and where both hash functions are based on either univariate or multivariate polynomials. This approach allows designs to benefit from the desirable features of both components and thereby strike new trade-offs between key size, security level, and amenability to optimization techniques. We extend the recent UHF code generation and benchmarking framework of Degabriele et al. (IEEE S&P 2024) to accommodate our multivariate designs (and also to support binary field arithmetic). We then use the framework to study the performance of a large collection of new two-level designs. This is done by first conducting a statistical factor analysis to determine which design features (and combinations of those features) most influence performance, and then using it to identify particular combinations of lower-level and higher-level hash functions offering particularly good performance/security trade-offs. We present new designs for both binary and prime fields, at two different security levels (corresponding to roughly 128 and 256 bits of security). Our best designs have performance that significantly outperforms state-of-the-art UHFs in the research literature and as deployed in mainstream cryptography libraries by up to 25%, resulting in 0.3 cycles/byte for 128-bit binary fields. We expect further gains from optimizations such as vectorization, as our benchmarks rely purely on auto-generated code from the extended framework, while state-of-the-art implementations typically use hand-optimized implementation strategies. We conclude with a brief inquiry into the performance implications of employing our best UHF design in the AEAD and Accordion mode designs currently under consideration for standardization by NIST.
## 2026/1603
* Title: Design and Analysis of Quantum Designated Verifier Signature Scheme
* Authors: Shanu Poddar, Vikas Srivastava
* [Permalink](https://eprint.iacr.org/2026/1603)
* [Download](https://eprint.iacr.org/2026/1603.pdf)
### Abstract
Designated Verifier Signatures (DVS) are an important variant of digital signatures that ensure only a specified verifier can validate a signature, while preserving non-transferability. With the advent of quantum computing, several quantum DVS schemes have been proposed to achieve quantum security. In this paper, we revisit the quantum DVS protocol of Xin et al. [Quantum Information Processing, 2022] and provide a structural cryptanalysis of its design. We show that the scheme admits an existential forgery under a chosen-message attack: given a valid quantum signature on one message, an adversary can efficiently transform it into a valid signature on another message without knowledge of the signerrCOs private key. To address this weakness, we propose a minimal countermeasure based on QKD-derived keys and quantum one-time pad encryption.
## 2026/1604
* Title: Algebraic Analysis of Homomorphic Trace Evaluation and Its Applications
* Authors: Han Xia
* [Permalink](https://eprint.iacr.org/2026/1604)
* [Download](https://eprint.iacr.org/2026/1604.pdf)
### Abstract
Field trace evaluation has emerged as a powerful tool in fully homomorphic encryption, with broad applications ranging from bootstrapping algorithms to privacy-preserving protocols. Recent advances have significantly reduced its noise growth by combining tower-based evaluation strategies with rescaling operations. However, existing analyses rely on uniform noise bounds that fail to capture the actual noise behavior across different coefficients, leading to substantial gaps between theoretical estimates and empirical observations.
In this work, we present a refined algebraic analysis of trace evaluation over power-of-two cyclotomics that uncovers structured cancellation effects among noise coefficients induced by subsequent linear operators, in particular the trace mappings of subextensions. We show that, except for the constant term, the variance of each output noise coefficient depends on the 2-adic valuation of its index, yielding bounds that improve upon prior uniform estimates by a factor of $O(\log n)$ both for non-constant coefficients and after a subsequent plaintext-ciphertext multiplication, where $n$ is the ring degree. We further extend our analysis to two typical algorithmic applications of trace evaluation. For ciphertext packing, we derive a non-recursive formulation that admits a cleaner structure and slightly tighter noise estimates. For coefficient extraction, our coefficient-wise analysis improves upon prior uniform variance bounds by factors ranging from $\Theta(n)$ to $\Theta(n^2)$ for non-constant coefficients and by a factor of $O(n)$ after post-multiplication. Experimental results confirm that the observed noise variances follow the coefficient-wise pattern predicted by our analysis and demonstrate pronounced improvements over existing estimates, providing effective guidance for parameter selection and system configuration in practice.
## 2026/1605
* Title: UC, Categorically: Rigorous Diagrammatic Proofs
* Authors: Pooya Farshim, Martti Karvonen, Andre Knispel, Markulf Kohlweiss, Philip Wadler
* [Permalink](https://eprint.iacr.org/2026/1605)
* [Download](https://eprint.iacr.org/2026/1605.pdf)
### Abstract
Category theory is a mathematical theory of composition, widely used in logic, computing, and physics. Here we apply it to give a theory of secure composition. In particular, we provide a categorical treatment of Canetti's Universal Composability (UC) framework for systems with a static number of parties and sessions, often termed UC for static systems, yielding four benefits.
First, we present our results graphically yet retain rigor by applying a standard categorical technique known as string diagrams. In particular, our formulation of the composition theorem can be graphically verified with a short sequence of diagrams, while remaining translatable to equations and amenable to formal verification.
Second, categories let us generalize so that our results extend beyond interactive Turing machines to other forms of computation, such as quantum computation or domain-specific languages.
Third, categories help us drop some unnecessary restrictions of UC (e.g., our adversary can be a computational network rather than a single Turing machine); we prove equivalence between our variant and the usual UC, showing no expressiveness is lost.
Finally, the categorical perspective leads us to identify and correct some minor technical oversights in the standard formulation of simple UC.
## 2026/1606
* Title: Verbeth: Secure Messaging with Metadata Minimization over Public Blockchain Logs
* Authors: Marco Esposito, Andrea Rizzini, Francesco Bruschi, Donatella Sciuto * [Permalink](https://eprint.iacr.org/2026/1606)
* [Download](https://eprint.iacr.org/2026/1606.pdf)
### Abstract
This work presents a private instant messaging protocol that leverages the public log layer of blockchains as the message transport layer, while the cryptographic state is kept only by client applications. Thanks to the properties of public ledgers, this approach achieves strong censorship resistance, while also revealing the economic and cryptographic limits of on-chain messaging. Notably, given the transparency of public ledgers, and since reading and writing operations are in most cases outsourced to third-party providers that may be curious, a well-known concern is direct metadata leakage. We address this both at first contact and during the conversation: for first contact, we propose two alternative discovery mechanisms, one based on long-term key encapsulation with trial decryption, the other on a private signaling service backed by trusted hardware. For the ongoing conversation, we show that topic rotation, driven by the off-chain cryptographic state, suffices to prevent topic and conversation linkability. As our main contribution, we provide an in-depth analysis of Verbeth's metadata leakage under different adversarial assumptions for both phases.
## 2026/1607
* Title: UFOs: A Very Efficient Multivariate Public Key Signature Scheme
* Authors: Gilles Macario-Rat
* [Permalink](https://eprint.iacr.org/2026/1607)
* [Download](https://eprint.iacr.org/2026/1607.pdf)
### Abstract
We present UFOs, a multivariate public-key signature scheme in the Unbalanced Oil and Vinegar (UOV) family. The scheme replaces generic quadratic polynomials with a structured subclass based on Frobenius-type quadratic forms, yielding a compressed public-key representation while retaining the efficient UOV signing procedure. We describe the key-generation, signing, and verification algorithms, and we detail the derivation of the public system from a compact secret description. We discuss security in the standard multivariate setting, including direct algebraic attacks and key-recovery approaches, and we formalize the underlying computational problems induced by the proposed structure. Finally, we report implementation results quantifying the costs of key generation, signing, and verification, as well as the resulting public-key and signature sizes.
## 2026/1608
* Title: Efficient Large-Integer Arithmetic for FHE
* Authors: Ahmad Al Badawi, Andreea Alexandru, Gurgen Arakelov, Charles Gouert, Sergey Gomenyuk, Valentina Kononova, Yark-#n Dor||z, Yuriy Polyakov
* [Permalink](https://eprint.iacr.org/2026/1608)
* [Download](https://eprint.iacr.org/2026/1608.pdf)
### Abstract
Fully Homomorphic Encryption (FHE) has emerged as one of the key technologies for privacy-preserving computation, enabling arbitrary computation directly on encrypted data. Vectorized FHE schemes, such as Brakerski/Fan--Vercauteren (BFV), Brakerski--Gentry--Vaikuntanathan (BGV), and Cheon--Kim--Kim--Song (CKKS), are typically used in applications dealing with large datasets, for example, confidential database queries and private ML inference. These FHE schemes are based on the computational hardness of Ring Learning with Errors (RLWE) and share a common algebraic foundation: arithmetic over high-dimensional polynomial rings with coefficient moduli spanning hundreds or thousands of bits, far exceeding the native arithmetic capabilities of modern processors.
This article surveys the evolution of large-integer arithmetic in RLWE-based FHE libraries, with a focus on the Residue Number System (RNS) techniques used in practically all modern implementations. We give a formal treatment of the two fundamental RNS building blocks --- basis extension and scaling --- that require information about the magnitude of a large value and are therefore incompatible with a purely residue-wise view of arithmetic. We contrast the two principal algorithmic approaches to these operations: the integer-only approach of Bajard, Eynard, Hasan, and Zucca (BEHZ), which tolerates approximation overflows and corrects them with auxiliary redundant moduli, and the floating-point approach of Halevi, Polyakov, and Shoup (HPS). We then show how these primitives compose into the higher-level RNS procedures used across all vectorized RLWE schemes and review how their adoption reshaped the architecture and performance of libraries such as HElib, SEAL, PALISADE/OpenFHE, HEAAN, and Lattigo. We give particular attention to the scaling error inherent in the original Full RNS variant of CKKS, and to the more recent techniques --- reduced-error scaling, composite scaling, and grafting --- that eliminate it or restore flexible, high-precision rescaling from within the residue representation. We also cover GPU-accelerated implementations and close by discussing a renewed, and so far exploratory, interest in positional (non-RNS) representations, raising the question of how such approaches might compare with the Full RNS variants that dominate FHE implementations today.
## 2026/1609
* Title: Distributed Monotone Policy Encryption with Stronger Security for DNFs and Threshold Policies from Lattices
* Authors: Rishab Goyal, Saikumar Yadugiri
* [Permalink](https://eprint.iacr.org/2026/1609)
* [Download](https://eprint.iacr.org/2026/1609.pdf)
### Abstract
Distributed monotone-policy encryption (DPE) lets each user sample and publish its own key, after which anyone can encrypt to a list of published keys under a monotone access policy that determines which coalitions can decrypt. Silent threshold encryption is the $t$-out-of-$N$ special case. What makes the primitive non-trivial is compactness, where the ciphertext stays sublinear in the policy description. Every post-quantum DPE scheme so far settles for selective security, fixing the challenge policy and the corrupted positions before setup, and complexity leveraging cannot close the gap without giving up compactness. The one DPE scheme known in the stronger static model, where the policy and the placement of malicious keys are chosen adaptively, relies on witness encryption (Devadas-Jain-Waters-Wu, Asiacrypt'25).
We give the first statically secure DPE schemes from falsifiable lattice assumptions. For DNF policies, ciphertexts are of size $\mathsf{poly}(\lambda, \log N)$, independent of the number and widths of the clauses, and public keys, secret keys, and partial decryptions are of size $\mathsf{poly}(\lambda)$. For $t$-out-of-$N$ threshold policies, ciphertext of size $\tau^6 \cdot \mathsf{poly}(\lambda)$ for $\tau = \min(t^2, N - t)$, improving to $\tau^2 \cdot \mathsf{poly}(\lambda)$ given a common reference string. We prove security under decomposed LWE, and the improved threshold parameters under succinct LWE, in the random oracle model.
Our constructions generalize the equivocal encryption framework of Goyal-Yadugiri to policies. We define equivocal DPE, which simulates public keys and partial decryptions and withholds the equivocation trapdoor while releasing the public coins that accompany a ciphertext, and compiles to static DPE with no loss in parameters.
## 2026/1610
* Title: Algorithmic Optimization of the Gaussian Sampler in the FN-DSA Post-Quantum Signature Scheme
* Authors: Nicolas HOUL|eS, Thibaut Heckmann
* [Permalink](https://eprint.iacr.org/2026/1610)
* [Download](https://eprint.iacr.org/2026/1610.pdf)
### Abstract
The post-quantum signature scheme Falcon (FN-DSA), currently being standardized by NIST as FIPS 206 (Initial Public Draft submitted August 2025, final standard expected 2026-2027), relies on a discrete Gaussian sampler whose critical bottleneck is the function fpr_expm_p63, computing $\lfloor \exp(-x) \cdot 2^{63} \rfloor$ for $x \in [0, \ln 2)$. While the reference implementation already employs a degree-12 fixed-point polynomial (FACCT), no segmented approximation has been studied for this specific function, nor has empirical timing security been published on ARM Cortex-M3 (emulated or physical).
This paper presents a systematic study of piecewise polynomial approximation applied to fpr_expm_p63, combining the Remez exchange algorithm (computed with 50 decimal digits of precision via mpmath), fixed-point arithmetic, and Horner evaluation. Two configurations are implemented and evaluated: a 32-segment degree-6 approximation at scale $2^{62}$ targeting x86-64, and a 16-segment degree-3 approximation at scale $2^{31}$ (256-byte LUT) targeting ARM Cortex-M3 IoT devices without hardware floating-point unit (FPU).
Against the authentic FACCT reference from Falcon's fpr.c, ported verbatim to ARM Cortex-M3 (emulated via QEMU user-mode with arm-linux-gnueabi -mfloat-abi=soft), our implementation achieves a $1.28\times$ median speedup across 30 independent runs (range $1.24\times$ to $1.33\times$), measured with a rigorous anti-noise protocol combining batch measurement, aggressive warm-up, ref/opt interleaving, and percentile filtering (P5-P95). DUDECT timing leakage tests confirm that both the FACCT reference (t-score $\in [0.05, 2.51]$) and our implementation (t-score $\in [1.99, 5.24]$) remain within statistical safety thresholds in the vast majority of runs (FACCT: 30/30; optimized: 27/30). Static instruction-level analysis via objdump disassembly provides deterministic constant-time evidence: zero data-dependent conditional branches, zero FPU instructions, and zero soft-float calls, yielding a branchless fixed-point Horner core; however, the full constant-time claim is limited to the tested compilation target and memory model.
To the best of our knowledge, this constitutes the first comparative study of segmented versus global polynomial approximation for fpr_expm_p63 in the FN-DSA context, and the first empirical DUDECT measurement of this function on emulated ARM Cortex-M3 against the authentic FACCT reference. Physical hardware validation on STM32F103 is identified as future work.
## 2026/1611
* Title: Private Identity-based Bulletin Boards for Anonymous Messaging and Other Online Services
* Authors: Karim Eldefrawy, Stanislaw Jarecki, Ben Terner, Gene Tsudik
* [Permalink](https://eprint.iacr.org/2026/1611)
* [Download](https://eprint.iacr.org/2026/1611.pdf)
### Abstract
Secure and anonymous messaging has many compelling use-cases and is becoming increasingly
popular. In this paper, we consider it in the context of delay-and-disruption-prone networks, which are characterized by
handicapped network access, disrupted operation, censorship, and intermittent network outages.
With such settings in mind, we define and design a Private Identity-Based Bulletin Board
(PIB^3) scheme, which allows users to anonymously post and retrieve messages to and from a
distributed database, and supports communication between users without pre-established
setup or pre-exchanged keys. Anyone can encrypt a message for an identity and public epoch,
such that only the party with the decryption key for that identity can identify, retrieve,
and decrypt the message. Against one corrupted non-colluding PIB^3 server, the server learns
neither the recipient identity nor the retrieved record indices beyond the leakage explicitly
modeled by the scheme: the public epoch, the database size, and the number of retrievals made
by the receiver. If retrieval-count privacy is required, retrievals can be padded to a fixed
bound. The multi-server construction extends this guarantee to larger server sets, and gives
coalition privacy whenever the underlying multi-server PIR scheme is private against the
corresponding coalition.
Contributions of this work are: (1) formally defining functionality and security requirements
for PIB^3-s, (2) defining and constructing a Hierarchical Identity-based Encryption (HIBE) scheme
with searchable ciphertexts, which serves as a building block for the proposed PIB^3 scheme and may be of independent interest,
(3) designing an efficient PIB^3 scheme that can be realized with $n\geq 2$ servers based on the
HIBE scheme with searchable ciphertexts combined with additional primitives, and (4) implementing
a functional PIB^3 prototype which demonstrates practicality of the entire concept and allows us
to assess its performance empirically.
## 2026/1612
* Title: DYNAFIX: Dynamic FixedrCaPoint Encoding for ArbitraryrCaRange MPC
* Authors: Yuntian Chen, Tianpei Lu, Zhanyong Tang, Bingsheng Zhang, Wenjing Yang, Zhuzhu Wang, Kui Ren
* [Permalink](https://eprint.iacr.org/2026/1612)
* [Download](https://eprint.iacr.org/2026/1612.pdf)
### Abstract
Privacy-preserving computation over real numbers typically employs either floating-point or fixed-point arithmetic. While fixed-point methods are highly efficient, they struggle to handle wide dynamic ranges. Conversely, floating-point methods support a much larger numerical scope but incur overheads more than a hundred times higher than their fixed-point counterparts. In this paper, we propose DYNAFIX, a dynamic fixed-point computation scheme that strikes a balance between floating-point and fixed-point arithmetic. Compared to traditional fixed-point approaches, our scheme supports an arbitrary numerical range; compared to floating-point computation, it maintains performance comparable to fixed-point execution. Experimental results demonstrate that our method achieves a $24.1\times$ speedup over the state-of-the-art when evaluating high-precision functions, such as the exponential function.
## 2026/1613
* Title: DuetORAM: Two-Server Distributed ORAM with Constant Rounds and O(log N) Communication
* Authors: Feng Li, Xiangfu Song, Yingying Li, Lisha Yao, Guomin Yang, Tianwei Zhang, Robert H. Deng
* [Permalink](https://eprint.iacr.org/2026/1613)
* [Download](https://eprint.iacr.org/2026/1613.pdf)
### Abstract
Distributed Oblivious RAM (DORAM) is a promising building block for privacy-preserving cloud databases and outsourced storage systems. However, existing two-server designs often rely on slow linear scans or heavy cryptographic primitives, making them struggle to balance efficiency and bandwidth, and thus hindering their practical deployment.
We present DuetORAM, a two-server DORAM that achieves constant-round access with $O(\log N)$ communication while avoiding these computational bottlenecks. Our key idea is a replicated-to-shared block encoding that allows servers to keep identical ciphertexts for efficient PIR-based retrieval, while locally interpreting them as secret shares to enable oblivious eviction via a lightweight shuffle. We further design a secret-shared shuffle with an offline-online decomposition that shifts most bandwidth-intensive work to a preprocessing phase, significantly reducing online communication. We implement a prototype of DuetORAM and evaluate it under diverse network conditions. Our results show that DuetORAM outperforms both the state-of-the-art two-server scheme DUORAM (reducing retrieval latency by up to 170$\times$ in LAN settings), and three-server design S$^3$ORAM (reducing retrieval latency by 1.7$\times$ in LAN and accelerating eviction by 7$\times$ in LAN and 5$\times$ in WAN, respectively).
## 2026/1614
* Title: LFSRs and Boolean Masking: An In-depth Security Analysis
* Authors: Anna Guinet, Jan Schoone, Niklas H||her, Dina Hesse, Tim G|+neysu
* [Permalink](https://eprint.iacr.org/2026/1614)
* [Download](https://eprint.iacr.org/2026/1614.pdf)
### Abstract
Masking is a widely adopted countermeasure to protect cryptographic implementations from side-channel attacks. Subsequent research has focused on designing masking schemes and formally proving their security, notably through the development of automated tools, within models abstracting the reality of a sidechannel analysis. These designs rely on an external source of randomness; however, there is currently no consensus on the choice of (pseudo-)random number generators for masking. To the best of our knowledge, existing formal proofs for masking security do not consider particular choices of random number generators, but rather assume that they yield uniformly distributed and independent random variables. In that context, we introduce the first verification framework that jointly analyzes a pseudorandom number generatorrCo specifically, but not limited to, a linear feedback shift registerrCoand a masking scheme, in the d-probing model. Our framework relies on the Walsh-Hadamard transform by drawing on techniques from linear cryptanalysis, which we extend to the robust probing model. We demonstrate our method on 4-bit and 8-bit S-boxes, provide a detailed analysis of the formal verification outcomes, and corroborate the findings with practical evaluations on an FPGA.
## 2026/1615
* Title: KORD: Breaking the Key-Generation Bottleneck in Dealerless Function Secret Sharing via ProtocolrCoHardware Co-Design
* Authors: Yijing Peng, Lin Liu, Yujie Xue, Shaojing Fu, Shaoqing Li, Yaohua Wang, Rongmao Chen, Yang Guo
* [Permalink](https://eprint.iacr.org/2026/1615)
* [Download](https://eprint.iacr.org/2026/1615.pdf)
### Abstract
Function secret sharing (FSS) has become a core primitive in privacyrCapreserving computation. However, each FSS invocation requires a fresh pair of function keys, typically produced by a trusted dealerrCoa dependency that expands the system's trust boundary and hinders practical deployment. Existing dealerless protocols eliminate this dependency, but incur substantial communication and a number of interaction rounds that grows linearly with the input bitrCawidth, making key generation a major bottleneck.
This paper presents KORD, a protocolrCohardware corCadesign that dramatically reduces the cost of dealerless FSS key generation. At its core is a pair of chips that establish a common root of trust through mutual attestation and, within it, reconstruct FSS keysrCoeliminating the need for a dealer. This root of trust further forms a security boundary within which KORD restructures the generation protocol, collapsing the interaction of prior dealerless protocols into a single round, independent of GGM depth. A crossrCakey scheduling scheme then interleaves independent GGMrCatree traversals, sustaining high computational throughput. KORD reduces keyrCageneration communication per operation by $7{,}633$rCo$70{,}274\times$ over the staterCaofrCatherCaart distributed FSS protocol. On a ZCU102 FPGA, crossrCakey interleaving lifts AES lane utilization from $8.3\%$ to a boardrCameasured $99.0\%$, for $11.60$ million $32$-bit DPF keys per second at $187.5\,\text{MHz}$ on a $21.5\,\text{K}$ LUT engine ($12.38\,\text{M}$ at the separately validated $200\,\text{MHz}$ operating point). On private ResNetrCa18 inference, key generation's share of endrCatorCaend time falls to $10.1\%$, from $82.6\%$ under a trusted dealer and over $96\%$ under the dealerless baseline.
## 2026/1616
* Title: Flip a Failure into a Success: Improved Bit Flipping Decoding for QC-MDPC Codes
* Authors: Paolo Santini, Davide De Zuane, Alessio Baldelli, Marco Baldi
* [Permalink](https://eprint.iacr.org/2026/1616)
* [Download](https://eprint.iacr.org/2026/1616.pdf)
### Abstract
Quasi-Cyclic Moderate-Density Parity-Check (QC-MDPC) codes are a family of error correcting codes admitting parity-check matrices composed of sparse circulant blocks. QC-MDPC codes have been used for the design of BIKE, one of the finalists in the NIST competition for the standardization of post-quantum cryptography. Decoding of QC-MDPC codes with cryptographically relevant parameters is intrinsically bound to fail, resulting in a decoding failure rate (DFR) that is nonzero. To achieve INDistinguishability under Adaptively Chosen Ciphertext Attacks (IND-CCA2), the DFR must not exceed $2^{-\lambda}$, with $\lambda$ being the security parameter. QC-MDPC codes are customarily decoded with a Bit Flipping (BF) algorithm. Especially at very low DFR values, error patterns having a large intersection with near-codewords (which are vectors corresponding to columns of the parity-check matrix, up to some shift) are the main cause of decoding failures.
In this paper, we show how a BF decoder can be tweaked to exploit the knowledge about near-codewords. Since error vectors that cause decoding failures are likely making the decoder converge to the closest near-codeword (i.e., to the near-codeword with the largest amount of overlapping positions with the error vector), we exploit such a harmful but predictable behavior: we let the decoder recognize, and consequently correct, syndromes of near-codewords. This modification comes with a very mild computational overhead and can be applied to any BF decoder. As a concrete application, we focus on BIKE parameters for NIST security category 1. We show that a recently proposed BF variant called $\textsf{BF}\text{-}\textsf{Max}$ outperforms significantly the two decoders used by BIKE within the NIST competition, achieving a significantly lower DFR with a comparable computational complexity.
## 2026/1617
* Title: Verifiable SelfMix
* Authors: Doron Zarchy
* [Permalink](https://eprint.iacr.org/2026/1617)
* [Download](https://eprint.iacr.org/2026/1617.pdf)
### Abstract
Anonymous communication systems aim to hide which user sent which message. Existing designs span efficient mixnets that rely on at least one honest mix server and decentralized protocols such as Dining Cryptographers networks (DC-nets) or secure multi-party computation (MPC)-based shuffles, which typically require greater communication or interaction. We introduce \emph{verifiable self-mix} (VSM), an anonymity architecture for privately placing messages in a public bulletin-board table. VSM separates oblivious slot allocation from anonymous message placement: \emph{Unique Number Selection} (UNS) assigns each user a distinct hidden location, and \emph{Secure Mapping of Private Permutation} (SMPP) places each encrypted message at its assigned location without revealing the user-to-location mapping. Because each user learns their own final location, VSM provides unconditional individual verifiability after the table is decrypted. We define VSM and prove anonymity, integrity, and self-verifiability in a static malicious model. We instantiate UNS using either trusted hardware or multi-server plaintext-equivalence tests, and SMPP using ElGamal, Boneh--Goh--Nissim (BGN), and a theoretical fully homomorphic encryption (FHE) construction. For $n$ users and $m$ slots, the vector based SMPP constructions require
$O(m)$ ciphertext upload per user and $O(nm)$ public aggregation.
We also present an FHE based variant that reduces the client upload to
$\tilde O(\log m)$ for fixed size messages.
These constructions offer different tradeoffs between trust, communication,
and computation, while preserving the modular structure of VSM and its unconditional individual verifiability.
## 2026/1618
* Title: Two-Limb CRT Ring-LWE Encryption with Exact Decryption and Public Re-randomization
* Authors: Damir Vodenicarevic, Andrei Fleiser, Pierre Seznec, Karen Mayen Naranjo, Lucas Foucher, L|-o Besan|oon, Thybault Alabarbe, Jean-Fran|oois Morcillo, Benjamin Reynes, Lilian Urvoy
* [Permalink](https://eprint.iacr.org/2026/1618)
* [Download](https://eprint.iacr.org/2026/1618.pdf)
### Abstract
Anonymity infrastructures such as mix networks, anonymous storage, and privacy-preserving replication rely on public re-randomization: any party holding only public information can transform a ciphertext into a fresh-looking encryption of the same plaintext, hiding the linkage between the two. Classical ElGamal-based solutions are broken by quantum adversaries, while existing lattice-based alternatives carry very large ciphertexts with unanalyzed noise growth, rely on heavyweight homomorphic-encryption stacks with approximate (rounded) decryption, or lack a precise analysis of how many re-randomizations are safe. We address this gap with a practical Ring Learning with Errors (Ring-LWE) public-key encryption scheme supporting public re-randomization without ciphertext growth. Our construction is LyubashevskyrCoPeikertrCoRegev / FanrCoVercauteren (LPR/BFV)-style encryption over $R=\mathbb{Z}[x]/(x^n+1)$ with $n=4096$, engineered around a two-limb Chinese Remainder Theorem (CRT) modulus $q=t\cdot q_2$ with 32-bit primes. Embedding plaintext as $\Delta M = q_2 M$ makes the message vanish modulo $q_2$, so the $q_2$-limb carries only the decryption noise, enabling exact message recovery without rounding. We prove correctness with explicit decryption-failure bounds that remain valid under repeated re-randomization, via an aggregation lemma showing that arbitrarily many re-randomizations affect decryption only through a single aggregated randomness triple. We also prove that two-limb ciphertexts are pseudorandom (indistinguishable from uniform, IND\$) under Decision Ring-LWE over the combined modulus $q=tq_2$; security against chosen-plaintext attack (IND-CPA) and re-randomization unlinkability follow. A constant-time Rust implementation encrypts in 0.80 ms, re-randomizes in 0.51 ms, and decrypts in 0.21 ms per 64 KiB ciphertext carrying 15.5 KiB of payload on a fixed-frequency 3.8 GHz CPUrCoon par with a modulus-matched Microsoft SEAL baselinerCoand passes timing-leakage tests. Empirical noise simulations validate the analysis.
## 2026/1619
* Title: Relect: Single Secret Leader Election via FHE with Reduced Computation and Communication and Transparent Setup
* Authors: Haofei Liang, Zeyu Liu, Yunhao Wang, Xiang Xie, Yu Yu, Fan Zhang
* [Permalink](https://eprint.iacr.org/2026/1619)
* [Download](https://eprint.iacr.org/2026/1619.pdf)
### Abstract
In a single secret leader election (SSLE) protocol, all parties collectively and obliviously elect one leader. Parties other than the selected leader should not be able to learn the identity of the leader unless it is revealed by the leader itself. The problem is first formalized by Boneh et al. (AFT 2020), and the first concretely feasible lattice-based SSLE with proof-of-concept implementations, $\mathsf{Qelect}$, was recently introduced by Wang and Zhang (USENIX 2025).
In this work, we present $\mathsf{Relect}$, an efficient SSLE protocol, based on the Ring Learning with Error assumption. We build it by leveraging the algebraic structure of the underlying threshold Fully Homomorphic Encryption (FHE) and by designing tailored homomorphic circuits. Compared to prior works, $\mathsf{Relect}$ (1) achieves substantially higher efficiency and (2) removes the strong environment assumption in $\mathsf{Qelect}$ (a trusted setup), and thereby also allows dynamic leader selection for each round.
Concretely, for $32$ -- $2048$ parties, our local FHE computation runtime (a major efficiency bottleneck for SSLE) achieves $7.15$ -- $42.4\times$ faster than $\mathsf{Qelect}$ for a single thread and $7.10$ -- $48\times$ faster for 16 threads. Furthermore, we show that for the same parameters, our communication cost is also $1.14$ -- $2\times$ smaller. As mentioned, this is achieved while removing the trusted setup.
In terms of end-to-end runtime, following $\mathsf{Qelect}$, we tested $2$ -- $128$ parties. We show that under the LAN setting, $\mathsf{Relect}$ is $2.77$ -- $345\times$ faster than $\mathsf{Qelect}$ per round. Under the WAN setting, $\mathsf{Relect}$ is $1.94$ to $17.2\times$ faster than $\mathsf{Qelect}$. Note that these performance gains are all achieved while removing the trusted assumption and achieving dynamic leader selection for each round.
## 2026/1620
* Title: Extending the Applicability of Algebraic Key Recovery Attacks on the UOV Signature Scheme
* Authors: Yasuhiko Ikematsu, Hiroki Furue
* [Permalink](https://eprint.iacr.org/2026/1620)
* [Download](https://eprint.iacr.org/2026/1620.pdf)
### Abstract
The Unbalanced Oil and Vinegar (UOV) scheme was proposed by Kipnis et al. in 1999 as a multivariate signature scheme. Owing to its small signature size and its resistance to various attacks over more than two decades, UOV has become one of the leading candidates in multivariate public key cryptography. In 2025, Ran proposed a novel algebraic key recovery attack exploiting the algebraic structure of UOV, which reduced the security of several parameter sets of UOV and its variants submitted to the second round of the NIST PQC standardization process for additional signatures. This attack was improved by Jin et al., and Furue and Ikematsu, forming a line of attacks that has significantly advanced the cryptanalysis of UOV. However, Ran's attack is applicable only when $v<2m$, where $v$ denotes the number of vinegar variables and $m$ the number of public polynomials. In fact, when $v\ge 2m$, an additional kernel element of the ideal generated by the public polynomials appears, preventing the attack from recovering the oil subspace. A similar issue arises in the improvements by Jin et al., and Furue and Ikematsu. In this paper, we propose a method that overcomes this issue, extending the applicability of this line of attacks to the case where such an additional kernel element appears. Applying our method to SNOVA via the lifting technique of Nakamura et al., we show that the claimed security levels of some parameter sets of SNOVA in the second round of NIST PQC standardization process for additional signatures are reduced. In particular, for the parameter set $(v,o,q,l)=(37,17,16,2)$ of NIST security level I, although Ran's attack is not applicable, our method reduces the estimated security to $2^{103}$ gate operations, which matches the complexity of the attack by Bros et al. in 2026.
## 2026/1621
* Title: Z-SCAPE: Zero-Knowledge Self-Custodial Credential Operation for Privacy-Preserving Asset Protection under Entropy-Source Failure
* Authors: Mehmet Sabir Kiraz, Suleyman Kardas
* [Permalink](https://eprint.iacr.org/2026/1621)
* [Download](https://eprint.iacr.org/2026/1621.pdf)
### Abstract
Motivated by the 2026 COLDCARD incident, this paper studies cryptographic asset recovery after self-custodial seed-generation failures. Self-custodial hardware wallets depend on secure entropy sources for seed generation. If an RNG implementation or design failure reduces seed entropy, an adversary may reconstruct wallet signing keys through offline search. Such weaknesses may also be discovered long after wallet creation, placing existing self-custodial assets at risk. To prevent large-scale exploitation after such a failure is identified, a hardware manufacturer or security response team may perform a protective sweep of affected assets into a protected recovery treasury. Asset redistribution then creates a fundamental authentication problem: once the signing key can be reconstructed by both the legitimate owner and an adversary, possession of that key no longer uniquely identifies the legitimate controller.
We propose Z-SCAPE, a zero-knowledge recovery-credential protocol for privacy-preserving asset recovery after seed-generation failures and protective sweeps. Before compromise, the user commits to a recovery credential consisting of a 256-bit recovery secret $r$ generated from an entropy source intended to be independent of the transaction-signing seed, and an RNG-independent personal record $P$. After an incident, the prover proves knowledge of $(P,r)$ in zero knowledge for the pre-bound wallet identifier $W$, while binding the proof to the incident-specific protected-asset reference, a fresh verifier nonce, an expiry value, and a fresh recovery destination. The verifier derives the protected-asset reference from authenticated protective-transfer records rather than accepting an arbitrary asset set from the claimant. The protocol enables recovery claims without revealing $P$, $r$, or the compromised wallet private keys, while preventing replay, destination substitution, and cross-wallet protected-asset substitution. Z-SCAPE provides concrete integration mechanisms for Bitcoin and Ethereum and enables only assets recorded as protectively transferred from the proved wallet to be returned to the fresh destination bound to an accepted recovery proof.
## 2026/1622
* Title: Formal Security Analysis of the Olvid Messenger
* Authors: Noemi Terzo, Cas Cremers, Ruben Gonzalez, Peter Schwabe, Yuval Yarom, Zhiyuan Zhang
* [Permalink](https://eprint.iacr.org/2026/1622)
* [Download](https://eprint.iacr.org/2026/1622.pdf)
### Abstract
We perform the first formal security analysis of the cryptographic core of Olvid, an end-to-end encrypted messaging app notably used by French government officials, including ministers. Despite its deployment in sensitive contexts and its role in critical communications infrastructure, Olvid's cryptographic security has received little independent analysis. To address this gap, we develop detailed models of Olvid's authenticated key exchange and continuous key agreement protocols. We formally verify that our protocol models achieve security properties such as mutual authentication, session-key secrecy, forward secrecy, and replay protection, under an active Dolev-Yao network adversary model that can compromise parties. While we constructively prove that the protocol design meets core security guarantees, our analysis also reveals that, contrary to its claims, the protocol does not meet strong modern security properties that are met by other state-of-the-art secure-messaging protocols, such as Signal. For example, we show in our formal analysis that Olvid is not secure in modern security models such as eCK. Along the way, we uncover a potential timing leakage, and discuss Olvid's anonymity claims.
## 2026/1623
* Title: Triple Cryptanalysis of Isogeny-Based VRFs from Asiacrypt 2025
* Authors: Yi-Fu Lai, Yu Yu, Xiaogang Zhou
* [Permalink](https://eprint.iacr.org/2026/1623)
* [Download](https://eprint.iacr.org/2026/1623.pdf)
### Abstract
Levin and Pedersen proposed at Asiacrypt2025 a new verifiable random function (VRF) based on a CGL-analogue hash function constructed from radical
isogenies. Their construction applies the same secret radical-CGL walk to a public starting curve and a message-dependent curve, and uses an R1CS proof
relation to show that the two walks use the same secret key.
We present a two-stage attack on this construction. The first stage concerns the unspecified representation of the public key. The reported key size indicates that the public curve is stored as a \(j\)-invariant, whereas both the specified radical-CGL computation use two coefficients to represent a curve.
By exploiting this form we can produce two different VRF outputs under the same public key and message, breaking the unique provability.
Hence, the output of the radical-CGL computation must follow the specification. In the second stage, we exploit these coefficients to recover the VRF secret key. With \(1536\) queries, our implementation recovers the complete \(256\)-bit secret in 30 minutes, thereby breaking residual pseudorandomness. Interestingly, we also observe that the using public key alone without queries can sometimes reveal one or two bits of the secret walk.
Besides, we extend Lai's observation to obtain a one-query attack on the group-action-based VRF proposed in the same paper with advantage closed to 1/2. Together, these constitute three attacks on their work.
## 2026/1624
* Title: Code Generation of Faster Formally Verified NTT with Plantard Reduction
* Authors: Donnie Y. Xu, Rajeev Gore, Amin Sakzad, Ron Steinfeld, Raymond K. Zhao
* [Permalink](https://eprint.iacr.org/2026/1624)
* [Download](https://eprint.iacr.org/2026/1624.pdf)
### Abstract
We present a formally verified implementation of the ML-KEM Number-Theoretic Transform (NTT) based on Plantard arithmetic, produced via a code generator that targets ML-KEM, ML-DSA, and FN-DSA from a single parameter triple. The generator embeds a static bound analyzer that places modular reductions at code-generation time without runtime branching, eliminating per-scheme manual tuning while preserving constant-time guarantees. Each generation produces structurally identical implementations in two backends: portable C, and Jasmin for formal verification. To establish end-to-end correctness, we contribute a parametric formalization of Plantard arithmetic in \textsc{EasyCrypt} and a layer-by-layer program-equivalence proof connecting the extracted Jasmin ML-KEM NTT to the abstract specification of formosa-mlkem; the existing algebraic chain is reused unchanged to extend correctness down to the mathematical NTT definition. Benchmarks across three schemes show that the generated code outperforms reference C by $1.5\times$--$1.8\times$ on the forward NTT and $1.7\times$--$2.5\times$ on the inverse, and outperforms the formally verified formosa-mlkem Jasmin baseline by $1.26\times$ and $2.19\times$ on ML-KEM. We believe our techniques generalize to other lattice-arithmetic primitives requiring both performance and formal verification.
## 2026/1625
* Title: AES-Based Grinding for MPC-in-the-Head Signatures
* Authors: Matthieu Rivain
* [Permalink](https://eprint.iacr.org/2026/1625)
* [Download](https://eprint.iacr.org/2026/1625.pdf)
### Abstract
Grinding is a technique which introduces a proof of work into the Fiat-Shamir transform: by constraining the challenge to satisfy a $w$-bit condition, forging a proof requires about $2^w/\varepsilon$ evaluations of the hash function instead of $1/\varepsilon$, where $\varepsilon$ is the soundness error of the underlying protocol. This allows one to select reduced parameters, yielding shorter proofs and signatures. Grinding is used in FAEST, MQOM and SDitH, the three MPC-in-the-Head schemes selected for the third round of the NIST additional post-quantum signature standardization process, where it is instantiated with Keccak. In this short paper, we investigate grinding schemes in which the proof of work is expressed in terms of block cipher computations, specifically AES, which is significantly faster than Keccak on modern CPUs, is already a building block of these schemes, and underlies the very definition of the NIST security categories. We formalize the notion of grinding scheme together with a protocol-agnostic security notion, we propose a construction performing two cipher calls per iteration, and we prove, in the ideal cipher and random oracle models, that an adversary making $Q_E$ cipher queries breaks it with probability at most $\frac{4}{3} \cdot \varepsilon\, Q_E / 2^w$, up to negligible terms. We further generalize the scheme to use more cipher calls per iteration, which makes the constant $\frac43$ tend to $1$.
## 2026/1626
* Title: Adaptive-Input-Secure Updatable Private Set Union
* Authors: Seongbong Choi, Jiseung Kim, Hyung Tae Lee
* [Permalink](https://eprint.iacr.org/2026/1626)
* [Download](https://eprint.iacr.org/2026/1626.pdf)
### Abstract
In multi-epoch deployments, private set union~(PSU) operates in an adaptive-input loop: after observing the union at epoch $t$, the receiver may choose its next input for epoch $t+1$. Liu et al.~(EUROCRYPT 2026) formalized this multi-epoch adaptive-input setting for updatable private set intersection and provided an instantiation,
but their framework does not extend to PSU. Meanwhile, existing PSU protocols are analyzed only in the single-shot setting.
We present the first semi-honest, adaptive-input-secure updatable PSU protocol supporting two-sided add/delete updates in the multi-epoch adaptive-input setting of Liu et al. Our construction is built around a new primitive, the updatable oblivious key-value store (uOKVS). Its defining rule, distributional erasure, requires each refresh to be distributed identically to a fresh static encoding of the current key set, rather than merely indistinguishably. We realize uOKVS by combining the Band-OKVS of Bienstock et al. with a PRF under a persistent key. The resulting refresh reuses a cached factorization, so its per-epoch encoding cost scales linearly rather than quadratically in the band width $w$. Building on this layer, we obtain a multi-epoch PSU protocol whose leakage is limited to set and update cardinalities, even against adaptive-input adversaries. We implement the protocol and benchmark it in a single-threaded setting. At $n = 2^{20}$ with per-epoch updates $\Delta = 55$ over $10$ epochs, the online per-epoch wall-clock time is $1.41$ s on LAN, yielding a $30.9\times$--$98.9\times$ speedup over prior static PSU protocols re-executed from scratch at each epoch.
## 2026/1627
* Title: Adaptively Secure Threshold Decryption from LWE with Polynomial Modulus
* Authors: Yunxin Zhang, Yunxiao Zhou, Shuai Han, Shengli Liu, Xinyi Huang
* [Permalink](https://eprint.iacr.org/2026/1627)
* [Download](https://eprint.iacr.org/2026/1627.pdf)
### Abstract
Threshold Decyption (TD) enables a set of decryptors, each holding a secret key share, to collaboratively decrypt ciphertexts. Lots of TD schemes consider only CPA security under static corruptions, but a stronger and more reasonable security notion in practice is CCA security under adaptive corruptions, which enhances the ability of adversaries to obtain partial decryptions of chosen ciphertexts and adaptively corrupt decryptors during the protocol. There are many works on TD from lattices, seeking for post-quantum security. However, none of these TD schemes achieves both adaptive security (i.e., security under adaptive corruptions) and polynomially-bounded modulus in lattices. Given the fact that polynomial modulus provides more post-quantum confidence than super-poly modulus, Devevey et al. [PKC 2021] left constructing an adaptively secure TD with polynomial modulus from lattices as an open problem.
In this paper, we resolve the above open problem by proposing three adaptively secure (t,N)-TD schemes based on the LWE assumption, all with polynomial modulus under appropriate settings.
- TD0: an adaptively CPA-secure scheme in the asynchronous setting in the standard model, whose modulus is polynomial for small number of users N.
- TD1: an adaptively CCA-secure scheme in the asynchronous setting in the standard model, whose modulus is polynomial for small N and bounded decryption queries.
- TD2: an adaptively CCA-secure scheme in the synchronous setting in the random oracle (RO) model, whose modulus is polynomial for bounded decryption queries.
The main technical challenge is to limit the leakage of secret key shares arising from decryption queries, while keeping the modulus a polynomial. To overcome this barrier, we develop a refined polynomial noise flooding technique based on a detailed min-entropy analysis of secret shares conditioned on linear matrix hints, leveraging recent advances on Matrix-Hint LWE. Based on our new technique, we build TD1 using the replicated secret sharing (RSS) scheme, hence supporting only small N. To enable larger N, we design TD2 using the Shamir secret sharing scheme, in which we further integrate our new technique with the zero-sum masking technique [Katsumata et al., CRYPTO 2024] to restrict the secret key leakage. To the best of our knowledge, our TD1 and TD2 are the first non-interactive lattice-based threshold decryption schemes achieving adaptive CCA security and polynomial modulus, simultaneously. Moreover, they achieve the strongest notion of adaptive CCA security among those compared in [Brzuska et al., PKC 2026]. We further establish robustness for both TD0 and TD1 via publicly verifiable partial decryptions, ensuring that the combination either outputs the correct plaintext or aborts.
## 2026/1628
* Title: Lattice-based Signature Schemes for Bitcoin
* Authors: Dmytro Zakharov, Mikhail Kudinov, Viktoria Balatska, Yaroslava Chopa * [Permalink](https://eprint.iacr.org/2026/1628)
* [Download](https://eprint.iacr.org/2026/1628.pdf)
### Abstract
Lattice-based cryptography offers a promising direction for transitioning Bitcoin toward post-quantum security, serving as a secure replacement for currently deployed discrete logarithm signatures. The primary advantages of lattice-based signature schemes include the compact combined size of signatures and public keys (e.g., in some cases below 1.6 KB), the robustness of underlying security assumptions, and an algebraic structure that, while not yet yielding practical constructions, holds potential for advanced functionality such as threshold and multi-signatures, compared to hash-based constructions. In this paper, we present a self-contained review of three lattice-based signature schemes, with Bitcoin's post-quantum transition as the motivating application: Dilithium, Falcon, and Hawk. The latter was recently withdrawn from NIST standardization following a key-recovery attack; we retain it because its design paradigm remains of independent interest. For each protocol, we detail the high-level intuition, the necessary technical preliminaries, low-level mechanics, performance, and security analysis. We then assess the deployment aspects relevant to Bitcoin: the on-chain footprint, determined by the combined public-key and signature size and compared against hash-based alternatives; the target security level for outputs that may remain unspent for decades; implementation constraints, such as Falcon's floating-point signing; and wallet key derivation.
No prior exposure to lattice-based cryptography is assumed: all the required background is developed within the document.
## 2026/1629
* Title: When Does Being Selfish Pay Off? Temporal Composability and Profitability in Selfish Mining
* Authors: Colin Finkbeiner, Connor Shaw, Ghada Almashaqbeh
* [Permalink](https://eprint.iacr.org/2026/1629)
* [Download](https://eprint.iacr.org/2026/1629.pdf)
### Abstract
Selfish mining undermines incentive compatibility of proof-of-work blockchains, letting a miner earn disproportionate rewards at a hashrate lower than the majority threshold. A decade of work has asked whether a strategy is profitable, however, far less is understood about when it becomes profitable. Timing is critical since selfish mining operates at a loss before it turns a profit, typically requiring tens of weeks to break even in the classic case.
In this paper, we present a holistic study of the time-to-profitability (TTP) of existing selfish mining strategies structured around four contributions. First, in the single-attacker setting, we characterize TTP across the full strategy space and find that TTP-minimizing and profit-maximizing strategies frequently diverge, making attack horizon a critical metric. In particular, under realistic fee dynamics, the use of incentive transactions to recruit honest-but-rational miners enable incentivized strategies to reach profitability up to $15\times$ faster than classic selfish mining at the same hash rate. Second, we explore TTP for the first time in the multi-attacker setting, showing that the difference in strategies between opposing attackers has a dramatic impact on joint-profitability lag. Third, we generalize intermittent selfish mining by exploring temporal composition over the full strategy space and show that its purported benefits are largely overstated. That is, alternating strategies rarely outperform the best static strategy in terms of either TTP or long-term profits.

Finally, and building off our earlier findings, we explore adaptive, state-conditioned strategy selection at the difficulty adjustment period (DAP) level. We compare a general-purpose LLM agent against a fixed decision-tree selector, both implementing the same selection criteria. We find that both selectors reliably identify profit-maximizing strategies from observed network conditions, at a low operating cost, lowering the expertise barrier to exploiting adaptive selfish mining.
## 2026/1630
* Title: Quasipolynomial Cryptanalysis of the McEliece Cryptosystem (or: PIR Meets McEliece)
* Authors: Ashrujit Ghoshal, Yuval Ishai, Aayush Jain, Nuozhou Sun
* [Permalink](https://eprint.iacr.org/2026/1630)
* [Download](https://eprint.iacr.org/2026/1630.pdf)
### Abstract
The McEliece code-based cryptosystem, utilizing binary Goppa codes, is the earliest public-key encryption scheme that is still considered post-quantum secure. We present a simple, classical quasipolynomial-time distinguisher for Goppa--McEliece in the asymptotic "Classic McEliece" regime: for code length $n$, extension degree $m=\Theta(\log n)$, Goppa degree $t=\Theta(n/\log n)$, and public-code dimension $k=\Theta(n)$, the algorithm runs in time $n^{{\mathcal O}(\log n)}$ and distinguishes the McEliece public key from the uniform distribution over $\mathbb F_2^{k\times n}$ with advantage $1-o(1)$. The distinguisher is not merely asymptotic: it applies to all Classic McEliece parameter sets considered in the NIST process and yields improved (though not yet practical) concrete attack estimates.
Our distinguishing attack originated from a failed attempt to construct doubly efficient private information retrieval (PIR) protocols from algebraic locally decodable codes, and can be intuitively explained from the PIR perspective. We extend this provable algorithm to a heuristic $n^{{\mathcal O}(\log n)}$-time ciphertext-decryption attack that recovers the message from a noisy codeword.
## 2026/1631
* Title: Preprocessed Private Function Evaluation: Achieving Sublinear Online Complexity for Lookup Tables
* Authors: Tanping Zhou, Xiaoyi Wang, Yi Qu, Wenchao Liu, Long Chen, Zhenfeng Zhang
* [Permalink](https://eprint.iacr.org/2026/1631)
* [Download](https://eprint.iacr.org/2026/1631.pdf)
### Abstract
Private Function Evaluation (PFE) facilitates the secure computation of private functions on private inputs in an oblivious manner, ensuring that both the function and the inputs remain confidential throughout the entire computational process. PFE has garnered significant attention due to its critical applications in various domains, such as privacy-preserving healthcare systems and privacy-preserving credit checks, where safeguarding the confidentiality of the function itself is of paramount importance.
However, despite its broad applicability, existing PFE schemes often exhibit inefficiencies, even in relatively straightforward scenarios such as the evaluation of lookup tables. To mitigate these limitations, we propose a novel variant of PFE, termed Preprocessed Private Function Evaluation (PPFE), which leverages preprocessing techniques to significantly enhance the efficiency of online computations. Within this framework, we introduce a specialized construction tailored specifically for lookup table operations, achieving sublinear complexity during the online computation phase.
The efficacy of the proposed approach is demonstrated through experimental evaluations. For a lookup table of size $2^{24}$, the online computation time required to process a single query is about 3 milliseconds, representing a performance improvement of more than an order of magnitude compared to existing results. Furthermore, the proposed scheme exhibits strong scalability, effectively handling thousands of adaptive queries within the same framework.
--- Synchronet 3.22a-Linux NewsLink 1.2