From Newsgroup: sci.crypt

## In this issue
1. [2025/365] Lattice-Based Updatable Public-Key Encryption for ...
2. [2025/1829] On the Limits of Consensus under Dynamic ...
3. [2026/16] Aborting Random Oracles: How to Build them, How to ...
4. [2026/313] Weak-Key Classes and Key Recovery in Key-Then-Hash ...
5. [2026/346] Lighthouse: Single-Server Secure Aggregation with ...
6. [2026/1189] Do You Need a Receipt? Anonymous Credential ...
7. [2026/1206] Scalable, quantum-accessible, and adaptive ...
8. [2026/1554] On the Hardness of some Vandermonde Knapsack problems
9. [2026/1556] Breaking the Beyond-Birthday-Bound Security of ...
10. [2026/1581] Post-Quantum Internet Key Exchange via ...
11. [2026/1638] Anamorphic Messaging: Analyzing the Double Ratchet, ...
12. [2026/1640] Qlapoti+ and More: Optimizing Isogeny-based Signatures
13. [2026/1642] A Torus-Structured Generalisation of NTRU: the NTC ...
14. [2026/1647] Information-Theoretic SFE and PFE with Reduced ...
15. [2026/1650] D-James: Ultra Short Multivariate Signatures
16. [2026/1651] Single-Server Verifiable PIR with Updates and ...
17. [2026/1652] On the Security of In-band Verification in End-to- ...
18. [2026/1653] Lumora: A Family of Permutation-Based Wide-Block ...
19. [2026/1654] Verifpal Seven Years Later: Can a Toy Become an ...
20. [2026/1655] Hardness of Euclidean Closest Vector within ...
21. [2026/1656] BinarySpartan: Spartan over binary fields
22. [2026/1657] Ideal Pseudorandom Code, Revisited
23. [2026/1658] Upper bounds for failure probabilities of ...
24. [2026/1659] Efficient Transaction Traceability for Auditable ...
25. [2026/1660] Transient Quantum Resistance, with Application to ...
26. [2026/1661] MKA Meets Multidrop: Optimizing Time-to-Key- ...
27. [2026/1662] Degree-Sum-Freedom Is Not EA Invariant: Exact ...
28. [2026/1663] Five-Bit Axial Subspace Differential Uniformity: ...
29. [2026/1664] Trace-Moment Canonicalization for Average-Case ...
30. [2026/1665] Nullity-One Canonicalization for Average-Case ...
31. [2026/1666] Rate-Limiting Nullifiers for Gasless Sequencer ...
32. [2026/1667] Resolving the Complexity of Linear Secret Sharing
33. [2026/1668] A Key-Recovery Attack on TALUS-MPC in TALUS v4
34. [2026/1669] Quantum Advantage for Two-Party Differential Privacy
35. [2026/1670] RSS: Robust Signing Service using Threshold ...
36. [2026/1671] Verified Pythagorean Composition for Adaptive ...
37. [2026/1672] AFS: A Family of ARX-Based Large-State S-boxes with ...
38. [2026/1673] Linearly Homomorphic Secret Sharing and Multi-Party ...
39. [2026/1674] MinMandate: Private Task-Scoped Payment ...
40. [2026/1675] SparseMPC: Secure Sparse Operations using Multi- ...
41. [2026/1676] Simple and Efficient SKL-IBE with Classical ...
42. [2026/1677] Fair-Weather No More: Guaranteed Efficiency in ...
43. [2026/1678] Cryptanalytic Extraction of Multi-Head Softmax ...
44. [2026/1679] Critical-Round Special Soundness for Multi-Round Proofs
45. [2026/1680] New Results on the Density of Irreducible NFSRs
46. [2026/1681] Aegon: Self-Auditable Key Transparency
47. [2026/1682] Incomplete Ciphertext Comparison in ML-KEM: From an ...
48. [2026/1683] Fully-Succinct Multi-Key FHE & Rate-1 Simulatable ...
49. [2026/1684] Non-Interactive Translation of Winternitz ...
50. [2026/1685] Pruning Merkle-Tree Consistent Accumulator
51. [2026/1686] A Unifying Umbrella for Circular-Secure ...
52. [2026/1687] Theoretical Open Problems in Symmetric ...
53. [2026/1688] HellrCOs Bells: A Neural Network Pipeline for Ternary ...
54. [2026/1689] A Hybrid Post-Quantum Encryption Architecture with ...
55. [2026/1690] Concurrently Secure Compact Blind Signatures from ...
56. [2026/1691] Equivalence Between Average-Case Hardness of ...
57. [2026/1692] From Round Skipping to S-Box Skipping: Attacking ...
58. [2026/1693] The ePrint:2026/1591 Quantum Algorithm Does Not ...
59. [2026/1694] Relations Between the Uniform MQ Assumption and ...
60. [2026/1695] On the Impossibility of Robust Combiners for ...
61. [2026/1696] Toward Secure Compilation: Leakage Detection for ...
62. [2026/1697] Actively Secure Two-Party Function Secret Sharing ...
63. [2026/1698] MamaBearZKP: A Holistic Co-design of Prime Fields ...
64. [2026/1699] DumboMix: Robust Asynchronous Anonymous Broadcast ...
65. [2026/1700] Qlapoty: Improved analysis and eN4aciency for ...
66. [2026/1701] DTRU: A Versatile, Compact, Simple, and Robust NTRU ...
## 2025/365
* Title: Lattice-Based Updatable Public-Key Encryption for Group Messaging
* Authors: Jo|2l Alwen, Georg Fuchsbauer, Marta Mularczyk, Doreen Riepel
* [Permalink](https://eprint.iacr.org/2025/365)
* [Download](https://eprint.iacr.org/2025/365.pdf)
### Abstract
Updatable Public-Key Encryption (UPKE) augments the security of PKE with Forward Secrecy properties. While requiring more coordination between parties, UPKE enables much more efficient constructions than full-fledged Forward-Secret PKE. Alwen, Fuchsbauer and Mularczyk (AFM, EurocryptrCO24) presented the strongest security notion to date. It is the first to meet the needs of UPKErCOs most important applications: Secure Group Messaging and Continuous Group Key Agreement. The authors provide a very efficient construction of an Updatable Key Encapsulation Mechanism (UKEM), implying UPKE, that satisfies their notion with classic security based on the Computational Diffie-Hellman (CDH) assumption in the Random Oracle Model (ROM).
No existing post-quantum UPKE/UKEM construction is known to meet the AFM definition. We present and implement practical secret-key recovery attacks in the AFM adversarial model for all proposed parameter sets of two PQ schemes including the most efficient one to date, due to Abou Haidar, Passel|?gue and Stehl|- (APS, AsiacryptrCO23). If the UKEM schemes were used in a real-world group messaging application, the attacks would correspond to realistic execution scenarios, even when targeting a 100% success probability.
Next, we present the first post-quantum UKEM construction meeting (a slight relaxation of) the AFM security notion. When based on the Module-LWE assumption, our construction is more efficient than prior PQ constructions, while achieving stronger security. More concretely, public key sizes are about 1/2 that of APS and ciphertext sizes are about 14% smaller. As the AFM security proof relies on random self-reducibility of CDH, which has no analogue for lattices, we develop a new proof technique for strong UKEM, identifying the core properties required from the underlying (lattice-based) encryption scheme.
## 2025/1829
* Title: On the Limits of Consensus under Dynamic Availability and Reconfiguration
* Authors: Javier Nieto, Joachim Neu, Ling Ren
* [Permalink](https://eprint.iacr.org/2025/1829)
* [Download](https://eprint.iacr.org/2025/1829.pdf)
### Abstract
Proof-of-stake blockchains require consensus protocols that support Dynamic Availability and Reconfiguration (which we call the DAR model). Here, Dynamic Availability means that the consensus protocol should remain live even if a large number of nodes temporarily crash, and Reconfiguration means it should be possible to change the set of operating nodes over time. State-of-the-art protocols inspired by the DAR model, such as Ethereum, Cardano's Ouroboros, or Snow White, require additional model features comprising external mechanisms or node capabilities that are difficult to justify, such as social consensus or the requirement that key evolution be performed even when nodes have crashed. The key result of this paper is the necessary and sufficient adversarial condition under which consensus can be achieved in the plain DAR model, without any extra features. We then introduce an additional feature to the model that is justified by proof-of-stake blockchain designs: honest nodes complete a sign-off procedure the moment they express intent to exit from the set of operating nodes. This additional feature reduces the power of the adversary relative to the plain DAR model and helps us obtain a bootstrapping gadget that is particularly simple and efficient in the common optimistic case of few reconfigurations and no double spending.
## 2026/16
* Title: Aborting Random Oracles: How to Build them, How to Use them
* Authors: Gottfried Herold, Dmitry Khovratovich, Mikhail Kudinov, Stefano Tessaro, Benedikt Wagner
* [Permalink](https://eprint.iacr.org/2026/016)
* [Download](https://eprint.iacr.org/2026/016.pdf)
### Abstract
In this work, we initiate the study of aborting hash functions, i.e., hash functions that may abort on a non-negligible fraction of inputs. We introduce the aborting random oracle model (aROM), an idealized framework that extends the standard random oracle model (ROM) to account for aborts. Within this model, we derive bounds for various security notions and establish generic indifferentiability results demonstrating how to construct aborting random oracles from standard ones.
Consequently, the derived bounds ultimately hold in the standard ROM. In this way, the aROM and its associated bounds provide a convenient and easy-to-use framework for analyzing cryptographic constructions that rely on potentially aborting hash functions.
To illustrate the utility of our framework, we apply our techniques to two settings: (1) the analysis of SNARK-friendly incomparable hypercube encodings, a core primitive in hash-based signature schemes, and (2) the analysis of grinding in FiatrCoShamir-based non-interactive arguments. Through our generic indifferentiability results, we can easily translate these analyses into concrete security bounds in the standard (non-aborting) random oracle model.
## 2026/313
* Title: Weak-Key Classes and Key Recovery in Key-Then-Hash Functions
* Authors: Jonathan Fuchs
* [Permalink](https://eprint.iacr.org/2026/313)
* [Download](https://eprint.iacr.org/2026/313.pdf)
### Abstract
Handschuh and Preneel define a weak-key class by rCLunexpectedrCY security behavior and efficient detection of class membership. Four families in their CRYPTO 2008 analysis, NH, NMH, WH, and Square Hash, fall within the later key-then-hash (KTH) formalism. For the controlled collision and fixed-difference attacks considered here, KTH offset-invariance shows that any nonempty solution set can be translated to contain any chosen absolute key while preserving its size, success probability, and the number and type of oracle queries. The exceptional behavior therefore cannot be attributed to particular absolute key values. The relative size of a solution set is exactly the corresponding collision or fixed-difference probability, which universality bounds.
This does not make the attacks harmless. A successful controlled differential restricts the reusable key to a known solution set. If the current transcript leaves candidate set $C$ and a later test has solution set $S'$, then its conditional success probability is $\#(C\cap S')/\#C$. Balanced intersections are information-theoretically optimal. Fixed-factor reductions give logarithmic recovery when realizable, while KTH translation alone gives an at-most-linear sequence of refinement tests up to translation symmetries.
We give localization mechanisms for the serial and parallel KTH constructions and a WegmanrCoCarterrCoShoup key-recovery attack on Serial instantiated with three-round Xoodoo. The attack completely recovers one reusable $384$-bit KTH key block. Published three-round Xoodoo differential trail cores and DaemenrCOs affine derivative analysis of the Xoodoo -c layer turn successful endpoint differentials into equations on the keyed state. Two suitable trails recover six complete three-bit columns, and $32$ cyclic translations recover all $384$ bits. When every trial uses a newly authenticated reference message, the attack requires $2^{42}$ expected differential trials, or about $2^{43}$ MAC-oracle calls. The target is Serial instantiated with three-round Xoodoo under Wegman-Carter-Shoup authentication, not Xoofff or six-round Xoodoo.
## 2026/346
* Title: Lighthouse: Single-Server Secure Aggregation with O(1) Server-Committee Communication at Scale
* Authors: Sanjam Garg, Alireza Kavousi, Dimitris Kolonelos, Erkan Tairi, Zhipeng Wang
* [Permalink](https://eprint.iacr.org/2026/346)
* [Download](https://eprint.iacr.org/2026/346.pdf)
### Abstract
Secure aggregation is a core primitive for privacy-preserving federated learning, enabling a server to compute aggregates of client updates without learning individual inputs. Recent protocols have explored committee-based designs to reduce client overhead and tolerate weakly connected participants. However, existing approaches still incur communication and computation costs that scale with the number of clients and/or the size of model updates. This becomes a serious bottleneck in interaction between the server and the committee, given that model updates are high-dimensional and the committee is a small set of clients.
We present Lighthouse, a new secure aggregation protocol that supports one-shot client communication and achieves constant committee computation and communication overhead with the server, independent of both the number of clients and the size of the input vector. Our protocol attains the best-known round complexity of two rounds, matching OPA (CRYPTO 2025) and TACITA (ePrint 2025) and improving upon Flamingo (IEEE S&P 2023) and Willow (CRYPTO 2025). Our core technical contribution is a novel application of recent advances in batched threshold encryption, which enables succinct serverrCocommittee interaction while preserving security and correctness. Beyond asymptotic improvements over prior works, Lighthouse yields substantial concrete efficiency gains: For an aggregation with 1024 clients, we reduce server-to-committee communication by over 100|u and committee-to-server communication by over 300|u compared to Flamingo and Willow. Also, we present an extension that supports dynamic client participation, a critical requirement for practical deployments at scale, while preserving the asymptotic and concrete efficiency of the static protocol for clients.
## 2026/1189
* Title: Do You Need a Receipt? Anonymous Credential Revocation at Continental Scale via Private Record Certification
* Authors: Kasra Edalatnejad, Sebastian Faust, Jonas Hofmann, Philipp-Florens Lehwalder, Thomas Schneider
* [Permalink](https://eprint.iacr.org/2026/1189)
* [Download](https://eprint.iacr.org/2026/1189.pdf)
### Abstract
A key challenge in digital credential systems is revocation, that is, the ability to revoke credentials post-issuance and verify their status upon presentation. While anonymous credentials enhance privacy over classical credentials (e.g., by providing unlinkability), they complicate revocation. Existing revocation schemes for anonymous credentials often suffer from high client or verifier computation, long delays before revocation takes effect (e.g., epoch-based settings), or require updates to all users with each revocation. We present an efficient, real-time revocation system for anonymous credentials with decentralized revocation authorities based on a novel primitive called Private Record Certification (PRC). PRC enables users to obtain a certificate for a record stored in a server-managed database without the servers learning which record was requested. This primitive is of independent interest, and we construct it by combining techniques from private information retrieval and secure multi-party computation. Our revocation scheme outsources its costs to the revocation authorities and has minimal overhead for clients and verifiers, while ensuring the communication costs are sublinear in the number of credentials for the revocation authorities. We build a prototype and demonstrate that our system achieves sub-second real-time latency at a scale of over 1 billion credentials, with an online operational cost of 2.5$ per server for processing 1 million PRC queries.
## 2026/1206
* Title: Scalable, quantum-accessible, and adaptive pseudorandom quantum state and pseudorandom function-like quantum state generators
* Authors: Rishabh Batra, Zhili Chen, Rahul Jain, YaoNan Zhang
* [Permalink](https://eprint.iacr.org/2026/1206)
* [Download](https://eprint.iacr.org/2026/1206.pdf)
### Abstract
We show new constructions for pseudorandom quantum states (PRS) and pseudorandom function-like quantum state (PRFS) generators satisfying scalability, which means the security parameter can be much larger than the number of qubits, quantum accessibility, which means the adversary can provide quantum input,
and adaptivity, which means the adversary can query it adaptively.
We present an isometric procedure to prepare quantum states that can be arbitrarily random (i.e., the trace distance from the Haar-random state can be arbitrarily small for the true random case, or the distinguishing advantage can be arbitrarily small for the pseudorandom case). This naturally gives the first construction for scalable, quantum-accessible, and adaptive PRFS assuming quantum-secure one-way functions. Compared to prior PRFS works, we use a stronger definition of quantum accessibility in which the adversary can be ancilla-assisted, i.e., the input state may not be pure and could be entangled with other quantum registers. Thus, our result also gives the first (fully) quantum-accessible PRFS.
Our PRFS construction implies various primitives, including long-input PRFS, short-input PRFS, short-output PRFS, non-adaptive PRFS, and classically-accessible adaptive PRFS. This new construction may be helpful in simplifying the microcrypt zoo.
## 2026/1554
* Title: On the Hardness of some Vandermonde Knapsack problems
* Authors: Dipayan Das, Arindam Mukherjee
* [Permalink](https://eprint.iacr.org/2026/1554)
* [Download](https://eprint.iacr.org/2026/1554.pdf)
### Abstract
The Vandermonde Knapsack problem comprises a family of algebraic variants of the Knapsack problem. This includes the Partial Vandermonde $(\mathsf{PV})$ Knapsack problem (DCCrCO15, ACNSrCO14, ACISPrCO18, DCCrCO20, Indocrypt'25), the Vanishing $\mathsf{SIS}$ $(\mathsf{vSIS})$-based commitment problem (CryptorCO23, PKC'25), and related assumptions. These problems have played an important role in enabling efficient lattice-based cryptographic constructions.
Recently, two independent works by Boudgoust, Gachon, and Pellet-Mary (CryptorCO22), and by Das and Joux (EurocryptrCO24), proposed attacks demonstrating that certain instances of the $\mathsf{PV}$ Knapsack problem are weak. In this paper, we present new attacks on the $\mathsf{PV}$ Knapsack problem for power-of-two cyclotomic rings. By combining our techniques with the attack of Das and Joux, we show that a substantially larger fraction of keys are weak in this setting than was previously known. We then extend our attack to the integer variant of the $\mathsf{vSIS}$ commitment problem, demonstrating that certain instances are also weak for specific parameter regimes.
## 2026/1556
* Title: Breaking the Beyond-Birthday-Bound Security of $\sharp\textsf{Pencil}$ * Authors: L|-onard Assouline, C|-cile Delerabl|-e
* [Permalink](https://eprint.iacr.org/2026/1556)
* [Download](https://eprint.iacr.org/2026/1556.pdf)
### Abstract
$\sharp\textsf{Pencil}$ is a domain-extended pseudorandom function by Bhaumik et al, accepted at CRYPTO 2026, claiming that it achieves close to $n$-bit security beyond the birthday bound. It is used as the key-derivation layer of the $\sharp\textsf{Pencil}$-CAU authenticated-encryption mode. We show that $\sharp\textsf{Pencil}$ has a birthday-bound collision attack: its front end $\textsf{Sharp}$ compresses the second half $N_2$ of the input
through the $(n-8)$-bit value
\[
J(N_2)
= \operatorname{msb}_{n-8}\bigl({\mathsf{E}}_{K_1}(N_2 || \texttt{0x00})\bigr), \]
after which the entire computation is a deterministic function of $(N_1,J)$. Thus, for any fixed $N_1$, distinct values $N_2,N_2'$ satisfying $J(N_2)=J(N_2')$ produce identical $\sharp\textsf{Pencil}$ outputs. Such collisions occur with probability $1-e^{-1}$ after $2^{(n-7)/2}$ queries, $2^{60.5}$ when $n=128$. This yields a PRF distinguisher with constant advantage, contradicting the security bound of Theorem 4. Since $2^{60.5}$ falls below the birthday bound $2^{n/2}$ that the construction was designed to pass, the beyond birthday-bound property does not hold. Given the derived key $K_1$, an explicit collision can be constructed in approximately $10^3$ inverse-cipher evaluations in expectation. The same collision breaks $\sharp\textsf{Pencil}$-CAU, as two nonce-respecting queries can reuse the key and the nonce of the inner GCM instance, yielding the difference of the two plaintexts. The first version of the paper does not have the defect: it left $J$ untruncated, which makes the map injective and invalidates the collisions above. Reverting to it is the remedy we suggest.
## 2026/1581
* Title: Post-Quantum Internet Key Exchange via Authenticated Forward-Secure KEM
* Authors: Yunlei Zhao, Biming Zhou, Zhixiang Zhao, Yifan Dong, Cheng Huang, Haodong Jiang
* [Permalink](https://eprint.iacr.org/2026/1581)
* [Download](https://eprint.iacr.org/2026/1581.pdf)
### Abstract
In this work, we present a new framework for signature-free, post-quantum secure authenticated key exchange (AKE) that simultaneously satisfies:
(1) exchanging at most two standard ciphertexts of a key encapsulation mechanism (KEM);
(2) computational symmetry;
(3) perfect forward secrecy (PFS);
(4) strong resilience to secret-state exposure;
(5) strong resistance to decryption-error attacks;
(6) admitting instantiations based on the native structure of
\textsf{ML-KEM} under the \textsf{MLWE} assumption; and
(7) provable security in both the random oracle model (ROM) and the quantum-accessible random oracle model (QROM) under the post-id $\mathsf{eCK}\mbox{-}\mathsf{PFS}$ framework.
This resolves several fundamental open questions in the literature.
The core technical building block is a new cryptographic primitive, called an \emph{authenticated forward-secure} KEM (AFS-KEM), which unifies authentication and forward secrecy within a single KEM
abstraction and may be of independent interest.
## 2026/1638
* Title: Anamorphic Messaging: Analyzing the Double Ratchet, Triple Ratchet, PQ3, and MLS
* Authors: Hien Chu, Alessandro Corsi, Paul R||sler
* [Permalink](https://eprint.iacr.org/2026/1638)
* [Download](https://eprint.iacr.org/2026/1638.pdf)
### Abstract
Anamorphic cryptography targets the scenario in which a dictator does not forbid the use of cryptography but requires all users to reveal their secret keys to them. Thus, the dictator can decrypt all honestly generated ciphertexts. The approach for bypassing this is to identify spots, such as random nonces, in existing cryptographic protocols in which secret messages can be hidden using an additional secret double key. So far, the literature mostly focused on identifying such spots in simple primitives like public-key encryption or signatures; only recently, an initial work identified limited spots in Signal's Double Ratchet Algorithm.
We are the first to leverage the statefulness of cryptographic communication protocols to employ continuously updated double states and, thereby, achieve Forward Security: Even if the adversary (i) observes all traffic, (ii) knows all users' regular secret key material at any stage of the protocol execution, and (iii) at some point learns the secret double state, the entire protocol execution looks benign although covert messages were previously hidden in the traffic anamorphically. We formalize this notion and also cover robustness and authenticity, which appear to be particularly relevant in the messaging context.
In this new model, we study four of the most relevant messaging protocols and identify hiding spots therein: Signal's Double Ratchet, Signal's Triple Ratchet, Apple's PQ3, and the two-party core of the Messaging Layer Security Standard. We focus on the cryptographic parts of these protocols and, despite their complexity, identify surprisingly few anamorphic hiding spots. We prove that all these protocols offer forward secure, authenticated anamorphic channels and we evaluate their bandwidths: While 16 bits can be embedded in every epoch of the Double Ratchet, Triple Ratchet and PQ3 provide 176 bits, respectively 256 bits, of bandwidth per post-quantum epoch, and MLS provides 688 bits per epoch.
## 2026/1640
* Title: Qlapoti+ and More: Optimizing Isogeny-based Signatures
* Authors: Yi-Fu Lai
* [Permalink](https://eprint.iacr.org/2026/1640)
* [Download](https://eprint.iacr.org/2026/1640.pdf)
### Abstract
This paper presents several optimizations to Qlapoti (Asiacrypt'25),
an ideal-finding procedure at the heart of modern isogeny-based
signature schemes. We apply these optimizations to the Qlapoti-based
NIST Round-2 SQIsign implementation from Asiacrypt'25. Together,
they accelerate the Qlapoti procedure by approximately \(1.6\times\) to \(5.3\times\), depending on the parameter set and implementation.
Under the Broadwell benchmark, compared with the baseline implementation in Asiacrypt'25,
our optimizations achieve key-generation speedups of \(1.29\times\), \(2.23\times\), and \(1.54\times\), and signing speedups of
\(1.23\times\), \(1.79\times\), and \(1.43\times\), at NIST security
levels~1, 3, and~5, respectively.
Our techniques also apply to the Qlapoti-optimized PRISM implementation (PKC'25, Journal of Cryptology), for which we introduce an additional
tailored optimizations.
Under the Broadwell benchmark, compared with the baseline implementation in JoC using Qlapoti, our improvements translate into key-generation speedups of \(1.22\times\), \(1.87\times\), and \(1.46\times\), and
signing speedups of \(1.47\times\), \(1.90\times\), and \(1.60\times\),
at NIST security levels~1, 3, and~5, respectively.
## 2026/1642
* Title: A Torus-Structured Generalisation of NTRU: the NTC Assumption, its Cryptanalysis, and a Compact KEM
* Authors: Sidoine Djimnaibeye, Djiby Sow, Mahamat Borgou Hassan
* [Permalink](https://eprint.iacr.org/2026/1642)
* [Download](https://eprint.iacr.org/2026/1642.pdf)
### Abstract
We introduce Noisy Torus Conjugation (NTC), a lattice assumption in which a short secret is confined to a non-split maximal torus of $GL_k(R_q)$ and acts by conjugation on a uniform matrix, the result being masked by a short additive error. NTRU is the $k=1$ member of the family. Passing to $k \ge 2$ changes the geometry of the underlying lattice in two specific ways. The planted module occupies a fraction $1/(2k)$ of the published lattice's dimension, against NTRU's $1/2$; and the norm-map shortcut that governs the overstretched regime is blocked once the conjugated matrix is required to be uniform over the full matrix algebra instead of the torus.
We develop the structure theory of the assumption: marginal uniformity of each component, invariance along the torus orbit, a rigidity theorem identifying the full set of short solutions, and a reduction from search to decision. On it we build an IND-CCA key encapsulation mechanism whose passive security reduces tightly to NTC together with one isolated decisional assumption. At NIST categories 1, 3 and 5 it reaches public keys within 1.08 to 1.16 times Kyber's and ciphertexts 2.0 to 2.1 times Kyber's.
The new assumption is not load-bearing but purchasable. Widening the key distribution to the smoothing parameter of the key lattice would make the public key statistically uniform and remove it altogether, leaving IND-CPA on module-LWE and hence on a worst-case problem. We price that variant at a factor 3.4 on the public key and 4.0 on the ciphertext. It rests, however, on a regularity statement not established for the completely split rings our transform uses; we isolate that statement as a conjecture and give a modulus class for which it is not needed.
Concrete parameters are selected with an estimator calibrated against the published core-SVP figures of Kyber, and validated against a hybrid
meet-in-the-middle model whose single free constant is fitted on Kyber. The fatigue predictions underlying the modulus window are tested further by lattice reduction. We reduce small instances of the published lattice against NTRU controls of identical dimension, determinant and planted-vector norm, and at every modulus the NTRU plant is discovered as a dense sublattice while the sparser NTC plant is not. A companion paper builds a Fiat-Shamir-with-aborts signature from the same assumption. The assumption is new and has no worst-case reduction; we state throughout what is proved, what is heuristic, what is measured, and what remains open.
## 2026/1647
* Title: Information-Theoretic SFE and PFE with Reduced Communication
* Authors: Shuaishuai Li, Cong Zhang, Juntong Lin, Anyu Wang, Xiaoyun Wang
* [Permalink](https://eprint.iacr.org/2026/1647)
* [Download](https://eprint.iacr.org/2026/1647.pdf)
### Abstract
Secure function evaluation (SFE) and private function evaluation (PFE) are fundamental primitives in multiparty computation. In SFE, multiple parties jointly compute a \textit{public} function over private inputs while revealing nothing beyond the output, whereas in PFE the function itself is \textit{private} and known only to a designated party. In this work, we focus on the semi-honest setting and present more efficient information-theoretic constructions for both SFE and PFE.
For SFE, the classical BGW protocol incurs $O(n^2)$ communication per multiplication gate. The DN protocol (Damg\aa rd and Nielsen, Crypto 2007) reduces the amortized communication to linear but still require an additional $O(n^2)$ term, yielding $O(m^* n + n^2)$ communication for $m^*$ multiplication gates. This becomes suboptimal in the regime $m^*= o(n)$. We introduce a simple technique that removes this quadratic overhead, achieving strictly linear $O(m^* n)$ communication.
For PFE, the only existing information-theoretic approach relies on universal circuits, which results in $O(m^5n+n^2)$ complexity for arithmetic circuits. We develop new techniques that avoid universal circuits entirely. Combined with our SFE improvements, this yields an honest-majority PFE protocol achieving $O(m^2n)$ communication for circuit size $m$. We further obtain improved efficiency in special cases, including a three-party protocol with $O(m^{4/3})$ communication, and an $n$-party protocol tolerating one corruption with $O(m^{(2n-2)/(2n-3)}n)$ communication.
## 2026/1650
* Title: D-James: Ultra Short Multivariate Signatures
* Authors: Jacques Patarin, Alexandre Roullet
* [Permalink](https://eprint.iacr.org/2026/1650)
* [Download](https://eprint.iacr.org/2026/1650.pdf)
### Abstract
Multivariate signature schemes are among the few post-quantum candidates capable of providing very short signatures, but designing secure constructions has proven challenging. HFE-based schemes such as G$e$MSS were compromised by algebraic MinRank attacks. This motivates the HFE$_\text{IP}^-$ framework, which combines IP and minus modifiers to address these attacks. We introduce James and D-James, the latter achieving signatures of only 156 bits at the 128-bit classical security level and 348 bits at the 256-bit classical security level, among the shortest signatures reported for practical post-quantum public-key signature schemes, with estimated signing and verification costs comparable to those of G$e$MSS. The main technical contribution is the introduction of Dragon terms, which decouple the number of public equations from the hash output length, allowing the signature size to be reduced independently of the security parameter. We characterize the algebraic structure introduced by Dragon terms and show that it does not enable known MinRank attacks when combined with the HFE$_\text{IP}^-$ countermeasures. We also show that the known differential attack does not appear to extend to the minus variant. We further present parameter sets over both binary and small non-binary finite fields. For small values of $q>2$, the public-key size decreases by up to a factor of 10, while signature size and computational cost remain close to the binary case.
## 2026/1651
* Title: Single-Server Verifiable PIR with Updates and Universally Composable Security
* Authors: Julia Guskind, Ariel Hamlin, Ryan Little, Daniel S. Roche, Mayank Varia
* [Permalink](https://eprint.iacr.org/2026/1651)
* [Download](https://eprint.iacr.org/2026/1651.pdf)
### Abstract
Private information retrieval (PIR) is a fundamental cryptographic primitive that allows a client to retrieve an entry of a database from a server without revealing which entry was retrieved. PIR security is traditionally defined with a distinguishing game that ensures the clients' access patterns are kept private from a semi-honest server. Verifiable PIR (VPIR) adds another game-based property that holds against a malicious server: the server is bound to a particular database and cannot cause a client to retrieve a database entry that is inconsistent with this database. Recent work by Alon and Beimel [ITC 2025] deviated from the traditional game-based PIR definitions and contributed a definition of standalone simulation-based security for multi-server PIR. Their techniques, however, do not readily extend to single-server VPIR and do not consider concurrent protocol composition when PIR is used as a building block within a larger application.
In this work, we further the study of simulation-based VPIR security. We are the first to formalize a universally composable (UC) definition of VPIR in the single-server setting by giving an ideal VPIR functionality. We motivate the need for UC security by showing how game-based VPIR properties fail under sequential and concurrent protocol composition. We also demonstrate the generality of our UC VPIR functionality by providing two realizations based on a trivial PIR and VeriSimplePIR [de Castro and Lee, USENIX Security 2024].
Additionally, we introduce a new kind of VPIR, called Updatable VPIR (UVPIR), which guarantees to clients that (1) database updates are authorized by permissioned clients and (2) responses to their queries are consistent with a specific version of the PIR database. We show that UVPIR can be constructed in a black-box manner on top of any VPIR protocol.
## 2026/1652
* Title: On the Security of In-band Verification in End-to-End Encrypted Video Calls
* Authors: Daniel Jones, Melissa Chase, Esha Ghosh, Kim Laine
* [Permalink](https://eprint.iacr.org/2026/1652)
* [Download](https://eprint.iacr.org/2026/1652.pdf)
### Abstract
Video conferencing software, including Zoom, Microsoft Teams, and Cisco Webex, use human-driven key verification ceremonies to protect end-to-end encrypted meetings against a potentially malicious service provider. The client software shows each participant a code that they must compare; if the codes match, the call is considered secure. Prior security analyses assumed authenticated out-of-band channels for the comparison, but this is generally unrealistic. The codes are short-lived, so the ``in-band'' channel being verified is, itself, the most natural one to use. We seek to understand the implications of this common practice, asking whether it can be secure and under what conditions.
To this end, we formalize the notion of a Human-to-Human Group Key Agreement protocol, modeling an authenticated group key exchange between people, rather than their cryptographic keys. We identify that the security of these protocols relies on the pre-existing capacity of people to consistently recognize one another, avoiding any global identification scheme or trusted external infrastructure.
We present a construction, prove it secure in our model, derive concrete bounds, and discuss non-examples demonstrating the definition's subtlety. Our results highlight the approach's usability issues and reliance on unforgeability of human-authenticated video streams---an assumption additionally challenged by recent advances in deepfakes.
## 2026/1653
* Title: Lumora: A Family of Permutation-Based Wide-Block Ciphers for Post-Quantum zkSNARK Applications
* Authors: Susanta Samanta, Martin Grenouilloux, Guang Gong, Chunlei Li
* [Permalink](https://eprint.iacr.org/2026/1653)
* [Download](https://eprint.iacr.org/2026/1653.pdf)
### Abstract
The deployment of advanced cryptographic protocols such as zero-knowledge proofs (ZKPs) requires symmetric primitives optimized for fast verification inside proof systems. In frameworks based on Rank-1 Constraint Systems (R1CS), prover performance and proof size are dominated by the cost of arithmetization, specifically, by the number of nonlinear multiplication constraints. Traditional bit-oriented designs are typically inefficient under this metric. In this paper, we introduce Lumora, a family of arithmetization-oriented, permutation-based wide-block ciphers designed for efficient use inside zkSNARK circuits and for applications in post-quantum digital signatures. Each instance of Lumora follows a unified AES-like SPN structure defined over the binary extension field $\mathbb{F}_{2^n}$ for $n \in \{16,32,64\}$. The underlying permutation is instantiated as a block cipher via the Even-Mansour paradigm, which eliminates the R1CS constraint overhead of a separate key schedule, ensuring the prover's workload remains strictly focused on evaluating the public permutation. Finally, we provide a detailed security analysis of the Lumora family, together with implementation results and a comparison within the FAEST-EM-256 framework.
## 2026/1654
* Title: Verifpal Seven Years Later: Can a Toy Become an Instrument?
* Authors: Nadim Kobeissi
* [Permalink](https://eprint.iacr.org/2026/1654)
* [Download](https://eprint.iacr.org/2026/1654.pdf)
### Abstract
Verifpal, introduced in 2019, is a symbolic protocol verifier that traded analytical generality for a modeling language a working engineer could read without training. Its own paper called the resulting soundness argument "incomplete, semi-formal, in-progress," and the fair conclusion at the time was that Verifpal was a teaching tool standing beside two research tools.
The engine that paper described has since been replaced outright. Where the 2019 engine searched forward, enumerating combinations of wire values to mutate under four tuned parameters, the new engine is goal-based: it starts from the query it is trying to contradict, breaks that requirement into subgoals, and forces a binding whenever a subgoal can be discharged in only one way, with the search bounded by the protocol's own term structure. This paper gives the first formal account of the replacement: its semantics, equational theory, knowledge closure and goal-directed solving. Soundness does not depend on the solver: before an attack is reported, a small trusted region re-checks that the attacker controls every slot the attack touches and can derive every term it installs, then re-executes the protocol and re-tests the query, so a solver bug can cost a missed attack but cannot produce a false one.
The language is also simpler and more capable: public-key cryptography no longer needs a special kind of value, key encapsulation mechanisms are expressible, and a primitive can be declared weak or forgeable at the call site. Every principal is now analyzed as several concurrent sessions holding their own fresh values, which brings attacks needing two instances of one role (such as Millen's necessarily-parallel $f^n g^n$) within reach. Attack traces are always reproducible and are written almost entirely in the modeler's own names, which greatly improves the usefulness and readability of Verifpal's findings.
Verifpal still comes with limits: no observational equivalence, a fixed equational theory, and while parallel execution is now genuinely supported, it is over a bounded number of sessions rather than unbounded replication. Our answer to the title's question is that Verifpal has become a different instrument rather than a smaller one, worth using alongside its two peers rather than instead of them.
## 2026/1655
* Title: Hardness of Euclidean Closest Vector within $n^{1/8-\epsilon}$ and Binary Nearest Codeword within $n^{1/4-\epsilon}$
* Authors: Zhao Song
* [Permalink](https://eprint.iacr.org/2026/1655)
* [Download](https://eprint.iacr.org/2026/1655.pdf)
### Abstract
We prove two deterministic inapproximability results.
First, for every fixed
$\epsilon>0$, Euclidean $\mathrm{GapCVP}^{(2)}$ is NP-hard with
gap factor $n^{1/8-\epsilon}$ under deterministic polynomial-time many-one reductions, where $n$ denotes the lattice rank. Consequently, the Euclidean closest vector problem is NP-hard to approximate within the same factor. This improves the previous $n^{1/400}$ hardness factor in Chapter 7 of the OpenAI report [Ope26].
Second, for every fixed $\epsilon>0$, binary nearest
codeword and binary syndrome decoding are NP-hard to approximate within $n^{1/4-\epsilon}$ under deterministic polynomial-time many-one reductions, where $n$ denotes the binary block length. This improves the previous $n^{1/200}$ hardness factor in Chapter 7 of the OpenAI report [Ope26].
## 2026/1656
* Title: BinarySpartan: Spartan over binary fields
* Authors: Srinath Setty
* [Permalink](https://eprint.iacr.org/2026/1656)
* [Download](https://eprint.iacr.org/2026/1656.pdf)
### Abstract
Spartan is a SNARK for R1CS that can be instantiated with any multi-
linear polynomial commitment scheme. We instantiate Spartan over a binary field, using Ligerito as the commitment scheme along with the ring-switching technique of Diamond and Posen; we refer to the instantiation as BinarySpartan. It is transparent, so it requires no trusted setup, and it provides polylogarithmic-sized proofs. Its security rests on a hash function, so it is plausibly post-quantum. We apply only well-known optimizations to Spartan and sum-check: the SIMD R1CS of Phalanx; the next multilinear extension of SuperSpartan; sum-check optimizations from Gruen, from Dao and Thaler, and from Bagad, Dao, Domb, and Thaler; and the byte lookup tables used by Binius64 for evaluating bit-valued linear maps.
Thus, BinarySpartan is not a new proof system but rather a natural instantiation of Spartan over binary fields; we implement and evaluate it end to end. On a MacBook Pro M4 Max (using only its 12 performance cores, and without GPU/Metal acceleration), BinarySpartan proves BLAKE3 at 410,000 hashes/second and SHA-256 at 219,000 hashes/second, including witness generation. These clear the 200,000 hashes/second rate proposed as sufficient for a post-quantum Ethereum transition, as well as the roughly 30,000rCo180,000 hashes/second a possible post-quantum Bitcoin transition would require. We also evaluate BinarySpartan on the Ethereum FoundationrCOs client-side proving benchmark, where it proves a single SHA-256 of a 2 KiB message in 6.2 ms, making it the fastest scheme in the benchmark suite.
## 2026/1657
* Title: Ideal Pseudorandom Code, Revisited
* Authors: Ganyuan Cao
* [Permalink](https://eprint.iacr.org/2026/1657)
* [Download](https://eprint.iacr.org/2026/1657.pdf)
### Abstract
Pseudorandom error-correcting codes (PRCs), introduced by Christ and Gunn at CRYPTOrCO24, combine pseudorandomness with error correction, providing a natural abstraction for robust watermarking and
steganography on generative AI models. Subsequent standalone notions, which are ideal security for secret-key PRCs and CCA-style security for public-key PRCs, are oracle-based and do not capture composable use with explicit parties, sessions, and corruption.
We give a UC treatment of PRCs via corruption-aware ideal functionalities for both settings. Under non-adaptive corruption, the UC notions recover the standalone ones. Under adaptive corruption, we identify a common obstruction: dummy codewords sampled before corruption, together with their neighborhoods, must later be opened as valid PRC codewords. We formalize this as a decoder-non-committing code (NC-PRC), which any adaptively UC-secure realization must induce. We then capture failures of such openings via targeted low opening capacity, show it rules out robust NC-PRCs, and prove that LDPC-based PRCs have this property hence do not admit a NC-PRC.
On the positive side, we sketch two compilers to lift error-correcting
codes to admit NC-PRCs: a secret-key one from a puncturable PRF
and indistinguishability obfuscation (iO), and a public-key one from a
smooth projective hash function (SPHF), both evading the barrier via programmable acceptance.
Finally, we identify a fresh-codeword explanation barrier for public-key
PRCs: accepted unseen codewords cannot be explained from public information without violating pseudorandomness, so public-key UC realizations require a trapdoor or an idealized setup.
## 2026/1658
* Title: Upper bounds for failure probabilities of reductions from low density subset sum problems to lattice problems on linearly independent vectors
* Authors: Shoichi Kamada
* [Permalink](https://eprint.iacr.org/2026/1658)
* [Download](https://eprint.iacr.org/2026/1658.pdf)
### Abstract
As a new lattice problem, we introduce $l$-Shortest Independent Vectors Problem ($l$-SIVP for short), where $l$ is a positive integer no greater than the rank of a lattice. In the case where $l=1$, $l$-SIVP means SVP, and in the case where $l$ is the rank of a lattice, $l$-SIVP means SIVP. We estimate upper bounds on the failure probabilities of the reductions from the subset sum problems to the $l$-SIVPs in terms of Ehrhart theory.
Especially, in the case of $l=1$, our upper bound is tighter than the previous result given by Coster et al. We give some considerations for dominating terms of our upper bounds of failure probabilities when $l$ is general.
## 2026/1659
* Title: Efficient Transaction Traceability for Auditable Privacy-Preserving Ledgers
* Authors: Elli Androulaki, Angelo De Caro, Kaoutar Elkhiyaoui, Rebekah Mercer, Elina van Kempen
* [Permalink](https://eprint.iacr.org/2026/1659)
* [Download](https://eprint.iacr.org/2026/1659.pdf)
### Abstract
Privacy-preserving distributed ledgers enable transaction processing systems in which users can submit transactions without revealing their identities or transaction details. Regulated and institutional settings impose additional requirements: authorized parties must be able to efficiently trace transactions to their originators without compromising overall system privacy. Existing approaches suffer from important limitations, including restricted parallel transaction formation, high computational overhead, and overly broad auditor access to user secrets.
We present a framework for efficient tracing that eliminates concurrency issues while limiting auditor access. We formalize our security requirements via an ideal functionality and propose a black-box construction based on pseudorandom functions and anonymous credentials, with two concrete instantiations: one using hash-based PRFs and zk-SNARKs, and another using algebraic PRFs and Sigma protocols. Our experimental evaluation demonstrates practicality, incurring only a few milliseconds of overhead for the added tracing capabilities.
## 2026/1660
* Title: Transient Quantum Resistance, with Application to Ethereum Consensus
* Authors: Pranay Anchuri, Matteo Campanelli, Rosario Gennaro
* [Permalink](https://eprint.iacr.org/2026/1660)
* [Download](https://eprint.iacr.org/2026/1660.pdf)
### Abstract
Candidates for post-quantum migration carry additional costs compared to their pre-quantum counterparts, especially for signatures, and they lose attractive properties of schemes such as BLS: homomorphism, and hence direct signature aggregation.
We propose a methodology through which a pre-quantum primitive may still be securely used past Q-day (the advent of quantum computers) in settings where forgery of signatures or cryptographic proofs need only be prevented for a bounded lifespan (transient quantum security). The idea is to bind a fresh, ephemeral, ordinary pre-quantum key to a long-term post-quantum identity once per lifespan window, so a forgery under the fresh key is useful only for that window, and to derive the fresh key so that its exposure never leaks the long-term secret.
Our main case study is the post-quantum migration of Ethereum consensus, where we give a solution that keeps relying on BLS and (i) retains signature aggregation, central at Ethereum's scale, without a SNARK prover, so the consensus-critical aggregate stays a single ~96-byte BLS signature, about three orders of magnitude smaller than the hundreds of kilobytes a SNARK-aggregated hash-based alternative
needs per aggregate, as in the current proposal for post-quantum Ethereum consensus; and (ii) needs only an additional ~590-690 bytes per epoch of per-validator reveal traffic.
Security holds as long as a standard pairing-based variant of the computational Diffie-Hellman problem (co-CDH') cannot be broken by a quantum computer within the 6.4-minute duration of an Ethereum epoch; we discuss the hardware and time budgets such a break would require today, and how they may shrink as quantum hardware improves.
We also provide a formal model and security analysis for the construction, and, of independent interest, a new analysis of BLS where the secret key is sampled similarly to the Dodis-Yampolskiy VRF (IACR PKC 2005) and the adversary is given a related group element as leakage.
## 2026/1661
* Title: MKA Meets Multidrop: Optimizing Time-to-Key-Agreement on 10BASE-T1S Ethernet
* Authors: Jonathan Ndop, Isaac Molina, Guillermo Oliver, Friedrich Wiemer, Axel Sikora
* [Permalink](https://eprint.iacr.org/2026/1661)
* [Download](https://eprint.iacr.org/2026/1661.pdf)
### Abstract
The MACsec Key Agreement protocol, defined in IEEE 802.1X, manages and distributes ephemeral Secure Association Keys for Ethernet links protected with MAC security (IEEE 802.1AE).
Prior work has shown that baseline MKA may scale poorly on shared medium Ethernet multidrop links and that formal worst-case bounds significantly exceed automotive startup targets, motivating alternative solutions such as In-line Key Agreement.
However, in practice, to preserve compatibility, integration effort, and alignment of standardization, automotive systems are more likely to optimize a MACsec/MKA architecture than to completely replace it.
This paper presents novel automotive MKA optimizations targeting secure startup times on shared medium networks and evaluates them through detailed network simulations.
Unlike previous work focused on baseline MKA or deterministic worst-case analysis, we study the full startup-time distribution of the optimized protocol under realistic startup scenarios.
We quantify the effect of the proposed optimizations on Time-To-Key-Agreement and show how the resulting empirical distributions can be translated into conservative simulation-derived practical startup-time bounds suitable for OEM timing budgets.
The resulting bounds are intended as simulation-derived engineering bounds under the modeled startup assumptions, complementing formal worst-case analysis with distributional information on typical, tail, and upper-end behavior.
## 2026/1662
* Title: Degree-Sum-Freedom Is Not EA Invariant: Exact Profiles in a 4-Uniform Permutation Family
* Authors: Jingchuan Ma, Yanhua Liu, Qiaoyun Huang
* [Permalink](https://eprint.iacr.org/2026/1662)
* [Download](https://eprint.iacr.org/2026/1662.pdf)
### Abstract
Degree-sum-freedom is a local criterion for division-property propagation from affine input spaces. The published version states that this criterion is invariant under extended-affine (EA) equivalence. We show that this assertion does not hold beyond ordinary sum-freedom and quantify the resulting variation. First, the natural Gold APN pair $x^3$ and $x^3+x$ has exact proper-flat values 3 and 2 on an infinite sequence of dimensions. We then study a known complete-mapping family of EA-equivalent, differentially 4-uniform permutations $F_b,G_b$ on $2r$ bits. For every odd $r$ and every $1\le c\le\lfloor(r-3)/2\rfloor$, we determine their exact codimension-$c$ profiles: $\mu_c(F_b)=2c$ and $\mu_c(G_b)=r+c-1$, equivalently $\tau_{2r-c}(F_b)=2r-2c$ and $\tau_{2r-c}(G_b)=r-c+1$. Thus the gap is $r-c-1\ge(r+1)/2$ simultaneously over a linear-size range of proper affine codimensions. The mate upper bound follows by specializing known generalized-degree duality with the exact source profile established here. The matching uniform lower bound is family-specific: after an associated-graded reduction, odd codimensions are detected by one classical consecutive Moore determinant, whereas even codimensions require a jointly nonvanishing family of replacement minors. A cyclic carry classification proves that the selected coefficients are complete reduced coefficients. These results concern local affine-input division-property behavior; they do not yield a multiround distinguisher or an attack on a concrete cipher.
## 2026/1663
* Title: Five-Bit Axial Subspace Differential Uniformity: Exact Optima and a DDT-Support Realizability Gap
* Authors: Jingchuan Ma, Yuqing Shao, Xin Wei, Qiaoyun Huang
* [Permalink](https://eprint.iacr.org/2026/1663)
* [Download](https://eprint.iacr.org/2026/1663.pdf)
### Abstract
Subspace differential uniformity (SDU) measures the concentration of a differential distribution table (DDT) on affine subspaces. We determine the exact optima of the two axial affine-SDU coordinates in dimension five and establish a strict gap between locally admissible support designs and supports realizable by almost perfect nonlinear (APN) permutations. We first prove that every $16$-subset of $\mathbb{F}_2^5$ meets some affine $3$-flat in at least six points. Equality holds precisely for balanced quadratic indicators of polar rank four, forming a single affine orbit represented by $\operatorname{supp}(\operatorname{Tr}(x^3))$. This gives the relaxed axial optimum $12$. We then classify all $900$ ordered monomial-trace candidates $M_{r,s}(u,v)=\operatorname{Tr}(u^r v^s)$: exactly $100$ attain both relaxed axial optima, yielding $20$ labelled arrays and three product-linear types up to transpose. Despite satisfying regularity and zero-vector-sum constraints, every optimal type violates a global necessary condition for DDT realizability: its two-dimensional character transform contains a negative coefficient where a vectorial Walsh square is required. Finally, the published exhaustive affine classification of five-bit APN permutations, together with direct recomputation of all five class representatives, gives realizable axial minimum $14$, attained simultaneously by the $x^{15}$ class. Thus local incidence and vector-sum constraints permit score $12$, whereas genuine APN-permutation DDT supports require score $14$.
## 2026/1664
* Title: Trace-Moment Canonicalization for Average-Case Matrix Code Conjugacy
* Authors: Jingchuan Ma, Yanhua Liu, Qiaoyun Huang
* [Permalink](https://eprint.iacr.org/2026/1664)
* [Download](https://eprint.iacr.org/2026/1664.pdf)
### Abstract
Matrix Code Conjugacy asks whether two matrix subspaces are related by one simultaneous change of basis. A recent average-case algorithm reaches a $\Theta(1/q)$ fraction when the code dimension equals the matrix size, but a general code basis carries an additional unknown coefficient-space action. We bypass that action rather than recover it. A nonzero generator $A$ of a one-dimensional trace hull defines the homogeneous functionals $X\mapsto\operatorname{Tr}(A^rX)$. A transverse moment selects a nondegenerate complement of the hull, and trace duality turns the moments into basis-independent homogeneous matrices inside the code. The pair $(A,M_2)$ transforms only by ambient conjugation and a known scalar weight.
For every odd prime power $q$, odd $n\ge 5$, and $2\le m\le n^2-2$, we obtain a deterministic partial search-and-decision algorithm that is correct for at least a $1/(35q)$ fraction of uniformly random $m$-dimensional first codes, against every second input. Its bit complexity is $\operatorname{poly}(n,m,\log q)$; the certified fraction is $\Theta(1/q)$. The proof counts the actual correlated projection law of $M_2$, including its endpoint atoms, and never models it as an independent random matrix. A direct corollary gives the same $\Theta(1/q)$ scale in the independent-uniform ordered-tuple model. The result excludes characteristic two and even $n$, and it does not by itself yield a general Matrix Code Equivalence algorithm.
## 2026/1665
* Title: Nullity-One Canonicalization for Average-Case 4-Tensor Isomorphism
* Authors: Jingchuan Ma, Yanhua Liu, Qiaoyun Huang
* [Permalink](https://eprint.iacr.org/2026/1665)
* [Download](https://eprint.iacr.org/2026/1665.pdf)
### Abstract
We study square 4-Tensor Isomorphism over finite fields in the average-case model where the first tensor is uniform and the second is arbitrary. The closest polynomial-time method exploits a higher-dimensional flattening kernel. The denser corank-one stratum occurs on the $1/q$ scale, but its one-dimensional kernel loses the matrix-pair information used by that method. We make this minimal defect algorithmically useful. After normalizing the left and right kernel matrices to the identity, the residual action becomes a pair of adjoint actions on $\mathfrak{sl}_n$. The normalized flattening induces a uniform map $\Phi\in\mathrm{GL}(\mathfrak{sl}_n)$; its two Gram operators yield linked projective spectral matrix pairs. We prove constant-probability scalar common-centralizer bounds for their actual orthogonality-conditioned distribution, recover both residual conjugations without enumerating field elements, and lift them to all four tensor factors.
For every odd prime power $q\geq 5$ and $n\geq 5$ with $\operatorname{char}(\mathbb{F}_q)\nmid n$, this gives a randomized partial algorithm with expected $\operatorname{poly}(n,\log q)$ running time that is correct on at least $c/q$ of uniform first tensors, for an explicit universal $c>0$. Its only randomized components are Las Vegas finite-field subroutines. We also give a complementary large-field result on tensors whose three standard $2|2$ flattenings are invertible. These results concern certified average-case complexity, and both tractable events are efficiently recognizable.
## 2026/1666
* Title: Rate-Limiting Nullifiers for Gasless Sequencer Admission in Ethereum Layer-2 Rollups
* Authors: U-fur +Ren, Sergei Tikhomirov, Sylvain Delhomme, Nadeem Bhati, Cyprien Grau
* [Permalink](https://eprint.iacr.org/2026/1666)
* [Download](https://eprint.iacr.org/2026/1666.pdf)
### Abstract
Blockchain networks rely on transaction fees for resource allocation and spam prevention. Ethereum's gas mechanism and its adoption by Layer-2 rollups serve this dual purpose, but gas-based fee markets produce unintended consequences: ineffective spam deterrence at low fee levels, poor user experience, privacy leakage, and revenue instability for rollup operators.
We present an idealized protocol architecture for gasless sequencer admission in Ethereum Layer-2 rollups based on Rate-Limiting Nullifiers (RLN) and a non-transferable reputation token (Karma). Users transact within a per-epoch gasless quota. Transactions beyond that quota use a gas-paid overflow path. RLN enforces the quota via zero-knowledge membership proofs, preserving pseudonymity for users within quota against on-chain observers while exposing violators through reputation slashing.
We present the architecture and transaction flow, analyze spam-attack economics through a parameterized cost comparison on a flat per-identity quota model (labeled flat-$N$, an analysis model for the spam stress test), and describe Status Network (SN), a deployed Ethereum L2 that implements this design.
## 2026/1667
* Title: Resolving the Complexity of Linear Secret Sharing
* Authors: Oded Nir
* [Permalink](https://eprint.iacr.org/2026/1667)
* [Download](https://eprint.iacr.org/2026/1667.pdf)
### Abstract
A secret-sharing scheme allows a dealer to distribute a secret $s$ among $n$ parties such that only predefined rCLauthorizedrCY sets of parties can reconstruct the secret, and all other rCLunauthorizedrCY sets learn nothing about $s$. Families of authorized sets are called access structures, and a scheme is called linear if its sharing map is linear in the secret and the dealerrCOs randomness. We show that every $n$-party access structure can be realized by a linear secret-sharing scheme for one-bit secrets with maximal share size of $2^{\lceil n/2\rceil-1}+1$ bits.
A counting lower bound for monotone span programs shows that almost all access structures require linear share size $2^{n/2-o(n)}$, which makes our upper bound tight. Our scheme is considerably simpler than previous schemes that obtained share size $2^{cn+o(n)}$ with $1/2\leq c<1$.
We also present a variant of this linear construction that is tailored for monotone k-DNFs access structures (also known as $k$-upslices). Then, by combining it with a non-linear scheme of Applebaum et al. (STOC 2020), we derive a scheme for all access structures with share size $2^{0.496n+o(n)}$.
This improves the previous upper bound of $2^{0.585n+o(n)}$ by Applebaum and Nir (CRYPTO 2021), and establishes a separation between the worst-case non-linear and linear exponents. Plugging the quadratic construction of Beimel, Othman, and Peter (CRYPTO 2021) into this framework yields quadratic schemes of share size $2^{0.4995n+o(n)}$, separating the quadratic and linear exponents.
The linear scheme for upslices and its proof were discovered in conversations prompted by the author with GPT-5.6 Sol and Claude Fable 5.
## 2026/1668
* Title: A Key-Recovery Attack on TALUS-MPC in TALUS v4
* Authors: Sunghyeon Jo
* [Permalink](https://eprint.iacr.org/2026/1668)
* [Download](https://eprint.iacr.org/2026/1668.pdf)
### Abstract
We give a two-transcript key-recovery attack on TALUS-MPC in TALUS v4. TALUS was presented in the second round of the NIST Threshold Call Preview Talks. In Algorithm 3 of TALUS v4, the committee's nonce polynomials are evaluated at all $N$ points so that any $T$ parties can sign. An adversary controlling the coordinator and $T-1$ parties can reuse the same pooled nonce with two quorums whose only common members are corrupt. Each participating honest party uses its signing share once, yet the coordinator obtains $\mathbf{z}_0=\mathbf{y}+c_0\mathbf{s}_1$, $\mathbf{z}_1=\mathbf{y}+c_1\mathbf{s}_1$. The nonce cancels on subtraction. Moreover, no invertibility assumption in $R_q$ is needed: the response equations lift to $\mathbb{Z}[X]/(X^{256}+1)$, and every nonzero $c_0-c_1$ is invertible in the cyclotomic field $\mathbb{Q}[X]/(X^{256}+1)$. Thus two distinct challenges recover $\mathbf{s}_1$ exactly; since the TALUS v4 public key includes the full $\mathbf{t}=\mathbf{A}\mathbf{s}_1+\mathbf{s}_2$, the adversary also recovers $\mathbf{s}_2$ and forges signatures.
## 2026/1669
* Title: Quantum Advantage for Two-Party Differential Privacy
* Authors: Daniel Alabi, Emil T. Khabiboulline
* [Permalink](https://eprint.iacr.org/2026/1669)
* [Download](https://eprint.iacr.org/2026/1669.pdf)
### Abstract
We introduce information-theoretically private quantum protocols for two-party Hamming distance when both parties must output the same estimate. Classically, for input length $n$, information-theoretic protocols require $\Omega(\sqrt{n})$ error under pure differential privacy and $\Omega(\sqrt{n}/\log n)$ error under strong approximate differential privacy, whereas computational security permits $O(1)$ error. In Klauck's honest, nonpreemptive, message-preserving model, we give an $O(n)$-communication quantum protocol with pure $\varepsilon$ quantum differential privacy (QDP) and expected error at most $\frac{2}{\sinh \varepsilon}+\gamma,$ for every $\gamma>0$. For approximate $(\varepsilon, \delta)$ QDP, an exact finite-cycle hockey-stick calculation yields strictly smaller error, while preserving the $O(1)$-versus-$\Omega(\sqrt{n}/\log n)$ separation for $\delta=o(1/n)$. Thus, quantum communication achieves $O(1)$ information-theoretic error, matching the accuracy available classically only under computational assumptions.
The main construction uses a guarded coherent round trip and an equal-Gram rigidity principle that prevents an honest player from retaining input-dependent complementary information. We also separate this model from weaker prescribed-channel privacy, which already admits an exact classical realization, and from fully retention-robust security, against which measurement-and-abort attacks remain possible. Therefore, we identify preservation of non-orthogonal quantum messages as a resource for privacy, but leave open whether a separation exists in the malicious setting.
## 2026/1670
* Title: RSS: Robust Signing Service using Threshold Signatures and TEEs
* Authors: Filip Rezabek, Kilian Glas, Eber Christer, Xinxin Fan, Georg Carle
* [Permalink](https://eprint.iacr.org/2026/1670)
* [Download](https://eprint.iacr.org/2026/1670.pdf)
### Abstract
Threshold signatures reduce the risk of single-key compromise by distributing signing authority, but each key share remains exposed to compromise of the software and infrastructure that execute the protocol. We present RSS, a threshold signing service that runs share generation and signing inside Trusted Execution Environments (TEEs).
We integrate GG20 threshold ECDSA, FROST, and threshold BLS into the EnGINE experimentation framework and evaluate local and Google Cloud deployments using AMD SEV-SNP and Intel TDX. Our experiments separate distributed key generation (DKG), preprocessing, and online signing, and cover up to 40 logical protocol participants distributed across four physical hosts or confidential VMs (CVMs).
In matched-platform comparisons, confidential execution adds limited overhead relative to protocol and deployment effects. DKG is the main scaling bottleneck: for 40 participants, it completes within seconds in the evaluated configurations, whereas signing completes in tens of milliseconds. Threshold BLS is approximately twice as slow as FROST for comparable values of $n$ and $t$. These results establish the performance feasibility of executing threshold-signature workloads inside CVMs under benign-operation assumptions. The evaluation does not cover a complete attestation-bound provisioning lifecycle, persistent-state rollback protection, or Byzantine fault behavior.
## 2026/1671
* Title: Verified Pythagorean Composition for Adaptive Cryptographic Games: Noise Flooding in Homomorphic Encryption
* Authors: Yi Lee, Alexandru Cojocaru, Junyi Liu, Xiaodi Wu
* [Permalink](https://eprint.iacr.org/2026/1671)
* [Download](https://eprint.iacr.org/2026/1671.pdf)
### Abstract
Noise flooding is a standard defense against decryption attacks on approximate homomorphic encryption, but its security proof is unusually sensitive to composition. Replacing each of \(q\) adaptive decryption answers with a statistically close simulation and applying an ordinary hybrid argument loses linearly in \(q\). The cryptographic proof instead accumulates conditional Kullback-Leibler (KL) costs and converts to statistical distance once, giving the parameter-critical square-root loss.
We machine-check this argument using Rocq and SSProve. Given any fully homomorphic encryption scheme that is approximately correct and IND-CPA secure, we formalize a reduction for every \(q\)-query IND-CPAD adversary and prove
\[
\Pr[\mathsf{IND\text{-}CPAD}_{\mathsf{NF}}^{\mathcal A}=1]
\leq \beta_{\mathsf{CPA}}(\mathcal B_{\mathcal A,q})
+ \frac{\sqrt{qn}}{2\gamma}.
\]
where \(n\) is the plaintext dimension and \(\gamma\) is the flooding-width multiplier. Our proof constructs a new relational program logic over SSProve semantics. Its Pythagorean judgment composes conditional KL budgets without converting them to statistical distance, and a verified trace compiler lifts a local oracle rule to arbitrary adaptive programs with a single final conversion.
## 2026/1672
* Title: AFS: A Family of ARX-Based Large-State S-boxes with Exceptional Properties
* Authors: Zhiguang Yan, Yongzhuang Wei, Ren|- Rodr|!guez-Aldama, Enes Pasalic * [Permalink](https://eprint.iacr.org/2026/1672)
* [Download](https://eprint.iacr.org/2026/1672.pdf)
### Abstract
Large-state ARX-based S-boxes have become a key component of modern lightweight cryptographic designs, yet deriving tight security bounds for their differential and linear properties remains challenging. In this paper, we study the security of Alzette, the 64-bit ARX-based S-box used in the SPARKLE permutation, and present a general framework for the analysis and design of large-state ARX S-boxes. We introduce SMCS, a hybrid search strategy that combines MILP-based optimization with SMT-based model checking, enabling the computation of tight bounds on maximum expected differential probabilities and linear correlations. Using SMCS, we refine existing bounds for Alzette and, for the first time, establish tight linear bounds (resp. differential bounds) for up to 15 rounds (resp. 14 rounds). Building on these results, we propose S-box configurational encoding, an automated design method for ARX-based S-boxes, and introduce a new family of S-boxes called AFS (ARX-Feistel Structure) with 32-bit and 64-bit instances. We show that selected AFS instances achieve strictly better resistance to single-trail differential and linear cryptanalysis than SPECKEY and Alzette, respectively, while preserving comparable hardware and software costs. Finally, we present the first bit-based SMT model for optimal long-trail decomposition and apply it to derive more accurate bounds for SPARX-128 and SPARKLE. Our results show that replacing the S-boxes with AFS instances yields substantial improvements in cryptanalytic security margins.
## 2026/1673
* Title: Linearly Homomorphic Secret Sharing and Multi-Party Computation with Unanimously Verifiable Deletion
* Authors: Yilei Chen, Liheng Ji, Han Luo
* [Permalink](https://eprint.iacr.org/2026/1673)
* [Download](https://eprint.iacr.org/2026/1673.pdf)
### Abstract
Certified deletion enables a party to prove that it has erased the sensitive information contained in a quantum state. Bartusek and Raizes (CRYPTO 2024) gave the first secret-sharing scheme with privately verifiable deletion. Subsequently, Katz and Sela (EUROCRYPT 2025) constructed secret-sharing schemes with publicly verifiable deletion under computational assumptions. Constructing such a publicly verifiable scheme without cryptographic assumptions remains open.
In this work, we introduce an intermediate notion called unanimously verifiable deletion, where deletion certificates are verified jointly by the parties in the protocol. While private verification relies on the dealer and public verification allows any third party to verify deletion, unanimous verification assigns the verification responsibility to the parties in the secret-sharing scheme themselves. We construct an information-theoretically secure linearly homomorphic threshold secret-sharing batch scheme with adaptive unanimously verifiable deletion. In particular, to obtain its linear-homomorphic property, we exploit a linearly homomorphic structure of BB84-type states that enables linear operations on encoded values while preserving certified deletion. More generally, this structure can be used to upgrade certain primitives with certified deletion to their linearly homomorphic counterparts.
As another major contribution, we demonstrate an application of this batch scheme by constructing outsourced multi-party computation (MPC) protocols for arbitrary arithmetic circuits. Our outsourced MPC has honest classical clients and quantum servers, and achieves adaptive unanimously verifiable deletion security in the trusted-preprocessing and security-with-abort setting, supports public output reconstruction, and is secure against malicious, rushing quantum server adversaries for any $t<n/2$, provided that throughout the online execution, at most $t$ corrupted servers remain undeleted and at least $t+1$ honest servers remain undeleted. Moreover, after successful finalization, all servers may be corrupted without revealing any information about the clients' inputs beyond the public output.
## 2026/1674
* Title: MinMandate: Private Task-Scoped Payment Authorization for Adaptive Agent Workflows
* Authors: Ge Gao, Haining Yu, Zhichao Liu, Dongyang Zhan, Yuanxiao Zhu, Zhongyun Hua
* [Permalink](https://eprint.iacr.org/2026/1674)
* [Download](https://eprint.iacr.org/2026/1674.pdf)
### Abstract
Autonomous agents are increasingly used to plan and execute paid workflows on behalf of users. Existing agentic-payment frameworks support this delegation through merchant-admission authorization credentials but require the user to specify merchants before execution. However, complex paid workflows often span multiple services and merchants, and agents may choose among them based on intermediate results. This creates two limitations: (1) requiring the user to choose each merchant in advance either limits the agent's adaptability or forces the user back into the loop; and (2) reusing a stable identifier across merchants lets observers link separate paid calls and infer the user's broader intent. To address these limitations, we introduce MinMandate, which grants adaptive merchant selection within user-approved task bounds and derives fresh per-call payment views without introducing a stable cross-merchant identifier. Extensive experiments on AgentDojo tasks demonstrate that, when 50% of merchants are unavailable, MinMandate improves task success by 32.7 percentage points on average across four tested planners compared with an AP2 baseline that preauthorizes one merchant per service class. Reintroducing a reusable public payment-layer handle in the Stable Handle ablation raises attacker task-recovery success by 27.4 percentage points on average, isolating the privacy cost of a stable join handle. The code is available at https://github.com/Zora-G/minmandate.
## 2026/1675
* Title: SparseMPC: Secure Sparse Operations using Multi-Party Computation
* Authors: Marc Damie
* [Permalink](https://eprint.iacr.org/2026/1675)
* [Download](https://eprint.iacr.org/2026/1675.pdf)
### Abstract
Multi-party computation (MPC) enables multiple parties to jointly process sensitive data without revealing their inputs. However, existing MPC protocols remain inefficient for high-dimensional sparse data. In plaintext, sparse linear algebra algorithms address this problem using two fundamental primitives, Scatter and Gather.
We propose SparseMPC, an outsourced MPC protocol that securely implements Scatter and Gather and uses them to perform sparse matrix multiplication. Our protocol supports an arbitrary number of data owners and provides a low memory footprint, constant round complexity, and low communication cost. Beyond sparse matrix multiplication, SparseMPC provides a foundation for efficiently realizing a broader class of sparse computations in outsourced MPC.
## 2026/1676
* Title: Simple and Efficient SKL-IBE with Classical Revocation from LWE
* Authors: Ho Nguyen Pham, Duong Hieu Phan, Quoc-Huy Vu, Weiqiang Wen
* [Permalink](https://eprint.iacr.org/2026/1676)
* [Download](https://eprint.iacr.org/2026/1676.pdf)
### Abstract
Secure key leasing (SKL) is a quantum cryptographic primitive that enables the leasing of decryption keys to delegated users with the
guarantee that, once revoked, the lessees irreversibly lose decryption capability. A key feature that makes SKL practically relevant is classical revocation: the ability to revoke keys at any time and from anywhere, without relying on a quantum channel.
In this work, we revisit SKL schemes for public-key encryption (PKE) and identity-based encryption (IBE), and present a new approach for concrete efficiency under the standard Learning With Errors (LWE) assumption. First, we refine the security analysis of the Dual-Regev SKL-PKE scheme with classical revocation from [Ananth, Poremba, and Vaikuntanathan, TCC 2023; Ananth, Hu, and Huang, TCC 2024], establishing security under the polynomial hardness of LWE with polynomial modulus. Together with the resource efficiency of the Dual-Regev-based construction, our analysis shows that this approach yields the most quantum-efficient known SKL-PKE scheme. Second, we present a simple and efficient construction of selectively secure SKL-IBE with classical revocation from standard LWE. Our approach directly extends the Dual-Regev SKL-PKE within the IBE framework of [Agrawal, Boneh, and Boyen, Eurocrypt 2010], avoiding garbled circuits and obfuscation-based assumptions and achieving improved concrete efficiency over prior generic approaches.
## 2026/1677
* Title: Fair-Weather No More: Guaranteed Efficiency in Secure Group Messaging * Authors: James Bartusek, Nir Bitansky, Yevgeniy Dodis, Rachit Garg, David J. Wu
* [Permalink](https://eprint.iacr.org/2026/1677)
* [Download](https://eprint.iacr.org/2026/1677.pdf)
### Abstract
Secure group messaging protocols, now standardized by the IETF as Messaging Layer Security (MLS), provide end-to-end encryption for billions of users. The cryptographic core of these protocols is continuous group key agreement (CGKA), a primitive designed to maintain a shared secret among a dynamic group while providing security guarantees like forward secrecy and post-compromise security. A critical challenge for CGKA is achieving efficiency, particularly sublinear complexity (in the size of the group), for group operations. While practical tree-based protocols like TreeKEM offer logarithmic complexity in ideal (so-called "fair-weather") scenarios, their performance degrades to linear in the worst-case, and even realistic average-case, scenarios. This performance collapse raises the fundamental question of whether any CGKA protocol can achieve provably sublinear worst-case complexity.
Prior work has established significant barriers to this goal, including black-box impossibility results ruling out efficient constructions from standard public-key encryption. Theoretical solutions circumvent these barriers using powerful tools like indistinguishability obfuscation ($i\mathcal{O}$), but these constructions are astronomically inefficient and often provide weaker security guarantees, such as lacking forward secrecy. This leaves a wide gap between practical protocols with poor worst-case guarantees and theoretical solutions that are entirely impractical.
In this paper, we narrow this gap by presenting the first CGKA protocol that achieves provably logarithmic worst-case complexity for both computation and communication. Our first construction is based on a falsifiable and plausibly post-quantum assumption called decomposed learning with errors (decomposed LWE), and achieves basic CGKA security (only group members know the key) and post-compromise security, but not forward secrecy. We then show how to extend our scheme in the random oracle model to achieve optimal security (including forward secrecy) while retaining worst-case sublinear communication. However, the forward-secure refresh operation takes linear time in the group size, while still producing compact ciphertexts.
Our work is the first to establish that worst-case efficient CGKA is theoretically possible from simple falsifiable assumptions. Moreover, it offers a plausible roadmap towards concretely efficient constructions.
## 2026/1678
* Title: Cryptanalytic Extraction of Multi-Head Softmax Attention Models
* Authors: Sunan Wang, Hao Lei, Longxiang Wei, Qun Liu, Kai Hu, Meiqin Wang
* [Permalink](https://eprint.iacr.org/2026/1678)
* [Download](https://eprint.iacr.org/2026/1678.pdf)
### Abstract
Since the seminal work of Carlini et al. at CRYPTO 2020, cryptanalytic model extraction has shown neural-networks parameters can be recovered from black-box queries. Existing attacks are largely built around piecewise-linear phenomena. Softmax attention, as the key component of the transformer architecture, presents a different extraction landscape: its nonlinearity is smooth and sequence-dependent, which renders the existing piecewise-linear-based method inapplicable. Recent work has investigated the learnability of a single-head attention model, while in the multi-head case, the parameters of the multi-head attention layer cannot be uniquely identified from value queries alone.
In this paper, we propose the first attack against multi-head attention models. We formalize the extractable representative of multi-head attention and give a polynomial-time algorithm for extracting the parameters of the canonical representative model. We also test our algorithm end to end under finite precision, and successfully extract the parameters of a softmax attention model with token dimension 8 and 6 heads to accuracy $2^{-51}$. Moreover, we overcome the limitation that existing parameter extraction algorithms for one-layer single-head Transformers fail when the ReLU feedforward networks (FFNs) include bias terms. The effectiveness of our approach is demonstrated through model extraction attacks in finite-precision experiments. These results show that softmax normalization itself exposes exploitable algebraic structure, extending cryptanalytic extraction beyond ReLU-centric techniques.
## 2026/1679
* Title: Critical-Round Special Soundness for Multi-Round Proofs
* Authors: Masayuki Abe, David Balb|is, Dung Bui, Miyako Ohkubo, Zehua Shang, Akira Takahashi, Mehdi Tibouchi
* [Permalink](https://eprint.iacr.org/2026/1679)
* [Download](https://eprint.iacr.org/2026/1679.pdf)
### Abstract
In this work, we revisit multi-round public-coin proof systems by enabling the use of their simulators and extractors within other cryptographic protocols. Although research on multi-round public-coin proofs has rapidly progressed, their simulators and extractors typically differ from the 3-move (e.g., Sigma protocols) setting in interface and behavior, and are rarely studied from this viewpoint.
Prior work [Abe et al., Eurocrypt rCO26] introduced the notion of critical-round zero-knowledge, showing that, for some classes of protocols, multi-round ZK simulators can be as useful in protocol constructions as the 3-move ones. In this paper, we focus on soundness and introduce critical-round special soundness, a property that enables multi-round witness extractors to be used in protocol design in a manner analogous to 3-move special soundness. We show that several existing multi-round public-coin proof systems satisfy this property and present three applications:
- A witness sharing scheme that verifiably secret-shares an NP witness without interaction among recipients. It can be realized in a hash-based way by combining MPC-in-the-Head with secret sharing.
- An offline trapdoor-extractable trapdoor commitment scheme where a trapdoor is extracted immediately upon a double opening. Offline trapdoor extractability was previously known from 3-move public-coin proofs, but no general construction from multi-round proofs was known; our approach closes this gap.
- A parameter improvement for the multi-round Fischlin transform [RotemrCoTessaro, CryptorCO25]. The improved parameter extends the design space of the multi-round Fischlin transform and reduces the proverrCOs complexity in practice.
Overall, our results clarify how multi-round public-coin proofs can support protocol design beyond their traditional role as stand-alone proof systems.
## 2026/1680
* Title: New Results on the Density of Irreducible NFSRs
* Authors: Daoyuan Zhang, Dongdai Lin
* [Permalink](https://eprint.iacr.org/2026/1680)
* [Download](https://eprint.iacr.org/2026/1680.pdf)
### Abstract
Nonlinear feedback shift registers (NFSRs) are fundamental building blocks for modern stream-cipher constructions. An $n$-stage NFSR $f$ is classified as irreducible when the output sequence set of $f$ does not contain the output family of any NFSR of order less than $n$. Existing research
has established upper and lower bounds for the density of irreducible NFSRs, confining this value within the range of 0.4461 to 0.4834. This study tightens these bounding intervals with high accuracy, reducing the original 0.04 gap down to only $8\times10^{-6}$.
## 2026/1681
* Title: Aegon: Self-Auditable Key Transparency
* Authors: Hossein Hafezi, Alireza Shirzad, Benedikt B|+nz, Kevin Lewi, Dillon George, Joseph Bonneau
* [Permalink](https://eprint.iacr.org/2026/1681)
* [Download](https://eprint.iacr.org/2026/1681.pdf)
### Abstract
Key transparency enables a centralized encrypted messaging provider to publicly commit to the public keys it distributes, allowing clients to detect potentially malicious keys. Recent deployments by WhatsApp and iMessage demonstrate the promise of this approach, but they rely on third-party global auditors to detect misbehavior by the key server. No existing system supports auditing efficiently enough to be done by lightweight end users while also providing scalability to billions of users and short epoch latency.
We present $\mathsf{Aegon}$, a key transparency scheme designed for global-scale encrypted messaging. Building on ideas from $\mathsf{IronDict}$, $\mathsf{Aegon}$ avoids per-epoch work that scales with the full dictionary size: its server computation depends only on the number of updates in the current epoch, eliminating global invariance proofs and enabling epoch latency of under a minute ($500\times$ reduction compared to $\mathsf{IronDict}$). $\mathsf{Aegon}$ further introduces a sharded dictionary design that reduces global parameters to shard-dependent sizes and enables horizontal scaling. To control long-term storage, $\mathsf{Aegon}$ uses proof caching to safely discard historical dictionary snapshots, so storage grows only with retained history.
We provide a production-grade Rust implementation of $\mathsf{Aegon}$ and demonstrate practical scalability to a dictionary with $4$ billion entries, comparing it against the public codebase of WhatsApp Key Transparency ($\mathsf{AKD}$). At the throughput of $1{,}250$ updates per second, $\mathsf{Aegon}$ produces constant-size auditor proofs of under $30$ KB, verifiable in under $65$ ms and independent of the number of updates per epoch or of the directory fill. At a fully-populated $2^{32}$-entry directory, this is roughly an $80{,}000\times$ reduction in audit proof size and a $370\times$ reduction in verify time relative to $\mathsf{AKD}$. All other server and client operations remain highly efficient and comparable to $\mathsf{AKD}$, while $\mathsf{Aegon}$ achieves stronger privacy guarantees.
## 2026/1682
* Title: Incomplete Ciphertext Comparison in ML-KEM: From an IND-CCA2 Break to Key Recovery
* Authors: Bhabani Sankar Das
* [Permalink](https://eprint.iacr.org/2026/1682)
* [Download](https://eprint.iacr.org/2026/1682.pdf)
### Abstract
ML-KEM is IND-CCA2 secure only because of one check inside decapsulation: the receiver re-encrypts the message it recovered and returns the true shared secret only if the result matches the received ciphertext exactly. This is the FujisakirCoOkamoto (FO) check. wolfSSL implemented it in hand-written SIMD assembly, and on two backends it compared fewer than all of the ciphertext bytes. The x86-64 AVX2 path compared 1536 of 1568 bytes; the ARM64 NEON path compared roughly half.
These bugs were documented as a weakening of IND-CCA2 security, in that a tampered ciphertext can slip past the check. We show they are worse than that. The bytes the check skips carry the tail of the decryption noise, and that noise is an exact linear function of the secret key. An attacker who varies those unchecked bytes and watches the decapsulation output reads the noise off one coordinate at a time. Stacking the measurements gives an overdetermined linear system in the secret, which we solve by ordinary least squares with no lattice reduction.
The measurement is a plaintext-checking oracle, the same primitive that key-mismatch attacks use. What is new is where it comes from. Reading it off the unchecked v-tail, rather than from chosen sparse-u ciphertexts, means it survives even when u is fully validated, as on AVX2, so the standard "validate all of u" hardening does not close it. The price is queries, 10rU| to 10rU| against a few thousand for key-mismatch, so the contribution is reach rather than efficiency.
We recover most of the ML-KEM-1024 private key end-to-end against the shipped binaries on both backends: 98.0% of the 2048 secret coefficients at 400 ciphertexts on AVX2, and 98.5% at 600 on NEON, reaching the full key with more ciphertexts (the verified reference model recovers all 2048 at about 1300 ciphertexts). The cost appears to track the geometry of which bytes go unchecked more than their number: NEON leaves about 2.5|u more coordinates unchecked than AVX2 yet needs more ciphertexts. We conclude that an incomplete FO comparison is a key-recovery vulnerability, and should be triaged as one.
## 2026/1683
* Title: Fully-Succinct Multi-Key FHE & Rate-1 Simulatable Threshold Decryption from LWE
* Authors: Abtin Afshar, Rishab Goyal
* [Permalink](https://eprint.iacr.org/2026/1683)
* [Download](https://eprint.iacr.org/2026/1683.pdf)
### Abstract
We construct the first multi-key fully homomorphic encryption (MKFHE) scheme where the ciphertext size, public key size, and secret key size remain independent of the number of users, $N$. Our construction is leveled and relies on the standard Learning with Errors (LWE) assumption.
All prior MKFHE schemes incur at least linear growth in ciphertext size with the number of users ($|\mathsf{ct}| \propto N$), a limitation that has persisted across more than a decade of research. Our results provide the first evidence that MKFHE with constant ciphertext size is achievable under standard assumptions and paves the way for many interesting applications.
We also describe a single-round distributed decryption protocol for multi-key ciphertexts in our fully-succinct MKFHE scheme. More remarkably, we show that our MKFHE scheme simultaneously satisfies the following properties: (1) the size of each user's partial decryption share is identically equal to the plaintext length (i.e., partial decryption shares are truly rate-1), and (2) an honest user's partial decryption can be simulated. To the best of our knowledge prior to this work, we did not have any MKFHE with one-round distributed decryption from standard assumptions that simultaneously satisfied both these properties. We show that our MKFHE is significantly useful in designing various forms of multi-party computation (MPC) protocols with asymptotically optimal communication complexity.
## 2026/1684
* Title: Non-Interactive Translation of Winternitz Signatures to Lamport Signatures via Secret Sharing
* Authors: Mikhail Sergeevitch, Konrad Staniec, David Tse, Nikhil Vanjani, Robin Linus Woll
* [Permalink](https://eprint.iacr.org/2026/1684)
* [Download](https://eprint.iacr.org/2026/1684.pdf)
### Abstract
BitVM2 brought arbitrary program execution to Bitcoin, yielding the first light-client-based bridge to its second layers and reducing the trust required at setup to a single honest participant. Its successors, BitVM3 and BABE, move the disputed computation off-chain into Garbled Circuits (GCs), cutting worst-case on-chain dispute costs by roughly three orders of magnitude and so opening participation beyond well-capitalized operators; BABE in turn cuts the off-chain storage and setup costs of BitVM3's garbled circuits by a comparable factor. What still reaches the chain, however, is bulkier than it need be. BitVM2 commits its data with compact Winternitz one-time signatures (WOTS), whereas BitVM3 and BABE must reveal GC input labels on-chain and so fall back on far bulkier Lamport signatures, which play two roles at once: GC input labels and Bitcoin-verifiable commitments. WOTS cannot simply be substituted, because its hash chains are monotonic---an evaluator holding one state's preimage can hash forward and obtain several active labels on a single input wire, destroying the circuit's privacy. Recovering BitVM2's compactness therefore calls for a practical GC whose input labels are WOTS signatures---a construction that has remained out of reach. We close this gap with a non-interactive \emph{WOTS-to-Lamport translation gadget}: the garbler commits on-chain using compact WOTS chains, and the evaluator expands them off-chain into exactly the orthogonal Lamport labels the GC consumes, learning nothing about the mutually exclusive ones. A naive translation table that enumerated messages would be exponentially large. Two symmetries bring it down to quadratic: reconstruction from a Shamir sharing depends only on \emph{how many} shares are held and not on \emph{which}, which collapses the exponentially many messages onto the single checksum weight WOTS already computes; and monotonicity, the very property that made WOTS unusable, orders an evaluator's access by inclusion. We model the gadget as a garbling scheme and prove it adaptively private. Applied to BABE, it restores WOTS-scale commitments to a GC-based protocol, cutting total on-chain script size by more than $3\times$ and bringing dispute transactions within Bitcoin's standardness limit.
## 2026/1685
* Title: Pruning Merkle-Tree Consistent Accumulator
* Authors: Anna Mendonca, Hudson Shi, Ivan Pryvalov, Amir Herzberg
* [Permalink](https://eprint.iacr.org/2026/1685)
* [Download](https://eprint.iacr.org/2026/1685.pdf)
### Abstract
Authenticated data structures are widely used to compute compact
digests of evolving collections of elements and to support efficient verification of element inclusion. However, the authenticated collection often should not grow forever: older elements may expire and no longer require verification. Many implemented append-only approaches, for example used in Certificate Transparency (CT), do not directly support this setting, since previously accumulated elements remain part of the authenticated state indefinitely. In this work, we introduce a pruning accumulator, a stateful accumulator that supports both incremental addition of new elements and pruning of an old prefix of previously accumulated elements. The resulting digest represents the unpruned sequence, while pruned elements are removed from the authenticated state. Unpruned elements continue to support proof-of-inclusion verification, proof
updates, update verification, and consistency checks. This captures applications that require authenticated, incrementally maintained state over a moving window of elements.
We present two constructions of Merkle-tree-based pruning accumulators, both with efficient accumulation, prefix pruning, proof generation, proof updating, and verification. The constructions preserve the standard Merkle-tree style of verification for active elements while reducing long-term storage requirements.
We provide formal definitions, correctness and security analysis, an open-source implementation, and experimental evaluation demonstrating the performance benefits of pruning.
## 2026/1686
* Title: A Unifying Umbrella for Circular-Secure Cryptographic Primitives
* Authors: Fuyuki Kitagawa, Takahiro Matsuda
* [Permalink](https://eprint.iacr.org/2026/1686)
* [Download](https://eprint.iacr.org/2026/1686.pdf)
### Abstract
The main message of this paper is that several seemingly different circular-style primitives are existentially equivalent. In particular, somewhat surprisingly, we show that hinting PRGs (Koppula and Waters, CRYPTO 2019) are equivalent to secret-key encryption (SKE) schemes satisfying key-dependent-message (KDM) security. As a conceptual centerpiece, we introduce key-dependent-shift (KDS) security for weak pseudorandom functions (PRFs), and show that they serve as a convenient hub connecting these primitives. We also show that KDS secure weak PRFs imply other cryptographic primitives with circular-style security, such as linear-resistant PRGs (Hajiabadi et al., ITC 2023) and hinting weak PRFs (Alamati and Patranabis, ASIACRYPT 2022), all of which are thus existentially equivalent to KDM secure SKE and hinting PRGs as well. Hence, KDS secure weak PRFs can be thought of as a unifying umbrella for circular-secure cryptographic primitives. As another application of our new notion, we show that KDS security enables new constructions of public-key encryption (PKE) satisfying randomness-dependent-message (RDM) security and correlated-product secure trapdoor functions (TDFs). Our key technical contribution is a generic construction of KDS secure weak PRFs from any KDM secure SKE.
## 2026/1687
* Title: Theoretical Open Problems in Symmetric Cryptography: Verifiable LLM-Guided Analysis
* Authors: Yufei Yuan, Yaoda Hu, Yixin Zhang, Lei Zhang, Wenling Wu
* [Permalink](https://eprint.iacr.org/2026/1687)
* [Download](https://eprint.iacr.org/2026/1687.pdf)
### Abstract
We present the Pilot--Sailor Framework, an LLM-guided system for studying theoretical open problems in symmetric cryptography. Pilot proposes intermediate statements and proof plans. Sailor attempts formal proofs, and the proof assistant admits only checked declarations to the verified context.
We apply this methodology to Boolean-function theory and symmetric cryptanalysis through fourteen mathematical case studies, comprising complete resolutions, corrected formulations, counterexamples, and scoped quantitative advances. In particular, we prove the original pointwise Tu--Deng conjecture for all word lengths and admissible residues. We further characterize equality in this bound: if \(t\) has \(z\) zero bits, equality holds exactly when every cyclic gap between consecutive zeros is at least \(z\). This criterion also gives a closed formula for the number of equality cases for each \(z\). We also prove that, for \(n=2k\geq6\) and \(k<m<2k\), every mapping \(F:\mathbb F_2^n\to\mathbb F_2^m\) satisfies
\(\operatorname{NL}(F)\leq2^{n-1}-2^{n/2-1}-2\). This improves both the covering-radius estimate and the bound obtained from Nyberg's obstruction and integrality. Using an exact computer-assisted spectral classification, we also prove that the maximum nonlinearity of a balanced Boolean function in eight variables is 116, resolving whether the value 118 can occur. Beyond the well-known long-standing problems highlighted above, we also establish new results for ten further research questions in symmetric cryptography.
## 2026/1688
* Title: HellrCOs Bells: A Neural Network Pipeline for Ternary Fast Matrix Multiplication Algorithms
* Authors: Erik M|Nrtensson, Paul Stankovski Wagner, Joshua Stapleton
* [Permalink](https://eprint.iacr.org/2026/1688)
* [Download](https://eprint.iacr.org/2026/1688.pdf)
### Abstract
We present a neural network-based pipeline for efficiently generating fast matrix multiplication (FMM) algorithms of small but arbitrary dimensions $(n,m,k)$. Our neural network is general and tunable to output FMM schemes with specific properties, and in this paper we specifically target aspects that are useful and important in practical implementation, such as ternarity (coefficients in $\{-1, 0, 1\}$), sparseness and a low number of additions after optimization (addition reduction carried out separately).
We generate and optimize thousands of FMM algorithms and show that our generation method is beneficial in terms of performance across the entire FMM pipeline (both the FMM generation itself and optimization of additions).
We discuss performance metrics and utilize heatmaps to visualize and understand this performance.
We achieve record-low arithmetic (additive) complexity for various combinations of dimensions. For $(n,m,k) = (2,2,k)$, our method performs particularly well. Our improvement compared to previous results increases with $k$.
We show that the (addition) optimization process can behave very differently depending on the dimensions considered, indicating how further improvements (beyond our results) can be targeted.
In particular, in the $(n,m,k) = (2,2,k)$ setting, we show evidence of structural FMM properties coming into play, concretely showing that FMM generation with a minimal number of additions is sometimes suboptimal with respect to the entire FMM pipeline.
Finally, we make our neural network implementation, our generated FMM schemes, heatmap utilities and datasets publicly available.
## 2026/1689
* Title: A Hybrid Post-Quantum Encryption Architecture with Self-Hosted Key Management for SME Cloud Data Protection
* Authors: Muhammad Shaheer Bin Junaid
* [Permalink](https://eprint.iacr.org/2026/1689)
* [Download](https://eprint.iacr.org/2026/1689.pdf)
### Abstract
Harvesting ciphertext from cloud storage needs no quantum computer; decrypting it later does. That gap
is the harvest-now-decrypt-later exposure: anything protected by RSA or ECDH today that must stay secret for
decades is already compromised. Small and medium-sized enterprises are least able to respond: they neither run the
infrastructure on which their data sits on nor employ a cryptographer. Bespoke migration suits firms with security
budgets; a managed key service relocates trust rather than removing it. The obstacle is architectural, not cryptographic.
We present Quantum Cloud Guard (QCG), a software-only three-layer architecture. No prior SME-oriented system
combines its three elements: client-side hybrid post-quantum encryption, self-hosted key custody with client-verifiable
ML-DSA-87 signatures on served keys, and an integrated application-layer abuse-prevention gateway. Files never
leave the client: each is sealed under AES-256-GCM, its key wrapped to an ML-KEM-1024 public key from the
enterpriserCOs key service. The enterprise alone administers it; it signs every key with ML-DSA-87, so a client that
pinned it detects substitution. Separating key custody from data custody is the point: a provider holding both can read
the data. On a 24 MHz STM32F407, ML-KEM-1024 key generation takes 40.8 ms and decapsulation 44.0 ms; on the
server every post-quantum operation stays sub-millisecond, signing adding 0.24 ms per request. The service runs on
a 4.49 EUR/month virtual server. Under sustained flooding, the in-process gateway Sentinel Gate rejected 98.8% of
attack traffic while a legitimate clientrCOs median latency moved from 621 to 625 ms. Being single-source, this shows
filtering effectiveness, not DDoS resilience.
## 2026/1690
* Title: Concurrently Secure Compact Blind Signatures from Module-SIS
* Authors: Olivier Blazy, Lola-Baie Mallordy, Weiqiang Wen
* [Permalink](https://eprint.iacr.org/2026/1690)
* [Download](https://eprint.iacr.org/2026/1690.pdf)
### Abstract
A blind signature scheme allows a user to interact with a signer to obtain a valid signature on a message, while ensuring that the signer cannot learn any information on the message being signed, nor link a given couple message-signature to the specific interaction that produced it (blindness). In round-optimal (i.e., two-move) blind signature schemes, a user sends a request (typically a commitment) for a message, and the signer responds with a signature. To achieve blindness, the resulting blind signature usually consists of a zero-knowledge proof of knowledge of a valid signature from the signer on a request. This reliance on zero-knowledge proofs has become the main bottleneck in reducing the blind signature size. In particular, state-of-the-art lattice-based blind signature schemes are instantiated based on the zero-knowledge proof system from [Lyubashevsky et al., EUROCRYPT, 2022], which results in blind signatures of at least 22 KB.
In this work, we carefully design a blind signature protocol following the classical lattice-based +u-protocol as in [Ducas et al., CRYPTO, 2013], so that the last component naturally forms a short preimage of the hash of the message, as a classical GPV signature. As a result, this removes the need for zero-knowledge proofs in the blind signature. Eventually, this design allows us to obtain a significantly more compact blind signature of size 4.7 KB, with concurrent security under the Module-SIS assumption. As a trade-off, our protocol may require more than one round with small probability, due to the rejection sampling in lattice-based +u-protocols. Under our proposed parameters, however, the expected number of rounds for honest users can be as small as 1.1, which is very close to optimal. To minimize the number of rounds, we require users to prove that they failed to derive a blind signature in the previous round, before starting a new one. This technique yields a moderately looser bound on the expected number of rounds for malicious users, who will be forced to terminate in at most 2.6 rounds.
## 2026/1691
* Title: Equivalence Between Average-Case Hardness of Learning and Cryptography for Mixed Quantum States
* Authors: Alexandru Cojocaru, Laura Lewis
* [Permalink](https://eprint.iacr.org/2026/1691)
* [Download](https://eprint.iacr.org/2026/1691.pdf)
### Abstract
The relationship between cryptography and learning theory has long been a central theme in the foundations of theoretical computer science: cryptographic primitives can imply hardness of learning, while hardness of learning can in turn be used to construct cryptographic schemes. Recent works have begun exploring analogous connections in the quantum setting, relating the average-case hardness of learning quantum states (AHL) to cryptographic primitives such as one-way state generators (OWSG). Despite recent progress exploring this for pure states, the relationship for mixed states has remained an open question.
In this work, we prove that the existence of AHL for mixed quantum states is equivalent to the existence of inefficiently verifiable one-way state generators (IV-OWSGs). As a consequence, this relates mixed-state AHL to EFI pairs. Moreover, as a corollary of existing results, we obtain a separation between IV-OWSGs and OWSGs relative to the SWAP oracle.
## 2026/1692
* Title: From Round Skipping to S-Box Skipping: Attacking Poseidon's Partial Layer via Subspace Restriction
* Authors: Amit Singh Bhati, Sundas Tariq, Tomer Ashur
* [Permalink](https://eprint.iacr.org/2026/1692)
* [Download](https://eprint.iacr.org/2026/1692.pdf)
### Abstract
Poseidon [Grassi, Khovratovich, Rechberger, Roy, and Schofnegger; USENIX'21] is an arithmetization-oriented (AO) hash function designed to be efficient in real-world zero-knowledge (ZK) applications. We present GSR, a generalized S-box skipping gadget that absorbs a single initial full round and $t-2k$ partial rounds without increasing the polynomial degree of the Poseidon polynomial system with state size $t$ and input-output constraints $2k$. By restricting the subspace of the total constraints satisfying solutions, independent of the rounds constants and MDS matrix selection, the distinguisher expends input degrees of freedom to linearize the internal state transitions where the dense algebraic mixing usually occurs. This maps a computationally infeasible polynomial system into a bounded, low-degree ideal parameterized by $k$ free variables.
We show how to use the gadget to construct a probability 1 distinguisher over $t-2k+1$ rounds of Poseidon. We then show how this distinguisher can be used as a basis for interpolation-based attacks. We go on to present experimental solutions to the CICO-1 problem over 28 out of 31 rounds and CICO-2 problem over 25 out of 31 rounds in the setting set by the Ethereum Poseidon initiative (i.e., using the KoalaBear field with $t=24$ and $\alpha=3$). Crucially, since the subspace restriction approach is tuned only by $t$ and $k$, our results apply to the Poseidon structure regardless of the choice of round constants, MDS matrix, S-box exponent $\alpha$, or field size $p$.
## 2026/1693
* Title: The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP
* Authors: Aparna Gupte, Seyoon Ragavan, Mark Zhandry
* [Permalink](https://eprint.iacr.org/2026/1693)
* [Download](https://eprint.iacr.org/2026/1693.pdf)
### Abstract
In this note, we formally show that the recent algorithm by Simon (ePrint:2026/1591, August 11 2026) does not extract the least-significant bit of the dihedral coset problem (DCP) secret with non-negligible guessing advantage, and therefore does not solve DCP. We emphasize that our result is not merely about Simon's analysis of his algorithm; we are showing directly that the algorithm cannot possibly work.
Our no-go encompasses a much broader class of algorithms than the specific algorithm by Simon. The main message of our no-go is that an algorithm for DCP following the template of the reduction by Regev (SIAM Journal on Computing, 2004) will probably have to make extensive use of the classical Fourier labels in the uncomputation stage. On the other hand, the algorithm by Simon can be implemented, up to error $\mathsf{poly}(n)2^{-n/3}$, using only the most-significant third of the classical Fourier labels, and therefore cannot succeed.
To help with verifiability, we release Lean 4 code for our results, available at https://github.com/sragavan99/lean-ePrint-2026-1591-refutation.
## 2026/1694
* Title: Relations Between the Uniform MQ Assumption and Other Multivariate Assumptions
* Authors: Zijun Zhuang, Yingjie Zhang, Jintai Ding
* [Permalink](https://eprint.iacr.org/2026/1694)
* [Download](https://eprint.iacr.org/2026/1694.pdf)
### Abstract
The uniform multivariate quadratic (UMQ) assumption states that it is hard to find a zero of a uniformly generated MQ function. It is the average-case hardness assumption about the MQ problem. In this paper, we investigate the relations among the UMQ assumption, the MQ one-wayness (MQOW) assumption, and the MQ second-preimage resistance (MQSPR) assumption.
We show that UMQ and MQSPR tightly imply each other, and MQOW tightly implies UMQ. Then, we show that UMQ implies MQOW when $m\leq n+O(\log\lambda)$, where $n$ is the number of variables, $m$ is the number of MQ equations, and $\lambda$ is the security parameter. In particular, when $m\leq n+O(1)$, this implication is tight.
As a corollary, we show that MQSPR implies MQOW under the same condition $m\leq n+O(\log\lambda)$, which is weaker than the compression condition $n=m+\omega(\log\lambda)$ required for the implication from SPR to OW for general function families. In particular, our result covers the square case $m=n$ as well as mildly overdetermined MQ systems satisfying $m=n+O(\log\lambda)$.
## 2026/1695
* Title: On the Impossibility of Robust Combiners for Cryptographic Groups
* Authors: Cong Zhang, Wenli Wang, Taiyu Wang, Hong-Sheng Zhou, Pengfei Chen, Zhihong Jia, Jian Liu, Jinfei Liu, Moti Yung, Kui Ren
* [Permalink](https://eprint.iacr.org/2026/1695)
* [Download](https://eprint.iacr.org/2026/1695.pdf)
### Abstract
A $(k,n)$-robust combiner for a primitive $\mathcal{P}$ combines $n$ candidate instantiations of $\mathcal{P}$ into a single scheme that remains secure as long as at least $k$ of them remain secure. Robust combiners have been extensively studied for primitives such as hash functions, public-key encryption, and oblivious transfer, but much less is known in the setting of cryptographic groups. In this work, we initiate the study of robust combiners for cryptographic groups in Maurer's generic group model (GGM), where algorithms access group elements only through abstract algebraic operations.
We ask whether one can combine $n$ candidate groups into a single group that remains secure provided that at least $k$ of the underlying groups remain secure. A natural baseline is the direct-product construction, which preserves search hardness but fails for decisional assumptions and incurs substantial representation overhead. We show that these limitations are in fact inherent.
Our first result is a complete impossibility for the decisional Diffie--Hellman assumption: for every polynomially bounded $n$ and $k$ with $k<n$, there is no generic $(k,n)$-robust combiner for cryptographic groups that preserves DDH security. Our second result gives a tight threshold for search assumptions in the regime where $n$ and $k$ are fixed constants. For the discrete logarithm problem, robust generic combination is possible when the combined group order is large enough to encode the secrets of $n-k+1$ components; concretely, if $\log N \ge (n-k+1)\lambda$, where the component groups have distinct $\lambda$-bit prime order, then a robust combiner exists. Conversely, if $\log N \le (n-k)\lambda$, then no generic $(k,n)$-robust DLog-secure combiner exists.
These results identify a fundamental limitation of robust hedging at the group level. Decisional assumptions such as DDH cannot be robustly combined in the GGM, while search assumptions admit robustness only at essentially optimal representation cost. Consequently, robustness for group-based cryptography must in general be achieved at higher layers, such as protocol design or key derivation.
## 2026/1696
* Title: Toward Secure Compilation: Leakage Detection for Masked Implementations in Jasmin
* Authors: Nicolai Schmitt, Sven Wroblewski, Fabio Campos, Andreas Heinemann
* [Permalink](https://eprint.iacr.org/2026/1696)
* [Download](https://eprint.iacr.org/2026/1696.pdf)
### Abstract
Masking is a well-established software countermeasure against side-channel attacks, yet even algorithmically correct masked implementations can leak on real hardware once the compiler has performed instruction selection, register allocation, and stack allocation. Existing approaches either rely on leakage simulation, which is tied to a specific power model and computationally expensive, or on formal verification of the source program, which does not capture the effects introduced by the subsequent compilation stages. We address this gap from within the compiler and propose a leakage detection pass for the Jasmin language, integrated into its formally verified pipeline and operating on the intermediate representation before register and stack allocation. Rather than simulating power traces, the pass implements a configurable, microarchitecture-oriented leakage model that tracks the contact between shares, secrets, random values, and public values, making the root causes of the detected leakage explicit and enabling the detection of masking-order reductions. We validate the pass on 60 dedicated Jasmin test snippets covering all considered leakage sources and category combinations, and intend it as the foundation for a subsequent compiler stage that automatically removes the detected leakage, thus constituting a first step toward secure compilation.
## 2026/1697
* Title: Actively Secure Two-Party Function Secret Sharing with Dynamic Cross-Phase Verification
* Authors: Yujie Xue, Lin Liu, Rongmao Chen, Yizhen Jiang, Yuchuan Luo, Bing Sun, Shaojing Fu
* [Permalink](https://eprint.iacr.org/2026/1697)
* [Download](https://eprint.iacr.org/2026/1697.pdf)
### Abstract
Function secret sharing (FSS) gives two parties succinct keys whose local evaluations add up to a hidden function value. Removing the dealer is the natural next step for preprocessing-based secure computation, but malicious security then requires more than checking a finished key: the generation transcript, the function the key actually computes, and every released evaluation share must all be bound to one execution. We call this the cross-phase binding problem, and we solve it.
We present VeriFSS, a dealer-free two-party FSS scheme with active security, proved in the standard simulation-based framework against one static malicious corruption. The construction rests on a two-plane key: the distributed generator produces a key for the paired function $x\mapsto(f_\theta(x),\Lambda f_\theta(x))$, where $\Lambda$ is a secret global authentication scalar. The second plane makes every local evaluation an authenticated sharing for free, which yields online report binding without vector commitments, extractable hashing, or per-point interaction. It also supplies the ingredient the audit was missing: we prove a moment-fidelity lemma showing that a corrupted party cannot misreport the full-domain moments of its own sealed key except with probability $3/|E|$ over the challenge set $E$, and a shape-identification lemma showing that three moment equations pin a point function down exactly, with error $2n/|E|$ over any field. The proof isolates the coefficient of the square monomial in the support polynomial and is therefore characteristic-free; in characteristic two an odd-size equal-weight support defeats the support equation on its own, and we show the position equation takes over. A discrete-derivative reduction carries both lemmas to comparison functions, and a Galois-ring variant covers fixed-point payloads over $\mathbb{Z}_{2^k}$ by a $2$-adic valuation argument, so no non-additive lift into a binary field is ever needed.
Generation costs two rounds and five field elements per party per level; certification adds $O(n)$ elements with no dependence on the domain size, and a dynamic cross-domain aggregation certifies arbitrarily many heterogeneous instances under one challenge and a constant number of rounds. We then lift the general-purpose FSS gates of Boyle et al. (EUROCRYPT 2021): every gate that is a public affine post-processing of a constant number of DPF/DCF evaluations---interval containment, splines, ReLU, arithmetic shift, bit decomposition, zero test, table lookup---inherits active security at no additional online cost.
We evaluate our construction using a C++ implementation that certifies keys over $\mathbb{F}_{p^2}$ ($p=2^{61}-1$) and $\mathrm{GF}(2^{128})$, realises the gate layer, and agrees bitrCaforrCabit on every exported test vector. A certified DPF key at $n=16$ takes $5.7$ ms to generate and $3.3$ ms to certify. Certified DPF keys are $5.4\%$ larger than the semi-honest dealer-free baseline at $n=16$, and aggregated certification traffic converges to $1{,}282$ bytes per instance while the round count stays constant. Replaying the certified execution between two processes over TCP shows what that constancy is worth: at a $50$ ms round trip a session takes $1.15$ s, and the figure is unchanged whether one key or sixty-four are certified together, so wide-area certification of a whole preprocessing session is latency-bound by a single key. A campaign of $1{,}400$ injected generation deviations plus shape, moment and release forgeries is rejected without exception in six of seven deviation classes; the seventh is rejected in exactly the $105$ of $200$ trials in which the attacked index bit is one, which is a quantitatively exact confirmation of the single-bit selective-failure predicate that we model explicitly in the ideal functionality, matching the leakage profile of the best known actively secure distributed DPF.
## 2026/1698
* Title: MamaBearZKP: A Holistic Co-design of Prime Fields and Proving Stacks for High-Throughput ZKP on Modern CPUs
* Authors: Jipeng Zhang, Yanpei Guo, Tao Lu, Hao Cheng, Jiaheng Zhang
* [Permalink](https://eprint.iacr.org/2026/1698)
* [Download](https://eprint.iacr.org/2026/1698.pdf)
### Abstract
Sum-check and Fast Fourier Transforms (FFTs) dominate the computational cost of modern zero-knowledge proving systems, such as HyperPlonk (Eurocrypt 2023) and FRI-based schemes like DeepFold (USENIX Security 2025). Despite numerous optimizations, existing efforts remain fragmented across algorithmic, protocol, and implementation layers, leaving significant CPU performance potential untapped.
We present MamaBearZKP, a co-designed framework that bridges these layers to enable high-throughput ZK proving on modern CPUs. At its core, MamaBearZKP leverages MamaBear, a 49-bit prime field ($p = 2^{49} - 2^{34} + 1$), and introduces a systematic vectorization framework specifically tailored for the AVX-512IFMA execution model. By treating field arithmetic, protocol structure, and low-level hardware primitives as a unified optimization target, MamaBearZKP achieves unprecedented efficiency.
We instantiate our framework in a HyperPlonk-DeepFold prover and obtain single-thread speedups of up to $42\times$, $33\times$, $15\times$, $21\times$, and $21\times$ for ZeroCheck, ProductCheck, DeepFold Commit, DeepFold Open, and end-to-end proof generation, respectively, compared to a Goldilocks-based baseline on the same platform. With 8-thread execution, the corresponding speedups increase to as much as $64\times$, $47\times$, $81\times$, $45\times$, and $45\times$. Across our end-to-end evaluations, MamaBearZKP also achieves up to $18\times$ single-thread speedup over Plonky3, which already uses an AVX-512 BabyBear backend.
Rather than resulting from isolated improvements, these gains arise from a synergistic cascading effect: the 49-bit fieldrCOs headroom enables efficient lazy reduction, which paves the way for high-performance fused fold-and-evaluate kernels. The efficiency of these kernels facilitates a unified stay-packed dataflow throughout the HyperPlonk and DeepFold stacks; it is precisely this end-to-end dataflow that materializes the hardware throughput of AVX-512IFMA into realized performance gains.
## 2026/1699
* Title: DumboMix: Robust Asynchronous Anonymous Broadcast Made Practical
* Authors: Wei Tang, Hanwen Feng, Jiliang Li, Yuan Lu, Qiang Tang
* [Permalink](https://eprint.iacr.org/2026/1699)
* [Download](https://eprint.iacr.org/2026/1699.pdf)
### Abstract
We present a practical framework $\mathsf{DumboMix}$ for asynchronous anonymous broadcasts with guaranteed output delivery (G.O.D., a.k.a. robustness), enabling a set of $n$ servers to privately solicit $N$ messages from distinct clients, such that these messages remain secret until they are simultaneously revealed in a uniformly random order. Here, asynchronous G.O.D. ensures that all solicited messages will eventually be randomly mixed despite (i) arbitrary malicious behaviors by up to $n/3$ Byzantine servers and (ii) unpredictable network delays and jitters.
At the core of $\mathsf{DumboMix}$, we first propose a couple of practical arithmetic circuits $\mathsf{DumboMix1}$ and $\mathsf{DumboMix2}$ for mixing in Shamir-secret-shared multi-party computation (MPC) over $\mathbb{Z}_p$, along with their server-optimized variants. When randomly mixing $N$ messages, their online phases require only $\mathcal{O}(1)$ multiplicative depth, expected $\mathcal{O}(N^2)$ scalar multiplications (between public and shared values), and up to $\mathcal{O}(N)$ MPC multiplications (between shared values). Moreover, assuming a robust underlying MPC framework, they guarantee that all revealed inputs are uniformly shuffled. In contrast, existing techniques fail to achieve all these performance and functionality features: The DC-net variant $\mathsf{Blinder}$ (CCSrCO20) may reveal a non-negligible fraction of inputs without shuffling them; Butterfly switching networks in secret-shared MPC (CCSrCO19) incur $\mathcal{O}(\log^2 N)$ multiplicative depth; RabbitMix (SecurityrCO24) requires $\mathcal{O}(N^2)$ MPC multiplications; and PowerMix (CCSrCO19) incurs $N^{3}/2$ scalar multiplications.
We also implement our mixing methods within $\mathsf{DumboMPC\text{++}}$, our computation-optimized implementation of the state-of-the-art robust AMPC framework $\mathsf{DumboMPC}$ (SecurityrCO25), which provides more concretely efficient offline preprocessing while preserving asynchronous G.O.D. and optimal resilience. We then conduct extensive evaluations with $n=4$ to $31$ servers under varying network settings, revealing that our new mixing circuits achieve 44.8--65.9|u (resp. 37.1--52.7|u), 4.8--7.1|u (resp. 3.9--5.5|u), and 2.7--4.0|u (resp. 5.1--7.2|u) speedups over RabbitMix, PowerMix, and the butterfly switching network, respectively, when shuffling 1024 messages in LAN (resp. WAN).
## 2026/1700
* Title: Qlapoty: Improved analysis and eN4aciency for quaternionic ideal to isogeny transformation
* Authors: Max Duparc, Antonin Leroux, Sina SchaeN4aer
* [Permalink](https://eprint.iacr.org/2026/1700)
* [Download](https://eprint.iacr.org/2026/1700.pdf)
### Abstract
The quaternionic ideal-to-isogeny translation is a central building block of SQIsign. While the Qlapoti algorithm by Borin, Invernizzi, Corte-Real Santos, Eriksen, Mula, Schaeffler and Vercauteren significantly simplified and accelerated this step, it does not treat several technical details in sufficient depth, resulting in a flawed analysis of its failure probability. Additionally, several discrepancies between the implementation of Qlapoti and the paper's pseudocode were never analyzed explicitly. We address these shortcomings and add further improvements, resulting in a new norm equation solving algorithm with negligible failure probability.
Our C implementations shows 6x to 9x speedups compared to Qlapoti's norm equation solver, and 1.3x-2.1x speedups for a SQIsign NIST2 signature (depending on NIST levels).
## 2026/1701
* Title: DTRU: A Versatile, Compact, Simple, and Robust NTRU KEM with Double $E_8$ Encoding
* Authors: Hengchuan Zou, Songlin Li, Jieyu Zheng, Xiaowen Hu, Hanyu Wei, Weizhi Ao, Yifan Dong, Wenbo Guo, Yunlei Zhao
* [Permalink](https://eprint.iacr.org/2026/1701)
* [Download](https://eprint.iacr.org/2026/1701.pdf)
### Abstract
Responding to China's 2025 call for commercial cryptographic standards mandating 128-bit, 256-bit, and 512-bit security (optional 384-bit), we propose DTRU, a versatile, compact, simple, and robust NTRU-based key encapsulation mechanism (KEM). Our principal design contribution is double $E_8$ encoding, which constructs 16-dimensional lattice codes from $E_8$ with low decoding complexity. We further provide a detailed analysis of decryption-failure probability under this encoding mechanism.
DTRU's design achieves a careful balance among versatility, compactness, simplicity, and robustness. To accommodate diverse application requirements, it supports multiple ring structures, including power-of-two cyclotomic rings, tricyclotomic rings, and large-Galois-group prime-degree prime-ideal number fields (LPPNF). The double $E_8$ encoding enables DTRU to achieve enhanced error correction with compact bandwidth. The design prioritizes simplicity to facilitate deployment on low-power devices, achieved by eschewing additional coefficient compression techniques and redundant invertibility checks during key generation, while enabling circuit/code reuse. Security robustness is guaranteed through parameter selections that offer adequate security redundancy, mitigating potential cyclotomic ring risks via LPPNF, and precluding sparse noise distributions in the recommended parameter sets.
Complementing our theoretical advances, we present comprehensive implementations of all the parameter sets with dedicated support for C, AVX2, and ARM platforms, leveraging architecture-specific optimizations. For example, compared to NTRU-HRSS and Kyber at the same security levels, our KEM is 49%-52% more compact and 3.84rCo15.69$\times$ faster than NTRU-HRSS in the round-trip time of ephemeral key exchange, and is 7%-27% more compact and 1.05rCo1.32$\times$ faster than Kyber.
--- Synchronet 3.22a-Linux NewsLink 1.2