From Newsgroup: sci.crypt

## In this issue
1. [2025/1225] Lattice EPID with Efficient Revocation
2. [2026/217] Cavefish: Communication-Optimal Light Client ...
3. [2026/261] Logarithmic-Depth Pseudorandom Functions from Well- ...
4. [2026/368] Additions, Multiplications, and the Interaction In- ...
5. [2026/1052] Full Key Recovery of Masked PRESENT on an Out-of- ...
6. [2026/1542] Signing-Key Recovery from Unsalted Root Expansion ...
7. [2026/1548] Revisiting the Wedge Attack on UOV problem
8. [2026/1561] LiftWHIR: A Prover-Efficient Polynomial Commitment ...
9. [2026/1786] Bit Operation Cost of ``Holdout'' Key-Recovery ...
10. [2026/1793] Exact CVP Is NP-Complete for Principal Cyclotomic ...
11. [2026/1794] Ideal Secret Sharing Schemes over Small Domains
12. [2026/1795] On Removing Interaction from Quantum Proofs
13. [2026/1796] UdMAC: Efficiently Updatable Message Authentication ...
14. [2026/1797] High-Precision Lewis Weights via Fourth-Moment ...
15. [2026/1798] Generalized Greedy Algorithms for Synthesizing Low- ...
16. [2026/1799] Two Constructions of Rotation-Symmetric Bent ...
17. [2026/1800] Separating Quantum Indistinguishability Obfuscation ...
18. [2026/1801] Security Analysis on a Secure Medical Data Sharing ...
19. [2026/1802] VERIF: An Efficient Zero-Knowledge Proof System for ...
20. [2026/1803] Adaptive Multi-Algorithm Key Exchange for Quantum- ...
21. [2026/1804] Dealing Haystack: Towards Trustless Haystack in the ...
22. [2026/1805] On Module Lattices with Galois-Symmetries: What You ...
23. [2026/1806] Practical Differential Fault Attacks on the GPRS ...
24. [2026/1807] A (6, 4) Vectorial Boolean Function With ...
25. [2026/1808] Cross-Signature Signing-Key Recovery and Domain- ...
26. [2026/1809] PikkuFold: Efficient Folding in a Few Kilobytes
27. [2026/1810] An Algebraic-Geometry Lower Bound against the ...
28. [2026/1811] Efficient Soft Analytical Side-Channel Attacks on ...
29. [2026/1812] Communication-Efficient Private Join and Compute ...
30. [2026/1813] Atom: Single-Server Private Information Retrieval ...
31. [2026/1814] LetoPIR: Fast Keyword Private Information Retrieval ...
32. [2026/1815] Novel SMT Encoding for Quantum Circuit Optimization
33. [2026/1816] From Lattices to Tensor Cores: Accelerating Private ...
34. [2026/1817] ATLAS: Automated Approximation of Transformers for ...
35. [2026/1818] Blood MERIDIAN: a blockcipher that is not a blockcipher
36. [2026/1819] On Memory Effects in PWXL variants
37. [2026/1820] Practical Silent Threshold Signatures and Silent ...
38. [2026/1821] Concrete Security Assessment of Isogeny-based ...
39. [2026/1822] Non-Malleable Reductions of Knowledge
40. [2026/1823] HyperSolver: Asymptotically and Concretely ...
41. [2026/1824] Comparing Privacy-Preserving Revocation for the ...
42. [2026/1825] Enhanced Differential-linear Cryptanalysis of ...
43. [2026/1826] Threshold Encryption with Internally Motivated ...
44. [2026/1827] AVXPoS: Reducing Consensus Verification Cost in the ...
45. [2026/1828] WeaveTLS: High-Throughput Cross-Connection ML-DSA ...
46. [2026/1829] Decomposed LWE is Equivalent to Succinct LWE
47. [2026/1830] The Extended Wedge Attack
48. [2026/1831] Silent-Share: Decoupling Hidden Threshold Matching ...
49. [2026/1832] Universally Composable Hybrid PAKE Secure Against ...
50. [2026/1833] On the Fault Injection Security of White-box Ciphers
## 2025/1225
* Title: Lattice EPID with Efficient Revocation
* Authors: Corentin Jeudy, Olivier Sanders
* [Permalink](https://eprint.iacr.org/2025/1225)
* [Download](https://eprint.iacr.org/2025/1225.pdf)
### Abstract
Enhanced Privacy Identification (EPID) is one of the anonymous authentication mechanisms that found their way into the industry, being deployed in billions of chips and standardized at ISO. The linchpin of EPID lies in its decentralized revocation procedure that allows to revoke a signer by simply placing one of its signatures on a signature revocation list SRL. Each new signature must then include a proof that it has been generated with a key different from those used to produce the signatures on the SRL. This proof of non-revocation in current post-quantum schemes either relies on general-purpose NIZKs or on regular zero-knowledge proofs (ZKP) but with a witness dimension linear in the size of the SRL, which leads to large size and/or computational complexity.
In this paper, we rethink the standard approach of non-revocation so as to avoid its heavy reliance on ZKP. Our construction indeed combines features from different tools (such as Falcon signatures) that are unusual in this context to pull most elements out of the ZKP, leading to significant performance improvements. Providing all these elements unconcealed creates many security challenges for our construction but we yet manage to address all of them and prove security under well-understood lattice assumptions, and in the strong model of Sanders-Traor|- (CT-RSA'21) allowing malicious SRLs.
## 2026/217
* Title: Cavefish: Communication-Optimal Light Client Protocol for UTxO Ledgers * Authors: Aggelos Kiayias, Marc Roeschlin, Polina Vinogradova, Daniel Morales, Pyrros Chaidos
* [Permalink](https://eprint.iacr.org/2026/217)
* [Download](https://eprint.iacr.org/2026/217.pdf)
### Abstract
Blockchain light clients (LCs) are agents with limited computational or storage resources that cannot maintain a fully validated copy of the ledger. They rely on service providers (SPs), typically full nodes, to access data required for tasks such as constructing a transaction (Tx) or interacting with off-chain applications.
We introduce Cavefish, a novel protocol for UTxO-based platforms that enables LCs to interact with the ledger and submit a transaction (Tx) with minimal trust, storage, and computation, without having to synchronize to the chain. The LC specifies a Tx (e.g., by specifying a source address rather than source UTxOs, a destination and value, and a change address), and the SP constructs it, including a payment to the SP as an additional output. The LC needs to verify Tx before signing it, but the SP cannot reveal it without fear of losing its compensation.
In order to resolve this two-sided trust problem, we propose a variant of the predicate blind signature (PBS) scheme of Fuchsbauer and Wolf (Eurocrypt 2024), which enables the SP to obtain valid Schnorr signatures on Tx, but only after proving to LC that Tx satisfies the specification. Cavefish achieves a trustless interaction in which the LC fulfills their transaction goal, and the SP receives fair compensation for their effort.
As transactions only need to stay private until posted, our PBS variant relaxes the unlinkability requirements of blind signatures.
We implement and benchmark the Non-interactive Argument of Knowledge component of Cavefish on two major UTxO-based blockchains, using two different zero-knowledge proving systems.
## 2026/261
* Title: Logarithmic-Depth Pseudorandom Functions from Well-Founded Code-Based Assumptions
* Authors: Youlong Ding, Aayush Jain, Ilan Komargodski
* [Permalink](https://eprint.iacr.org/2026/261)
* [Download](https://eprint.iacr.org/2026/261.pdf)
### Abstract
We give the first $\mathsf{NC}^1$-computable Pseudorandom Function (PRF) constructions from well-founded (non-ad-hoc) code-based assumptions. Specifically, we give two constructions based on two different classical variants of the learning parity with noise (LPN) assumption:
(1) An $\mathsf{NC}^1$-computable PRF from hardness of Sparse-LPN [Alekhnovich, FOCS~'03] (with respect to a sublinear-depth expander graph family). This PRF is also key-homomorphic.
(2) An $\mathsf{NC}^1$-computable PRF from hardness of Ring-LPN [Heyse et al., FSE~'12].
Both of these assumptions have been studied for many years in cryptography and average-case complexity. Ring-LPN has been used in the context of silent preprocessing for MPC and has a stable cryptanalysis. The study of counterexamples for Sparse-LPN is an active area of research. Notably, within the range of parameters that we need, none of these assumptions is known to imply collision-resistant hashing, and the first is not known to imply public-key encryption. Prior constructions of code-based PRFs (let alone key-homomorphic) are either super-logarithmic depth, or rely on newly introduced assumptions.
As a bonus, we give a similar result relying on the \emph{classical} LPN assumption, albeit with quasi-polynomial hardness:
-A key-homomorphic $\mathsf{NC}^1$-computable PRF from quasi-polynomial hardness of the classical LPN [Blum et al., CRYPTO~'93].
Technically, all of our results are obtained via a refinement and substantial extension of the recent ideas of [Ding, Jain, and Komargodski, STOC~'25].
## 2026/368
* Title: Additions, Multiplications, and the Interaction In-Between: Optimizing MPC Protocols via Leveled Linear Secret Sharing (Full Version)
* Authors: Andreas Br|+ggemann, Thomas Schneider, Maximilian Stillger
* [Permalink](https://eprint.iacr.org/2026/368)
* [Download](https://eprint.iacr.org/2026/368.pdf)
### Abstract
Secure multiparty computation (MPC) enables distrusting parties in a distributed system to compute on their private inputs without compromising their privacy. For many secret-sharing-based approaches, including some of today's most efficient MPC protocols, there is a pattern where two shared values are locally multiplied into some intermediate representation that is immediately and interactively translated back into sharings of the product. The intermediate representation is often still a full-fledged but different secret sharing scheme. This has been used to efficiently compute dot products by computing the sum of all intermediate products and then interactively translating only the sum instead of translating each individual product. Beyond that, the intermediate representation or secret sharing scheme has mostly been seen only as a necessary interim step, leaving most of its potential untapped.
We change that by proposing the paradigm of leveled linear secret sharing, which allows dynamic switching between the original secret sharing and the previously only intermediate one more freely, while enabling arbitrary linear computations in any of the domains. Prior multiplications are split into a non-interactive multiplication that switches from one to the other secret sharing, and an interactive upgrade back to the original secret sharing domain. The upgrade now does not necessarily follow each multiplication immediately, but just needs to be placed somewhere before the next multiplication is computed, possibly upgrading the linear aggregation of many multiplications' results. We apply this idea to improve three-party computation on replicated sharings (CCS'16), n-party BGW-style protocols (STOC'88), and masked secret sharing protocols such as ABY2.0 (USENIX Security'21). We build a novel optimizer that optimally selects which gate of a circuit is evaluated in which domain. With that, we improve communication by 10-37% for many circuits. Furthermore, we implement our generalization for replicated sharing, measure run time improvements of mostly 10-26% in a LAN, and make a full implementation of the protocol and our novel optimizer publicly available.
## 2026/1052
* Title: Full Key Recovery of Masked PRESENT on an Out-of-Order RISC-V Processor: A First Reported Case Study
* Authors: Siddhartha Chowdhury, Nimish Mishra, Sarani Bhattacharya, Debdeep Mukhopadhyay
* [Permalink](https://eprint.iacr.org/2026/1052)
* [Download](https://eprint.iacr.org/2026/1052.pdf)
### Abstract
Masking-based countermeasures such as Threshold Implementations and Probe-Isolating Non-Interference (PINI) protect cryptographic software by maintaining separation between sensitive shares under a prescribed leakage model. Modern out-of-order (OoO) processors, however, introduce backend mechanisms such as register renaming, dynamic scheduling, forwarding, speculative execution, and physical-register reuse that can create additional observations not represented at the ISA level.
We develop a trace-driven backend analysis methodology that reconstructs physical-register histories and execution-time interactions from OoO RISC-V traces and relates these events to the semantics of masked computations. The analysis targets two classes of OoO-induced observations: Rename-Induced Transition Leakage (RIL), arising when distinct masked values successively occupy the same physical register, and IEW-Induced Dispatch Leakage, arising from transient overlap of share-processing instructions inside issue, execute, and writeback structures.
We evaluate the methodology on masked PRESENT and on controlled compositions of first-order PINI1 gadgets. For masked PRESENT, although Q12-style rotations protect selected nonlinear operations, the affine share pair $(a_0,a_1)$ remains represented in distinct architectural registers. OoO physical-register reuse can nevertheless create transitions of the form
\[
\operatorname{HW}_{\mathrm{bit}}(a_0[b]\oplus a_1[b]),
\]
which reconstruct the affine intermediate at the leakage-model level and yield a key-dependent channel. Using an instrumented gem5 OoO RISC-V model, we recover the complete 64-bit first-round PRESENT subkey from these backend observations.
For PINI, we extend the observation space with OoO-created physical-register and backend-execution interactions and test whether each modeled observation remains simulatable within the first-order PINI circuit-share budget. The isolated gadget already exhibits local simulator-bound violations, while extending the computation through a share-wise linear layer and a second PINI1 gadget introduces additional cross-composition violations. Under the stressed baseline configuration, the number of cross-composition violation observations progresses from $0$ to $32$ and then to $128$, showing that PINI composability under its original probing model does not automatically extend to the considered OoO observation model.
Finally, we evaluate physical observability on a SiFive P550-class OoO RISC-V processor using Linux-accessible thermal telemetry. A profiled forced-reference methodology directly recovers 60 of the 80 PRESENT master-key bits. Since the positions of the remaining 20 bits are known, exhaustive search over the resulting $2^{20}$ candidate space completes recovery of the full 80-bit key.
Together, these results expose a cross-layer gap between software-level masking guarantees and OoO execution. Architecturally separated shares can acquire additional relationships through hidden backend state, producing observations that may exceed formal masking bounds and, in the PRESENT case, propagate into experimentally observable key-dependent behavior on real hardware.
## 2026/1542
* Title: Signing-Key Recovery from Unsalted Root Expansion and Salt-Binding Repair for MQOM v2
* Authors: Jos|- Luis Delgado
* [Permalink](https://eprint.iacr.org/2026/1542)
* [Download](https://eprint.iacr.org/2026/1542.pdf)
### Abstract
We give the first passive classical EUF-CMA attack on MQOM v2 in which an optimal three-record parity-indexed XOR triangle detects every usable collision, recovers the complete signing key, and produces a fresh-message forgery. In MQOM v2, every correlated-GGM root is derived from a fresh $\lambda$-bit master seed using a fixed PRG call with zero salt, while a public opening reveals either the corresponding root or its XOR with a fixed prefix of the long-term MQ witness. The resulting root functions are shared by all signatures, keys, salts, and v2 releases, so repeated master seeds expose linear equations in the witness. In Category I at the permitted $Q=2^{64}$ signing-query boundary, the attack has birthday-regime success $0.393395296381$ with error $O(2^{-64})$. A rank-two extension recovers two unrelated keys, while reusable global tables attain membership-certified lower bounds of $0.632030733547$ for the complete triangle and $0.776706354579$ for the record-optimal one-root allocation at $P=Q=2^{64}$.
The same fixed root functions support full-key recovery in every security category and reusable precomputation across targets and versions, while a streaming first-distinguished-point construction replaces storage of the signature corpus with certified chain coverage and an identifier-free endpoint index. Its membership-hit law is exact conditional on realized distinct coverage, with separate forecasts for chain construction, tags, fingerprints, and MPHF storage; a Category-I GF(2) design point uses 52 GiB, $2^{52}$ signatures, and target coverage $C=2^{77}$; conditional on that coverage, its success is $0.631940886333$ and its normalized serial forecast is below $2^{94}$. Pinned probes reproduce the fixed roots for every official tag from v2.0.0 through v2.1.1 and a pinned current revision in Categories I, III, and V, and salt-bound, domain-separated root expansion eliminates the collision and reusable-precomputation channels.
## 2026/1548
* Title: Revisiting the Wedge Attack on UOV problem
* Authors: Jintai Ding, Peigen Li, Siyong Tao
* [Permalink](https://eprint.iacr.org/2026/1548)
* [Download](https://eprint.iacr.org/2026/1548.pdf)
### Abstract
In this article, we first reformulate the wedge attack within a cleaner algebraic-geometric framework and then extend it to multi-homogeneous systems over fields of arbitrary characteristic. Building on these tools, we apply the resulting multi-homogeneous wedge attack to the security analysis of SNOVA.
## 2026/1561
* Title: LiftWHIR: A Prover-Efficient Polynomial Commitment with Short Proofs
* Authors: Zhongliang Zhang, Xinxuan Zhang, Yuanju Wei, Lang Qin, Yi Deng
* [Permalink](https://eprint.iacr.org/2026/1561)
* [Download](https://eprint.iacr.org/2026/1561.pdf)
### Abstract
Polynomial commitment schemes allow a prover to commit to a large polynomial and later prove a claimed evaluation at a chosen point. They are a core component of many efficient SNARKs, and the cost of their evaluation phase directly affects SNARK prover time. Reed--Solomon-based schemes already offer small proofs and fast verification, but generating an evaluation proof for a large polynomial remains expensive.
We present LiftWHIR, a Reed--Solomon-based polynomial commitment scheme that reduces prover time in the evaluation phase. LiftWHIR combines interleaved coding with the DEEP(ITCS'20) technique to reduce proving an evaluation of a large polynomial to two smaller tasks: a proximity test on a shorter codeword and evaluation of a smaller polynomial.
The use of DEEP simultaneously reduces the number of queries required by the proximity test.
We then use WHIR(EUROCRYPT'25) to prove both resulting tasks, keeping verification and communication costs low.
LiftWHIR trades a modest increase in proof size and verifier time for a substantial reduction in prover time.
At $n=2^{20}$ over a 255-bit prime field and code rate $1/2$ (resp., $1/4$), LiftWHIR reduces the evaluation phase to 167 ms (resp., 169 ms), yielding a $4.4\times$ (resp., $6.7\times$) speedup over WHIR. Including commitment, LiftWHIR achieves total prover times of 808 ms (resp., 1,474 ms), corresponding to overall prover speedups of $1.61\times$ (resp., $1.55\times$). Verification time increases from 0.55 ms to 0.76 ms (resp., 0.40 ms to 0.51 ms), while proof size is $1.46\times$ (resp., $1.33\times$) that of WHIR.
We further instantiate Spartan(CRYPTO'20) with LiftWHIR and compare it with a Spartan variant instantiated with WHIR.
LiftWHIR speeds up proving by $1.9\times$, while verification time increases only from 3.86ms to 4.62ms, at the cost of a $42\%$ increase in proof size.
## 2026/1786
* Title: Bit Operation Cost of ``Holdout'' Key-Recovery Attacks Against Classic McEliece
* Authors: Markku-Juhani O. Saarinen
* [Permalink](https://eprint.iacr.org/2026/1786)
* [Download](https://eprint.iacr.org/2026/1786.pdf)
### Abstract
We cost the best Holdout key-recovery attack that we currently know for each Classic McEliece parameter set. One shortened coordinate set of the direct locator-recovery method of Ghoshal, Ishai, Jain, and Sun suffices for every set: public parity-check elimination selects the $mt+1$ compatible labels needed for key completion and replaces the four or five shortened sets used in the source analysis. We make every sparse linear-system solve reliable by applying Eberly's random diagonal scaling and iterative scalar Lanczos solver over a larger field, mapping each returned solution back to the original field, and substituting it into the original equations. Separately costing matrix passes that use only binary derivative data and operations with general field coefficients gives complete conditional estimates of $2^{126.77}$ bit operations for mceliece348864, $2^{145.22}$ for mceliece460896, $2^{137.48}$ for mceliece6688128, $2^{136.65}$ for mceliece6960119, and $2^{137.48}$ for mceliece8192128. The corresponding simultaneously stored state estimates are $2^{51.33}$, $2^{59.10}$, $2^{55.18}$, $2^{54.86}$, and $2^{55.18}$ bits. All five work estimates lie below the NIST classical-gate reference level for their claimed category.
The estimates remain conditional on the source's conjectures about the canonical form of binary Goppa codes and the rigidity of rank-one solutions, together with the required rank inequalities for the full relation matrices and their coordinate blocks. Failure of either the projected-kernel rank condition or the four-holdout rigidity assumption at sufficiently many coordinates could create an exponential obstruction. The estimates are arithmetic and state estimates, not elapsed-time claims, and no Classic McEliece target key has been recovered.
Note: This is a living document: the estimate, assumptions, and scope will be updated as algorithms and reproducible evidence improve.
## 2026/1793
* Title: Exact CVP Is NP-Complete for Principal Cyclotomic Ideals
* Authors: Jiaqi Liu, Yansong Feng, Yanbin Pan
* [Permalink](https://eprint.iacr.org/2026/1793)
* [Download](https://eprint.iacr.org/2026/1793.pdf)
### Abstract
We prove that exact Euclidean decision-CVP is $\mathsf{NP}$-complete on the coefficient lattices of nonzero principal ideals in the power-of-two cyclotomic rings $R_d=\mathbb{Z}[y]/(y^d+1)$. A deterministic reduction from Exact Cover by 3-Sets (X3C) produces an integral target and an integer squared threshold $\Delta$ such that the closest squared distance is exactly $\Delta$ in YES instances and at least $\Delta+4$ in NO instances. Moreover, the ideal elements whose squared distance from the target under the coefficient embedding is at most $\Delta$ are in bijection with the exact covers of the given X3C instance. This also gives $\mathsf{NP}$-hardness of exact search-CVP under polynomial-time Turing reductions.
We also transfer the resulting principal-ideal CVP instances to full-rank principal ideals of the cyclic quotient ring $\mathbb{Z}[X]/(X^D-1)$, where $D=2d$. Their coefficient lattices are invariant under a cyclic rotation by one coordinate. The lift preserves principality, doubles the dimension, and scales the squared distances of corresponding elements by eight. Thus, on principal cyclic ideal lattices, exact decision-CVP is $\mathsf{NP}$-complete and exact search-CVP is $\mathsf{NP}$-hard.
The cyclotomic and cyclic hardness results also admit uniformly computable fixed-family forms. For each X3C universe size, one principal cyclotomic ideal and one principal cyclic ideal can be fixed before the collection of triples is known, and only the respective targets and squared thresholds depend on the collection. Thus exact decision-CVP remains $\mathsf{NP}$-complete on both fixed families. If exact decision-CVP with preprocessing (CVPP) were solvable in polynomial time on either family, then $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$. By the Karp--Lipton theorem, such a preprocessing scheme would collapse the polynomial hierarchy to $\Sigma_2^{\mathsf{P}}$. To our knowledge, the cyclic results resolve the exact decision versions of Micciancio's questions of whether CVP is $\mathsf{NP}$-hard on cyclic lattices and on a fixed family of cyclic lattices, even under the stronger restriction to full-rank principal cyclic ideals.
## 2026/1794
* Title: Ideal Secret Sharing Schemes over Small Domains
* Authors: Amos Beimel, Aner Ben-Efraim, Oriol Farr|as, Adriana Moya
* [Permalink](https://eprint.iacr.org/2026/1794)
* [Download](https://eprint.iacr.org/2026/1794.pdf)
### Abstract
In any secret sharing scheme, the size of each share must be at least as large as the size of the secret. Schemes that attain this lower bound are called $k$-ideal, where $k$ is the size of the domain of the secrets and shares, or simply ideal if they are $k$-ideal for some $k$. An access structure is called $k$-ideal if it admits a $k$-ideal secret sharing scheme. The characterization of ideal access structures is a longstanding open problem at the intersection of cryptography, matroid theory, and information theory, previously solved only for $k=2$ and $k=3$.
In this work, we solve this problem for $k=4$ and $k=6$. Our results exploit the connections between ideal secret sharing schemes and matroids and new techniques based on latin squares. For $k=4$, we show that an access structure is $4$-ideal if and only if it admits a $\mathbb{F}_4$-linear ideal secret sharing scheme, i.e., a scheme where the shares and the secret are elements of $\mathbb{F}_4$ and the sharing and reconstruction functions are linear. To prove this result, we show that the class of matroids determined by ideal $\mathbb{F}_4$-linear schemes coincides with those determined by $4$-ideal schemes.
For $k=6$, we prove that an access structure admits a $6$-ideal scheme if and only if it admits a $k$-ideal scheme for every $k\geq 2$. This result shows that domains of size $k=6$ are the most restrictive domains for constructing ideal secret sharing schemes, and that $6$-ideal schemes can be essentially built by combining ideal $\mathbb{F}_2$-linear schemes with ideal $\mathbb{F}_3$-linear schemes via the Chinese Remainder Theorem.
Beyond these characterizations, our main technical contributions are the introduction of new techniques for analyzing ideal secret sharing schemes, extending the connections between ideal threshold schemes and latin squares to the general case, and the classification of the values of $k$ for which some relevant matroids are $k$-entropic.
## 2026/1795
* Title: On Removing Interaction from Quantum Proofs
* Authors: Nicholas Spooner, Max Tromanhauser
* [Permalink](https://eprint.iacr.org/2026/1795)
* [Download](https://eprint.iacr.org/2026/1795.pdf)
### Abstract
An important open question in quantum cryptography is the construction of publicly-verifiable NIZKs for QMA. Classically, one can construct NIZKs for NP in the random oracle model (and sometimes in the standard model) by compiling an honest-verifier ZK (HVZK) $\Sigma$-protocol for NP using the FiatrCoShamir transformation. Broadbent and Grilo introduced a quantum analog of a $\Sigma$-protocol (which they call a $\Xi$-protocol) in which the prover's first message is quantum, and show that HVZK $\Xi$-protocols exist for QMA. However, it is not clear how to compile such protocols into NIZKs in the (Q)ROM, because the FiatrCoShamir transformation seems to be incompatible with quantum messages. In this work we give formal evidence that this is indeed the case: we show that if generic "FiatrCoShamir-like" compilers for quantum protocols exist in the QROM (with small completeness and soundness error) then QMA = BQP.
## 2026/1796
* Title: UdMAC: Efficiently Updatable Message Authentication Codes
* Authors: Debrup Chakraborty, Avishek Majumder
* [Permalink](https://eprint.iacr.org/2026/1796)
* [Download](https://eprint.iacr.org/2026/1796.pdf)
### Abstract
Message authentication codes (MAC) are ubiquitous and are considered to be the most important tool employed to ensure authenticity of messages in the symmetric key setting. In this work, we aim to empower MACs with a newly added functionality of updatablility, i.e., the goal is to construct a MAC scheme where the authentication tag for a message can be updated with every update to the message without recomputing the tag for the entire message. Such a functionality can be useful in several scenarios, primarily where the storage of a frequently changing large message is delegated to an un-trusted server. In such a scenario it may be infeasible for an user to download the entire message and recompute the tag for every update. We introduce a new class of MACs called updatable message authentication code (UdMAC), which inherently enjoys the functionality of updates. We systematically develop UdMACs, provide syntax for UdMAC, propose formal security notion. We then present two constructions: $\mathsf{concatu}$ and $\mathsf{xoru}$, which support two distinct message updates, namely, concatenation and xor difference. We analyze both the constructions in details and prove security of the construction in the newly proposed security model.
## 2026/1797
* Title: High-Precision Lewis Weights via Fourth-Moment Control and Local Bregman Acceleration
* Authors: Zhao Song
* [Permalink](https://eprint.iacr.org/2026/1797)
* [Download](https://eprint.iacr.org/2026/1797.pdf)
### Abstract
We study the high-precision computation of $\ell_p$-Lewis weights for $p\ge4$ in the black-box exact-real full-vector leverage-score oracle model, measuring complexity by the number of adaptive oracle rounds. In this model, Gribling, Sidford, and Zhang [GSZ26] obtained an $O(p^2\log(m/\epsilon))$ bound for computing an $\epsilon$-estimate. We improve this bound to $O(p\log(mp)+\sqrt p\log(1/\epsilon))$. To obtain this result, we isolate the normalized fourth-moment operator governing the nonlinear Hessian of their log-determinant matrix potential and prove that each relative-gradient step with denominator $p$ resets the operator norm to a universal constant. This reset controls the entire update segment and yields an $O(p\log(mp))$ global entrance phase. After entering an $O(1/p)$ spectral neighborhood of the optimum, we switch to a restarted accelerated Bregman-gradient method for the vector potential.
## 2026/1798
* Title: Generalized Greedy Algorithms for Synthesizing Low-depth CNOT Circuits * Authors: Tung Chou
* [Permalink](https://eprint.iacr.org/2026/1798)
* [Download](https://eprint.iacr.org/2026/1798.pdf)
### Abstract
A CNOT circuit is a quantum circuit where the only type of gate appeared in the circuit is the CNOT gate. Given an n |u n binary matrix which specifies the relationship between input and output, existing greedy algorithms generate corresponding CNOT circuits of n qubits, with the goal of minimizing depth of the circuits.
This short paper presents two new greedy algorithms, which can be considered as generalized versions of existing greedy algorithms. The new algorithms are inspired by the algorithm presented in the Asiacrypt 2024 paper rCLQuantum circuits of AES with a low-depth linear layer and a new structurerCY. Although we have not run large-scale experiments, small-scale experiments suggest that the new algorithms are at least as powerful as existing greedy algorithms.
## 2026/1799
* Title: Two Constructions of Rotation-Symmetric Bent Functions Outside the Completed Maiorana--McFarland Class with Any Possible Algebraic Degree
* Authors: Deng Tang
* [Permalink](https://eprint.iacr.org/2026/1799)
* [Download](https://eprint.iacr.org/2026/1799.pdf)
### Abstract
Rotation-symmetric Boolean functions form an important class of cryptographically significant Boolean functions. In 2017, Su and Tang proposed in [IEEE TIT 63(7): 4658rCo4667, 2017] an infinite class of rotation-symmetric bent functions of every possible algebraic degree. In this paper, we present two constructions of rotation-symmetric bent functions outside the completed Maiorana--McFarland class on $n=30\cdot 7^j$ variables with $j\geq0$ and $n=70t$ variables with $t\geq1$, respectively. Each of the two constructions generates bent functions of every possible algebraic degree ranging from $3$ to $n/2$. Since the algebraic degree of an $n$-variable bent function is at most $n/2$ and every quadratic bent function belongs to the completed Maiorana--McFarland class, the interval from $3$ to $n/2$ is the full possible degree range for bent functions outside this class. To the best of our knowledge, these are the first infinite constructions of rotation-symmetric bent functions in which functions have algebraic degrees ranging from $3$ to $n/2$ while remaining entirely outside the completed Maiorana--McFarland class.
## 2026/1800
* Title: Separating Quantum Indistinguishability Obfuscation from Falsifiable Assumptions
* Authors: Mohammed Barhoush, Tomoyuki Morimae, Ramis Movassagh
* [Permalink](https://eprint.iacr.org/2026/1800)
* [Download](https://eprint.iacr.org/2026/1800.pdf)
### Abstract
Quantum indistinguishability obfuscation (qIO) aims to make a quantum circuit unintelligible while preserving its functionality. It serves as a foundational primitive for advanced applications, such as witness encryption (WE) for QMA, non-interactive zero-knowledge arguments for QMA, and attribute-based encryption for BQP. Despite its importance, constructing qIO from standard assumptions remains a major open problem.
In this work, we prove that the security of WE for QMA cannot be based on any falsifiable cryptographic assumption via a restricted class of quantum black-box reductions. Because qIO for null quantum circuits implies WE for QMA, this also separates null-qIO from falsifiable assumptions. Since almost all standard cryptographic assumptions are falsifiable, our result presents a barrier to basing qIO on standard cryptographic assumptions.
The reductions we rule out are restricted: the reduction must query the adversary classically, non-adaptively, at the same security parameter, and only on honestly generated ciphertexts. Moreover, our impossibility applies only to WE with classical ciphertexts, and therefore does not rule out qIO with obfuscators whose output is a quantum state. Ruling out more general reductions, as well as more general forms of WE and qIO, remains open.
Our impossibility relies on the existence of a QMA-QCIP[2] gap problem, an average-case assumption postulating a QMA language that cannot be verified with two messages of classical communication.
## 2026/1801
* Title: Security Analysis on a Secure Medical Data Sharing System in Digital Twin Environments
* Authors: Mizuki Hayashi, Keita Emura
* [Permalink](https://eprint.iacr.org/2026/1801)
* [Download](https://eprint.iacr.org/2026/1801.pdf)
### Abstract
Gao et al. (IEEE Internet of Things Journal, 2025) proposed a medical data sharing system for digital twin environments using identity-based encryption (IBE), public-key encryption with keyword search (PEKS), and blockchain technologies. In this short note, we show that Gao et al.'s system allows unauthorized users to access other patients' medical data. We further show that the search server can obtain information about the queried keywords from the trapdoors (search queries). In addition, we analyze the procedure used to retrieve, from the blockchain, the IPFS (InterPlanetary File System) addresses storing encrypted medical data and encrypted keywords. Since these addresses are derived from labels that can be computed solely from public information and keywords, and because the keywords themselves are provided to the search server, we demonstrate that searchable encryption is unnecessary in the first place. Based on our security analysis, we argue that the proposed system requires a fundamental redesign.
## 2026/1802
* Title: VERIF: An Efficient Zero-Knowledge Proof System for Verifying IVF-Flat Retrieval in RAG Services
* Authors: Zhiwen Zhang, Yuao Zhou, Ge Chang, Cong Li, Yuejian Fang, Qingni Shen
* [Permalink](https://eprint.iacr.org/2026/1802)
* [Download](https://eprint.iacr.org/2026/1802.pdf)
### Abstract
Retrieval-augmented generation (RAG) services outsource vector search over proprietary corpora, yet clients cannot verify that returned context conforms to the promised index, parameters, and snapshot. We present VERIF, the first dedicated zero-knowledge polynomial interactive oracle proof (PIOP) for complete, service-consistent IVF-Flat retrieval. VERIF proves top-$m$ centroid selection, authenticated routing, exact full-vector scoring of every routed candidate, final top-$k$ selection, and context binding. Its commitment-eliding reduction keeps query-dependent scores virtual and reduces selection claims directly to inner products over authenticated data. A unified, permutation-free top-$t$ relation with limb-decomposed range arguments handles both selection stages without sorting or score commitments. Against a matched, optimized implementation of the same retrieval relation using a general-purpose circuit-based zkSNARK (Plonky2), our prototype achieves up to an $86.5\times$ prover speedup and reduces peak memory by up to 99.1%. VERIF proves retrieval over authenticated SIFT and 768-dimensional Cohere indexes containing 32 million and 8 million vectors in 5.90 and 11.57 seconds, respectively; verification takes 0.62--1.48 seconds. These results demonstrate practical verifiable IVF-Flat retrieval for RAG-as-a-Service.
## 2026/1803
* Title: Adaptive Multi-Algorithm Key Exchange for Quantum-Resilient Secure Communication: Dynamic Switching among QKD, Post-Quantum, and Classical Key Establishment with Entropy Fusion
* Authors: Ogbodo Tochukwu Hillary, Bilkisu Larai Muhammad-Bello, Saleh El-Yakub Abdullahi
* [Permalink](https://eprint.iacr.org/2026/1803)
* [Download](https://eprint.iacr.org/2026/1803.pdf)
### Abstract
With the arrival of scalable quantum computers, classical key exchange protocols like RSA, elliptic-curve and finite-field Diffie-Hellman are vulnerable to harvest-now-decrypt-later attacks. Quantum key distribution offers information-theoretic security but is sensitive to channel noise, loss, and distance, while post-quantum cryptography provides quantum resistance on conventional hardware at the cost of larger keys and a dependence on hardware computational strength. Existing hybrid defenses generally rely on static configurations that require manual intervention when channel conditions degrade, and no prior software-defined system performs real-time three-way switching among these approaches while preserving uninterrupted key availability. This paper presents an adaptive multi-algorithm key generation and exchange framework that dynamically selects among quantum key distribution (BB84), post-quantum cryptography (Kyber512, standardized as ML-KEM-512), and classical Diffie-Hellman according to real-time monitoring of the quantum bit error rate and network latency, fusing key material from all active sources through an HMAC-based key derivation stage. The framework was implemented and evaluated in a controlled simulation environment built on Qiskit, liboqs, and the Python cryptography library. Across all five operating modes it attained a 100% key-generation success rate, with the quantum-resistant modes sustaining a secret-key throughput of approximately 3 kbps at a 256-bit key size and mode transitions completing without loss of key availability. A Kruskal-Wallis test confirmed that the timing differences among modes were statistically significant (H = 133.32, p < 0.001), and the security model was placed on a formal footing using the robust key-combiner framework. The results indicate that adaptive multi-algorithm key exchange can substantially improve the quantum resilience of secure communication systems in terms of security, availability, and performance.
## 2026/1804
* Title: Dealing Haystack: Towards Trustless Haystack in the Optimistic Setting * Authors: Isabel Mu|#oz, Isaac Agudo, Marco L||pez, Daniel Morales
* [Permalink](https://eprint.iacr.org/2026/1804)
* [Download](https://eprint.iacr.org/2026/1804.pdf)
### Abstract
Hash-based constructions occupy a distinctive position among post-quantum signatures: their security reduces to well-tested properties of hash functions rather than to newer assumptions such as lattices or isogenies. This work focuses on stateful schemes instead of stateless, because the former are considerably more efficient. However, they have the problem of state handling, since reusing a one-time key twice enables signature forgeries. Despite threshold signatures mitigate this problem by spreading trust among a set of disjoint parties, building them from hash-based schemes is difficult, since these lack the homomorphic structure needed to recombine partial signatures, and generic multiparty computation can be expensive for hash-based constructions. Kelsey, Lang and Lucks recently proposed Haystack, the first threshold scheme for hash-based signatures producing standard LMS or XMSS signatures, at the cost of a fully trusted setup and a large common reference value. We analyze Haystack along two dimensions: performance and security.
First, as Haystack lacks an implementation and realistic benchmarking, we implement the protocol in Java and produce a network-aware evaluation of its viability in real deployments, concluding that it performs comparably to other post-quantum threshold schemes.
Second, we relax the trust placed in the dealer. For that, we introduce a variant of the setup built on an optimistic, lightweight MPC-based partial-DKG. It does not remove the dealer's ability to forge, but it prevents it from impersonating trustees within the signing protocol, while preserving the standard signature format. Also, an optional succinct-argument layer provides public auditability. We further consider a full-DKG setting with no dealer and where the trustees run the entire setup under MPC. Both variants are implemented in MP-SPDZ and their costs have been analyzed.
## 2026/1805
* Title: On Module Lattices with Galois-Symmetries: What You See Is Not What You Get
* Authors: Ronald Cramer, Dani|2l van Gent, Andrea Lesavourey, Alice Pellet-Mary
* [Permalink](https://eprint.iacr.org/2026/1805)
* [Download](https://eprint.iacr.org/2026/1805.pdf)
### Abstract
This paper deals with the hardness of finding short vectors in module lattices. Let $K$ be a number field of degree $d$ and $\mathcal{O}_K$ its ring of integers. We show that if a module lattice $M$ of rank $n$ in $\mathcal{O}_K^n$ has some Galois-symmetries, namely if it is fixed coordinate-wise (as a set) by a group $G$ of automorphisms of $K$, then $M$ can actually be seen as a module of rank~$n$ over a subfield~$K'$ of $K$ ($K'$ is the fixed-field of $G$), whose degree is $|G|$ times smaller than the degree of $K$. When one wants to find short vectors in $M$, this translates into the observation that the module lattice $M$, which is a priori a lattice of rank $n d$ can in fact be seen as a lattice of rank only $n d / |G|$. Hence, finding short vectors in $M$ is easier than what one could have expected by forgetting about the algebraic structure of $M$. This result is a generalization of a similar result by Boudgoust, Gachon and Pellet-Mary (Crypto'22), which was restricted to ideal lattices (i.e., modules of rank $1$).
## 2026/1806
* Title: Practical Differential Fault Attacks on the GPRS Standard Ciphers
* Authors: Zhengting Li, Lin Ding, An Wang, Haotong Xu, Zheng Liu, Zheng Wu, Xinhai Wang, Jiang Wan
* [Permalink](https://eprint.iacr.org/2026/1806)
* [Download](https://eprint.iacr.org/2026/1806.pdf)
### Abstract
GEA-1 and GEA-2 are two standard stream ciphers used in GPRS (General Packet Radio Service) to protect against eavesdropping GPRS between the base station and the phone. Now, a range of current phones still support them. In this paper, a differential fault attack on the GEA-like stream ciphers under the random fault model is proposed for the first time. In this attack, an efficient dedicated algorithm for identifying the exact fault location is proposed. By using this dedicated algorithm, the attacker can succeed in determining the exact fault location. As applications, practical differential fault attacks on the GPRS standard ciphers (i.e., GEA-1 and GEA-2) are presented, which recover the 64-bit secret keys of GEA-1 and GEA-2 with time complexities of ${2^{{\rm{33}}{\rm{.807}}}}$ and ${2^{{\rm{33}}{\rm{.858}}}}$, respectively. We validate the cryptanalytic results by simulating the whole attacks on the platform ChipWhisperer Lite. The experimental results show that both GEA-1 and GEA-2 can be broken within sixteen minutes on a common laptop. Finally, the possible countermeasures are presented to protect the processed data of massive GPRS devices.
## 2026/1807
* Title: A (6, 4) Vectorial Boolean Function With Nonlinearity 26 and the Maximum Nonlinearity for Six-Bit Permutations
* Authors: Yufei Yuan, Lei Zhang, Wenling Wu
* [Permalink](https://eprint.iacr.org/2026/1807)
* [Download](https://eprint.iacr.org/2026/1807.pdf)
### Abstract
When the output dimension of a vectorial Boolean function exceeds half its input dimension, not all nonzero components can be bent. The best attainable componentwise nonlinearity in this range, however, is generally unknown. We ask whether the conjectured bound for even-dimensional square mappings
extends to this high-output regime, and show that it does not. Specifically, we construct a six-input, four-output function with nonlinearity 26, thereby improving the previous lower bound of 24. Its seven bent components form the nonzero part of a three-dimensional component subspace, whereas the remaining eight components all have maximum absolute Walsh coefficient 12. Accordingly, the associated binary linear code has length 64, dimension 11, and minimum distance 26. We then address the distinct problem of six-bit permutations and determine its exact maximum. A computer-assisted evaluation of the complete classification of Boolean functions in six variables bounds the autocorrelation energy of every balanced component whose Walsh coefficients have magnitude at most 12. Combined with a vectorial fourth-moment identity, this bound forces every six-bit permutation to have a component with maximum absolute Walsh coefficient at least 16, and hence nonlinearity at most 24. Inversion over the field with 64 elements attains this value. Finally, the same argument gives necessary coding conditions for any non-bijective six-input, six-output function whose nonlinearity exceeds 24.
## 2026/1808
* Title: Cross-Signature Signing-Key Recovery and Domain-Separation Repair for SDitH v2
* Authors: Jos|- Luis Delgado
* [Permalink](https://eprint.iacr.org/2026/1808)
* [Download](https://eprint.iacr.org/2026/1808.pdf)
### Abstract
We give the first cross-signature signing-key recovery attack on SDitH v2 from public chosen-message transcripts. Each hidden VOLE leaf exposes a commitment and a public endpoint $A=\mathsf{wit}\oplus G_{\rm wit}(s)$ that masks the permanent witness, and because share expansion uses $s$ as the block-cipher key with an all-zero IV, one candidate stream block can be tested against all endpoints under the same public key. The attack shares nonlinear terms of the unary RSD predicates across endpoints, organizes public masks in tries, and updates the circuit along a Gray-code traversal, while a two-block leaf commitment validates each survivor before signing-key reconstruction.
With $q=2^{12}$ signatures, complete key recovery and forgery cost 11.23rCo11.67 bits less than matched AES-128/192/256 exhaustive search across six parameter sets, and the comparison includes target identification, commitment validation, signer-used keys, signature acquisition, witness reconstruction, and fresh signing. A multi-key experiment measures the generic gain from multiple targets, and executions over a reduced domain against the official C implementation recover the signing witness and produce a fresh accepted signature for every parameter set. We repair the shared stream domain by labelling each expansion with the signature salt, global leaf ordinal, and block position; this change preserves signature size and block-cipher call count and reduces the attack to generic multi-target search.
## 2026/1809
* Title: PikkuFold: Efficient Folding in a Few Kilobytes
* Authors: Micha+e Osadnik
* [Permalink](https://eprint.iacr.org/2026/1809)
* [Download](https://eprint.iacr.org/2026/1809.pdf)
### Abstract
Folding is a powerful technique for constructing efficient succinct proof systems, especially for computations that are expressed in a streaming fashion.
We present PikkuFold, a new lattice-based folding protocol that improves upon state-of-the-art folding schemes such as SALSAA (ePrint 2025/2124) and Cyclo (EUROCRYPT 2026). One folding step communicates $5.5$ KB beyond the commitments to its fresh inputs, against $\geq 30$ KB for Cyclo and $\geq 60$ KB for SALSAA for similar instances, while keeping prover time comparable and the verifier in the millisecond range. At the heart of our construction are layered random projections, whose algebraic structure makes them fast to verify and whose final image is short enough to send to the verifier directly, cutting out the cost of auxiliary commitments.
We use those techniques to replace the extensive and restrictive range proofs of Cyclo, while still achieving only a small additive increase in the accumulator norm across multiple folds. PikkuFold is the first lattice-based construction that does not require any in-protocol commitments beyond those of the fresh inputs. Such commitments are the heavy part of a folding transcript: every prior lattice-based scheme commits to a decomposed or otherwise transformed witness during the fold, immediately increasing the communication by dozens of kilobytes. On top of that, we provide two contributions of independent interest, applicable beyond the context of folding schemes:
(i) a Johnson-Lindenstrauss theorem for biased ternary matrices modulo $q$ with certified concrete constants, which replaces the heuristic parametrisation of prior works, and
(ii) a thorough analysis of the short-challenge sampler with fixed Hamming weight and operator-norm rejection, offering a wide range of parameter sets. Using this sampler as a drop-in replacement would lead to immediate improvements in a wide family of lattice-based protocols.
## 2026/1810
* Title: An Algebraic-Geometry Lower Bound against the ePrint:2026/1747 McEliece Key-Recovery Attack
* Authors: Daniel Apon
* [Permalink](https://eprint.iacr.org/2026/1810)
* [Download](https://eprint.iacr.org/2026/1810.pdf)
### Abstract
A few weeks ago, Ghoshal, Ishai, Jain, and Sun (ePrint:2026/1630) introduced a "hold-out distinguisher" for the GopparCoMcEliece public key. This past week, Vedenev (eprint:2026/1747) proposed to turn its polynomial relations into key recovery by reconstructing the hidden generalized ReedrCoSolomon representation from nested Hasse-derivative spaces at held positions.
VedenevrCOs proposed held-position count explicitly assumes that the resulting linear equations are independent across positions. Yet, experiments on proper binary Goppa instances contradict that assumption, demonstrating a familiar "waterfall" phenomenon where - just before the required independent equation count for a successful attack - additional held positions sharply drop in value, providing just a single, independent equation rather than the $\approx {k \choose 2}$ such equations from the early positions.
This note identifies an algebraic-geometric reason for this inherent dependence. For a binary Goppa polynomial of degree $t$, an explicit linear map constructs a $(2t+3)$-dimensional family modulo the true solution. At each held support point, the entire derivative-flag block restricts on this family to at most one ordinary evaluation condition. Consequently, under a concrete nondegeneracy condition stated in terms of the hidden vector polynomial $\bf F$ and its formal derivative ${\bf F}$$'$:
$c_{need} \gt 2t + 3,$
where $c_{need}$ is the number of sampled held positions required at the critical step in VedenevrCOs algorithm. (The proposed key-recovery algorithmrCOs cost depends on $c_{need}$ in the exponent.)
For ISO/NIST Category 5 parameter set ${\sf mceliece8192128}$, this gives $c_{\rm need} \gt 259,$ which implies VedenevrCOs key-recovery algorithm costs in excess of $2^{1500}$ bit operations there.
## 2026/1811
* Title: Efficient Soft Analytical Side-Channel Attacks on Large-Scale Cryptographic Computations
* Authors: Yiteng Sun, Zhuo Huang, Yan Zhuang, Shuo Sun, Xinyu Li, Yu Yu, Weijia Wang
* [Permalink](https://eprint.iacr.org/2026/1811)
* [Download](https://eprint.iacr.org/2026/1811.pdf)
### Abstract
Soft Analytical Side-Channel Attacks (SASCA) combine leakage-derived priors from multiple intermediate variables with their functional dependencies through belief propagation (BP).However, when applying SASCA to large-scale cryptographic computations where algorithms are abstracted into extensive factor graphs with large candidate sets per variable node, the memory and computational complexity of SASCA become prohibitive. A natural first choice for large-domain variables is to fragment them into smaller-domain variables when the underlying computation decomposes accordingly. For modular addition and multiplication, however, preserving cross-fragment dependencies can introduce short cycles and coupled factor updates, motivating alternative inference strategies. We consider the Number Theoretic Transform (NTT) in ML-DSA as a representative large-scale cryptographic computation, where standard SASCA (with FFT optimization) requires approximately 122~GB of memory for message propagation in an unprotected single-trace setting, even for a 6-layer sub-NTT component, while masking further amplifies the graph size and inference cost.
\vspace{0.3em}
To address this limitation, we propose Greedy Region-Wise Pruning SASCA (GRWP-SASCA), a practical and efficient framework that enables scalable inference by dividing the global factor graph into manageable regions. The core idea is to replace global BP with a sequence of localized inference steps, where regions are incrementally merged, and the search space is reduced via greedy pruning of redundant structures and low-confidence candidates, thereby significantly reducing the memory and computational complexity of the BP algorithm. This design provides a flexible attack strategy for large-domain arithmetic factor graphs. Our results show that GRWP-SASCA transforms previously infeasible SASCA attacks on large-scale cryptographic computations into practical ones. Theoretical analysis of single-trace attacks on unprotected ML-DSA shows that GRWP-SASCA reduces the memory overhead associated with message propagation by a factor of up to $151$ compared to the standard SASCA, while achieving an estimated speedup by a factor of $68$. For $d$-order masked ML-DSA with multiple (say, $t$) traces, GRWP-SASCA achieves an estimated reduction in memory overhead associated with message propagation by a factor of up to $388.13t(d+1.14)/(d+2.44)$, while achieving a speedup by a factor of approximately $2d + 4$. Real-device experiments on an ARM Cortex-M4 platform demonstrate that the secret can be recovered from an unprotected implementation within approximately $15$ minutes with a single trace, with a peak message memory usage of approximately 0.9 GB. For first-order masked ML-DSA, the secret can be recovered within 3.2 hours using 8 traces, with a peak message memory usage of approximately 8.1 GB.
## 2026/1812
* Title: Communication-Efficient Private Join and Compute over Distributed Input Sets
* Authors: Yunqing Sun, Xinran Cai, Hanlin Liu, Xiao Wang, Wei Dong
* [Permalink](https://eprint.iacr.org/2026/1812)
* [Download](https://eprint.iacr.org/2026/1812.pdf)
### Abstract
Private Join and Compute (PJC) enables two parties to compute aggregates over matching records from their private datasets. In this work, we focus on the inner-product variant of PJC, which computes the inner product over matching records from their private datasets. It has important applications such as privacy-preserving ad conversion measurement. However, existing PJC protocols assume each party holds the entire dataset, which is often unrealistic in practice, where relevant datasets are distributed across multiple data owners. No existing PJC protocols directly support distributed input sets across multiple clients, while straightforward generic approaches introduce substantial overhead.
We propose an efficient approximate PJC protocol for distributed input sets while keeping the communication sublinear in the input size. Our protocol works in the semi-honest setting and uses two non-colluding servers that learn nothing beyond the final approximation. The core technical contribution is a novel adaptation of the G\"odel Prize-winning AMS sketch redesigned for efficient evaluation under fully homomorphic encryption. Concretely, we show a new structured randomness that can be homomorphically generated from short seeds using just 3 levels of multiplication while maintaining the best plaintext accuracy bound. Based on our optimized implementation, clients can insert each input element into an encrypted sketch in 30 ms, which has a size of 250 KB, independent of input size. The servers can recover the final output within seconds, orders of magnitude faster than the generic method.
## 2026/1813
* Title: Atom: Single-Server Private Information Retrieval with Low Communication and Fast Computation
* Authors: Baoyu Li, Binwu Xiang, Kang Yang, Yu Yu, Xiaogang Zhou
* [Permalink](https://eprint.iacr.org/2026/1813)
* [Download](https://eprint.iacr.org/2026/1813.pdf)
### Abstract
Private information retrieval (PIR) enables a client to retrieve a record without revealing the index.Among existing PIR protocols with database-independent preprocessing, for each query, the protocols with low communication often take from several seconds to tens of seconds, while the faster protocols require hundreds of kilobytes for communication.
In this paper, we propose three techniques for different-type ciphertext conversions: (1) the first one is to generate a two-orbit SIMD selector from encrypted bits; (2) the second one is to convert a packed $\mathsf{RLWE}$ ciphertext into an aligned monomial $\mathsf{RGSW}$ ciphertext; (3) the third one is to produce an arbitrary monomial $\mathsf{RGSW}$ ciphertext from encrypted bits.
Building on these techniques, we design a new PIR protocol (called Atom), achieving the best of both worlds (i.e., having not only low communication but also fast computation). We implemented Atom and evaluated its performance for $256$ B records and databases from $256$ MB to $8$ GB. Specifically, Atom takes $3.0 \sim 3.8$ KB of online communication (i.e., the total communication, excluding the setup phase that can be run only once and reused for multiple queries), and takes $0.4 \sim 5.0$ seconds per query.
Compared to the state-of-the-art KsPIR (CCS'24), Atom reduces the online communication cost by a factor of $40.5\times \sim 51.3\times$, while its running time is comparable to KsPIR ($0.2 \sim 5.2$ seconds per query).
## 2026/1814
* Title: LetoPIR: Fast Keyword Private Information Retrieval with Logarithmic Communication
* Authors: Baoyu Li, Kang Yang, Qi Liu, Binwu Xiang, Xiaogang Zhou, Xiang Xie, Yu Yu
* [Permalink](https://eprint.iacr.org/2026/1814)
* [Download](https://eprint.iacr.org/2026/1814.pdf)
### Abstract
Keyword private information retrieval (PIR) allows a client to retrieve a record associated with a keyword from a database without revealing any information about the keyword.
In the standard single-server setting, existing hintless keyword PIR protocols incur substantial communication and computation costs.
In this paper, we propose an efficient approach to generate $k$-hot vectors (i.e., vectors with exactly $k$ nonrCazero components) in homomorphic-encryption form, and present a bucket-merging technique to decrease the maximum size of buckets. Based on these techniques, we construct LetoPIR, a hintless keyword PIR protocol that outperforms previous PIR protocols in the same setting. Compared to the state-of-the-art hintless keyword PIR scheme, SparsePIR (USENIX'23), LetoPIR achieves a $12.4\times \sim 17.0\times$ improvement in communication cost for databases ranging from $256$ MB to $4$ GB with records of $256$ bytes, and more than $3.0\times$ improvement in computation cost for the $256$ MB database.
Compared to the state-of-the-art keyword PIR scheme with client hint, KPIR (USENIX'25), LetoPIR reduces the communication cost by $51.4\times \sim184.8\times$, while achieving a similar (even better) computation cost.
## 2026/1815
* Title: Novel SMT Encoding for Quantum Circuit Optimization
* Authors: Youbo Guo, Fengrong Zhang, Lei Liao, Yongzhuang Wei, Baocang Wang, Xiaogang Zhou
* [Permalink](https://eprint.iacr.org/2026/1815)
* [Download](https://eprint.iacr.org/2026/1815.pdf)
### Abstract
In recent years, quantum circuit optimization has become an important research topic. Motivated by the fact that quantum gates act on fixed physical wires and modify only their target wires, we propose two SMT encodings: an exact-G encoding and an at-most-G encoding with null gates. Our method speeds up most tested 4-bit S-box instances, achieving up to approximately 130x speedup on the ELEPHANT S-box. Importantly, our method enables automated synthesis of practical 5-bit S-box quantum circuits, such as KECCAK and ASCON. For the KECCAK S-box, in the no-ancilla setting, our model obtains concrete implementations with 17 NCT gates and full depth 51, and with 16 NCT gates and full depth 52, improving the EUROCRYPT 2025 result of Huang et al. It further finds a 13-gate implementation with full depth 55, which is gate-count optimal in the no-ancilla setting under the NCT gate set. In addition, when one ancilla qubit is allowed, our model obtains KECCAK implementations with Toffoli count 5, matching the theoretical lower bound. Finally, our model can also be applied to small-scale linear-layer implementation; for example, it finds a 24-CNOT implementation with depth 3 for the 16x16 linear matrix of MIDORI.
## 2026/1816
* Title: From Lattices to Tensor Cores: Accelerating Private Information Retrieval
* Authors: Sidaarth Sabhnani, David J. Wu
* [Permalink](https://eprint.iacr.org/2026/1816)
* [Download](https://eprint.iacr.org/2026/1816.pdf)
### Abstract
This work introduces SandwichPIR, the first single-server PIR protocol that implements the overwhelming majority of the server computation as dense 8-bit integer matrix multiplications on GPU tensor cores and requires no offline communication. For a 4 GB database with 32 KB records, SandwichPIR answers a query in 8.2 ms and communicates 688 KB of data. This amounts to a server throughput of 488 GB/s and is $88\times$ faster than the best CPU-based protocol that does not rely on offline communication.
The performance of SandwichPIR shines when processing a batch of queries from many independent clients. This moves the server from a memory-bandwidth-bound regime into a compute-bound regime. A single Nvidia L40S GPU can process a batch of 128 queries to the same 4 GB database in 21.0 ms. This gives an amortized per-query processing time of 0.16 ms and an effective throughput of roughly 24 TB/s. This is $50\times$ higher than the single-query throughput. With a fleet of 8 GPUs, SandwichPIR can process a batch of 128 queries to a 256 GB database in 119 ms and achieves an effective throughput of nearly 270 TB/s.
Finally, we show how to use SandwichPIR to enable private access to (text-only) English Wikipedia (8 GB compressed). Retrieving an article (up to 128 KB) requires 768 KB of client-server communication, with an estimated total end-to-end latency under 200 ms over a broadband network connection. By processing 64 queries at a time, a single GPU can handle over 2,500 queries per second (with a computational cost of \$0.20 per million queries based on current AWS pricing).
## 2026/1817
* Title: ATLAS: Automated Approximation of Transformers for Efficient Homomorphic Inference in One Hour
* Authors: Jianhang Xie, Sicheng Tan, Vishnu Naresh Boddeti, Zhichao Lu
* [Permalink](https://eprint.iacr.org/2026/1817)
* [Download](https://eprint.iacr.org/2026/1817.pdf)
### Abstract
Fully homomorphic encryption (FHE) lets a server run inference on encrypted data with strong privacy guarantees, but running a Transformer under FHE is expensive. Its non-linear operations, such as softmax, normalization, and activation, must be replaced with polynomial approximations that the CKKS scheme supports, and the depth of these approximations dominates inference cost. Existing FHE Transformers use hand-tuned approximation settings, such as iteration count and polynomial degree, applied uniformly across layers, models, and tasks. Hand-tuning is slow and error-prone. Even a single uniform setting has about $10^7$ choices, and manual search cannot exploit layer-wise variation. AutoFHE, the only automated method with multi-objective search, targets ReLU-only CNNs and needs full fine-tuning per candidate, which is too costly for Transformers. Per-layer settings also push the search space to about $10^{85}$ for BERT and ViT and $10^{228}$ for LLaMA3, beyond both manual and fine-tuning-based search. We present ATLAS, a training-free framework that automates this search by treating each layer's approximation setting as a multi-objective optimization over latency and accuracy. The problem is hard: the decision space is large (96 or 256 variables), each configuration takes 70 to 1,000 seconds to evaluate even in cleartext, and 85 to 90 percent of configurations are invalid. ATLAS handles this with a two-stage optimization strategy and a surrogate model, completing the search in about one hour. Compared to an iterative softmax baseline, ATLAS cuts multiplicative depth and end-to-end latency by about 35 percent with little accuracy loss, and works across encoder-only, decoder-only, and vision Transformers, complementing parallel work on packing and matrix multiplication.
## 2026/1818
* Title: Blood MERIDIAN: a blockcipher that is not a blockcipher
* Authors: JP Aumasson
* [Permalink](https://eprint.iacr.org/2026/1818)
* [Download](https://eprint.iacr.org/2026/1818.pdf)
### Abstract
MERIDIAN is a 128-bit blockcipher proposed as a lightweight AES alternative. We show that its rCLDirectional SubstitutionrCY layer is not injective by giving an explicit collision. This yields a full 12-round collision for every key. Consequently, no keyed instance of MERIDIAN is a permutation, so no decryption function can invert encryption on all plaintexts, and its blockcipher and PRP security claims fail. We additionally identify a one-round differential that exceeds the claimed bound by a factor 13.37.
## 2026/1819
* Title: On Memory Effects in PWXL variants
* Authors: Jintai Ding, Hao Guo, Bo-Yin Yang
* [Permalink](https://eprint.iacr.org/2026/1819)
* [Download](https://eprint.iacr.org/2026/1819.pdf)
### Abstract
We estimate the intrinsic undercounting in the free-memory-access,
Macaulay coefficient-on-demand RAM modeling when applied to the
Parallelized Wiedemann-based XL in the Ran Wedge attack and in the
Furue--Ikematsu intersection attack, under some optimistic but still
feasible-sounding assumptions for the attackers.
We believe that this shows the memory effects makes UOV secure
enough for Ip, Is, and III. If NIST considers our original
parameters insufficiently convincing, we do not take Furue's
suggested replacements; we offer instead the following
perturbations, which hold $m$ --- and hence the compressed public key
--- fixed and spend only on the vinegar count: uov-Ip\# (256,116,44),
uov-III\# (256,186,72) and uov-V\# (256,250,96).
## 2026/1820
* Title: Practical Silent Threshold Signatures and Silent Threshold Encryption for Dynamic Committees
* Authors: Yifei He, Zheng Zhou, Yu Chen, Zhi Guan, Zhong Chen
* [Permalink](https://eprint.iacr.org/2026/1820)
* [Download](https://eprint.iacr.org/2026/1820.pdf)
### Abstract
Silent threshold signatures (STS) and encryption (STE) enable threshold cryptography without interactive distributed key generation, allowing a group of $N$ parties to non-interactively generate a joint public signature verification key or an encryption key. However, modern distributed systems (such as Ethereum) rely on small, dynamically changing committees of size $n \ll N$ for efficiency, and existing silent threshold schemes either fail to support this dynamic setting or suffer from severe scalability issues. The only known STS construction for dynamic committees, Dyna-hinTS, requires an aggregation time of $O(N\log N)$ per epoch, tightly coupling the cost to the global system size rather than the small active committee. Furthermore, no STE scheme for dynamic committees has been proposed yet.
In this work, we present practical silent threshold signature and encryption schemes for dynamic committees, bringing the aggregation cost down to strictly depend only on the committee size $n$. For signatures, we redesign the Dyna-hinTS framework by replacing its Plonk-style SNARKs with linear pairing checks and a new polynomial commitment for representing the committee, yielding an aggregation time of $O(n\log^2n)$. We also introduce the first silent threshold encryption scheme for dynamic committees with matching efficiency. We further significantly optimize the silent setup phase common to prior STS and STE schemes, reducing each partyrCOs one-time setup (i.e., generating the setup data, referred to as a "hint") cost from $O(N^2)$ to $O(N)$.
We implement our schemes in Rust, and the results demonstrate practicality at scale. For a system parameterized with $N = 2^{20}$ and $n = 2^{10}$, the per-party hint generation takes 197 seconds, and signature aggregation takes 0.153 seconds, achieving a $>1900\times$ improvement over Dyna-hinTS. At the same time, our aggregated signature size, verification key size, and verification time remain constant.
## 2026/1821
* Title: Concrete Security Assessment of Isogeny-based Cryptography with the new Isogeny-Path algorithm
* Authors: Maher Mamah
* [Permalink](https://eprint.iacr.org/2026/1821)
* [Download](https://eprint.iacr.org/2026/1821.pdf)
### Abstract
Very recently, Wesolowski (ePrint 2026/1486) proposed a heuristic
algorithm for solving the supersingular isogeny-path problem in time and
memory \(p^{1/3+o(1)}\), where \(p\) is the characteristic of the underlying field. Although this constitutes an asymptotic improvement over the previous best-known complexity of \(p^{1/2}\log^{O(1)}(p)\), its concrete impact on
the security of isogeny-based cryptographic schemes, particularly SQIsign, remains unclear due to the superpolynomial overhead hidden in the
\(p^{o(1)}\) factor and the algorithm's exponential memory requirement.
In this work, we assess the concrete cost of Wesolowski's attack, study its time--memory tradeoffs, and investigate optimizations based on the
van Oorschot--Wiener (vOW) technique. Our analysis shows that, over the practical memory ranges considered, neither the optimized full-list attack
nor its vOW variants outperform the previous state-of-the-art low-memory algorithm for computing supersingular endomorphism rings. We further study quantum claw-finding improvements. While Grover search can essentially
remove the large memory requirement, it offers little improvement in running time, whereas Tani's algorithm provides a stronger gate--memory tradeoff at
the cost of substantial coherent quantum memory. Overall, our results show
that the asymptotic \(p^{1/3+o(1)}\) improvement does not directly translate into a comparable reduction in concrete security.
## 2026/1822
* Title: Non-Malleable Reductions of Knowledge
* Authors: Antonio Faonio, Lili Tong
* [Permalink](https://eprint.iacr.org/2026/1822)
* [Download](https://eprint.iacr.org/2026/1822.pdf)
### Abstract
Non-malleability for non-interactive zero-knowledge proofs requires that, given a proof for a statement, it is infeasible to derive a valid proof for a related statement without knowing a corresponding witness. We introduce a modular framework for analyzing non-malleable reductions of knowledge (RoKs).
A reduction of knowledge transforms the task of proving knowledge for a source relation into proving knowledge for a target relation, often simpler or more structured. RoKs are an extremely useful tools for compositions. We identify different settings in which the composition of two RoKs, and in particular two non-interactive RoKs obtained via the Fiat-Shamir transform, preserves simulation extractability, and thus non-malleability. Our framework isolates simple and concrete properties required from each component, including novel forms of zero knowledge and new security notions that are easier to verify than full simulation extractability. This yields a systematic toolbox for establishing non malleability in modular proof systems.
Finally, we illustrate the power of our approach by analyzing LaBRADOR (Beullens and Seiler, CRYPTOrCO23), a lattice based proof system for R1CS. We provide the first analysis of its simulation extractability and, since LaBRADOR is not zero knowledge, we design a zero knowledge variant that preserves its practical efficiency and sublinear proof size. Our results show that non-malleability for advanced proof systems can be achieved modularly, significantly simplifying the security analysis.
## 2026/1823
* Title: HyperSolver: Asymptotically and Concretely Accelerating the DelfsrCoGalbraith Attack using Isogeny Ladders
* Authors: Lorenz Panny, Ryan Rueger, Alessandro Sferlazza, Aleksei Udovenko
* [Permalink](https://eprint.iacr.org/2026/1823)
* [Download](https://eprint.iacr.org/2026/1823.pdf)
### Abstract
We present a new variant of the memoryless Delfs-Galbraith algorithm for finding an isogeny path from any given supersingular elliptic curve to a curve with known endomorphism ring. Through existing polynomial-time reductions, our algorithm allows one to solve the supersingular endomorphism-ring problem which lies at the heart of isogeny-based cryptography.
For arbitrary characteristics $p$ our algorithm asymptotically outperforms the previous best Delfs-Galbraith variant by a logarithmic factor; and matches the best previous asymptotic for characteristics with favourable structure.
In addition to the asymptotic analysis, we also calculate a concrete cost estimate for our algorithm in terms of finite-field operations, which indicates that our expected cost is lower than all previous Delfs-Galbraith variants, even concretely. By substituting bit-operation counts for the cost of arithmetic, we can deduce concrete bit-security estimates for isogeny-based cryptographic primitives, including (but not limited to) SQIsign.
As part of the calculation of the expected cost, we also provide a novel analysis of the probability of encountering "distinguished" subgraphs in an expander graph when relying various modes of graph exploration, whose potentially counterintuitive behaviour had apparently remained unnoticed thus far.
Finally, we provide a complete implementation of our algorithm(s), with the asymptotic bottleneck being attacked on GPUs, and the easier post-processing done on CPU using C++ as well as SageMath. Preliminary experimental results suggest that we can solve $100$-bit instances of the problem within less than $100$ GPU hours.
For comparison, the current cryptanalytic record for ECDLP (which has a comparable classical attack complexity) stands at $114$ bits, achieved using significantly more hardware and time.
## 2026/1824
* Title: Comparing Privacy-Preserving Revocation for the EUDI Wallet
* Authors: Andrea Flamini, Anja Lehmann, Giada Sciarretta, Mario Scuro, Nicola Smaniotto, Alessandro Tomasi, Silvio Ranise
* [Permalink](https://eprint.iacr.org/2026/1824)
* [Download](https://eprint.iacr.org/2026/1824.pdf)
### Abstract
The European Digital Identity Wallet has integrated anonymous credentials into its technical specifications, and singles out four constructions for privacy-preserving revocation, drawn from two families: positive dynamic accumulators and signed-pairs. The two families are described in the literature in substantially different terms, and no common basis for comparing them exists, which currently prevents informed and quantitative decision making. In this work, we give a unified treatment of both families, showing that signed-pairs, despite their very different presentation, can be expressed in the standard accumulator syntax. We use this to define a single revocation mechanism that any of the four constructions instantiates, which in turn allows us to compare the resulting mechanisms both at the protocol level and empirically. We measure the performance of all four across the full credential lifecycle, on server-class hardware for the Status Manager and on a smartphone for the Holder and Verifier, with parameters taken from a live national eID scheme. No construction dominates in every aspect, and we make the resulting trade-offs explicit, showing which construction suits which deployment, and identify promising avenues for further improvement at the protocol level.
## 2026/1825
* Title: Enhanced Differential-linear Cryptanalysis of Forr\'{o} with MILP
* Authors: Zhengting Li, Lin Ding, Xinhai Wang, Honglei Wang, Jiang Wan, Fan Zhang
* [Permalink](https://eprint.iacr.org/2026/1825)
* [Download](https://eprint.iacr.org/2026/1825.pdf)
### Abstract
ARX-based design is a major building block of modern cryptographic ciphers due to its efficiency in software. Forr\'{o} is an ARX-based stream cipher proposed by Coutinho et al. at ASIACRYPT 2022, which was designed to provide higher security margin than the ChaCha stream cipher. In this paper, we propose a full automated MILP model called \textit{MinForr\'{o}}, to derive linear approximations for the Forr\'{o} stream cipher. For the differential part, a two-stage strategy to search for single-bit differential trails with high differential correlations is presented, which helps us to find the first-ever 3-round differential trails for Forr\'{o}. By combining the linear approximations obtained by \textit{MinForr\'{o}} and 3-round differential trail for Forr\'{o}, we propose improved differential-linear distinguishers for 4-, 5-, 5.25-, 5.5-, 5.75-, 6-, 6.25- and 6.5-round Forr\'{o} with complexities ${2^{32.44}}$, ${2^{46}}$, ${2^{50}}$, ${2^{64.32}}$, ${2^{87.12}}$, ${2^{117.92}}$, ${2^{174.92}}$ and ${2^{226.88}}$, respectively. The proposed differential-linear distinguishers for 4-, 5-, 5.25- and 5.5-round Forr\'{o} significantly improve the existing distinguishers by factors of ${2^{4.11}}$, ${2^{83.68}}$, ${2^{127.64}}$ and ${2^{178.20}}$, respectively. To the best of our knowledge, this is the first differential-linear distinguisher for Forr\'{o} that reaches 6.5 rounds, which is a significant advancement over the existing record of 5.5 rounds. We have implemented the differential-linear distinguishers for 4- and 5-round Forr\'{o} on a common PC, and the experimental
results confirm the correctness of these distinguishers. Furthermore, when combined with the \textit{Probabilistic Neutral Bits} (PNB) technique, we obtain key recovery attacks on 5.5-, 6-, 6.5- and 6.75-round Forr\'{o} with time complexities ${2^{149.20}}$, ${2^{151.84}}$, ${2^{213.49}}$ and ${2^{251.97}}$, respectively. The proposed key recovery attack on 5.5-round Forr\'{o} significantly improves the time complexity of the existing attack by a factor of ${2^{75.84}}$. To the best of our knowledge, this is the first key recovery attack on Forr\'{o} that reaches 6.75 rounds, which is a significant advancement over the existing record of 5.5 rounds.
## 2026/1826
* Title: Threshold Encryption with Internally Motivated Corruptions
* Authors: Jan Bormet, Hussien Othman, Benedikt Wagner
* [Permalink](https://eprint.iacr.org/2026/1826)
* [Download](https://eprint.iacr.org/2026/1826.pdf)
### Abstract
In recent years, threshold encryption has gained a lot of interest, particularly due to its potential use in encrypted mempools in blockchains.
Standard security models allow the adversary to corrupt parties either statically (i.e., fixed at the onset of the game) or adaptively (i.e., via an oracle one-by-one, depending on keys and ciphertexts).
In this work, we observe that neither of these models captures the case in which a party decides to become corrupted based on secret information. For instance, in an encrypted mempool application with randomly rotating committees, an adversary may set up a smart contract that pays parties who reveal their decryption share, and parties decide whether to claim it based on, say, whether they are on the next committee. Such corruptions are not fixed in advance, but they are also not chosen solely by an external adversary based on public information.
We initiate the formal study of such internally motivated corruptions and partial decryptions. We introduce a security framework in which each party's corruption behavior may depend on its local secret state. That is, on a corruption, the adversary can submit a motivation function and all parties for which this motivation function outputs $1$ (on their secret information) are corrupted. A similar internally motivated behavior is allowed for releasing partial decryptions.
We then study threshold encryption under this stronger notion of security. In particular, we show:
- Negative Results: We show that for certain classes of motivation functions and number of queries, no threshold encryption scheme can satisfy security. We also show a concrete practical attack with internally motivated corruptions against a scheme that has been proven secure with standard corruptions.
- Positive Results: We give two efficient classes of constructions from the (Bilinear) Diffie-Hellman assumptions. The first is secure when partial decryptions on the challenge ciphertext are internally motivated. The second additionally allows internally motivated corruptions.
## 2026/1827
* Title: AVXPoS: Reducing Consensus Verification Cost in the Ethereum Proof-of-Stake Client
* Authors: Ganqin Liu, Hao Cheng, Georgios Fotiadis, Jipeng Zhang, Chen Qian
* [Permalink](https://eprint.iacr.org/2026/1827)
* [Download](https://eprint.iacr.org/2026/1827.pdf)
### Abstract
Ethereum Proof-of-Stake (PoS) clients must verify large volumes of Boneh--Lynn--Shacham (BLS) signatures for attestations, sync-committee messages,
and other consensus-critical objects within fixed slot deadlines. This recurring
cost competes with state transition, fork choice, and message propagation for client CPU time, so reducing it increases the verification headroom available under bursty load. Prior cryptographic-engineering work has shown that SIMD can substantially accelerate BLS verification kernels, but these gains do not automatically survive client software boundaries, runtime scheduling, and irregular verification ranges.
We present AVXPoS, a client-aware batching framework for BLS verification in the Prysm Ethereum PoS client. AVXPoS treats batched verification as a client-level systems problem: it preserves Prysm's verification semantics while reorganizing protocol-shaped requests into native batched states that expose SIMD parallelism across API, worker, and native-backend boundaries. We instantiate AVXPoS with an AVX-512 backend for BLS12-381, combining Go-side range formation with C-side width-adaptive dispatch. On a resource-constrained two-core Intel host, AVXPoS gains $1.44$--$2.10\times$ over Prysm's production \texttt{blst} backend at selected small batch sizes that bracket the post-aggregation $p50/p95/p99$ batch-size quantiles of an all-subnets steady-state mainnet stress trace,
and reaches up to $3.18\times$ in controlled capacity sweeps. On a 16-core AMD host, a production checkpoint-backfill
verifier at Ethereum's 128-block request cap improves by $1.81\times$. Cross-platform results indicate that the relative speedup depends in part on Prysm's worker budget, because worker partitioning determines how much SIMD parallelism remains within each native range.
## 2026/1828
* Title: WeaveTLS: High-Throughput Cross-Connection ML-DSA Authentication in Mutual TLS
* Authors: Ganqin Liu, Hao Cheng, Jipeng Zhang
* [Permalink](https://eprint.iacr.org/2026/1828)
* [Download](https://eprint.iacr.org/2026/1828.pdf)
### Abstract
Mutual TLS (mTLS) authenticates both peers and therefore incurs post-quantum signature costs on every connection. Concurrent handshakes expose independent ML-DSA operations, but executing them jointly is difficult: signing is rejection-divergent, verification uses heterogeneous keys, and synchronous TLS APIs expose authentication work one connection at a time.
We present WeaveTLS, a wire-transparent architecture that executes
ML-DSA authentication across concurrent TLS connections. Its primitive interface combines rejection-aware slot refill with per-request expanded-key handles, supporting both unrelated client keys and shared issuer keys. A stackless OpenSSL continuation lets an nginx worker suspend authentication, expose work from other connections, and execute compatible operations through optimized single-request, four-request, or eight-request AVX-512 kernels without fibers
or cross-thread handoff. WeaveTLS preserves the TLS authentication
barrier, certificate validation, and wire protocol.
On an AMD Ryzen 9 9950X3D, WeaveTLS improves one-core nginx mTLS
throughput by 2.81-4.31$\times$ over OpenSSL's default ML-DSA path and by 2.19-3.29$\times$ over a synchronous reference-C control in the same provider across ML-DSA-44/65/87. At the primitive boundary, expanded-key eight-request verification is 1.65-2.23$\times$ faster than matched cached AVX2, and rejection-aware refill makes ML-DSA-65 signing 1.90$\times$ faster than otherwise identical lockstep scheduling. Cohort publication also weakens client-visible rejection timing under load, reducing attempt-count/latency correlation to 0.063 at concurrency 16 and 0.008 at 64; singleton execution retains the signal.
## 2026/1829
* Title: Decomposed LWE is Equivalent to Succinct LWE
* Authors: Damiano Abram, Gal Arnon, Valerio Cini, Paul Lou, Giulio Malavolta, Lawrence Roy
* [Permalink](https://eprint.iacr.org/2026/1829)
* [Download](https://eprint.iacr.org/2026/1829.pdf)
### Abstract
We prove that the Succinct Learning with Errors assumption, introduced by Wee (CRYPTO '24), and the Decomposed Learning with Errors assumption, introduced by Abram, Malavolta, and Roy (CRYPTO '25), are equivalent under appropriate parameter settings. Abram, Malavolta, and Roy proved that Succinct LWE implies Decomposed LWE. We establish the converse implication, showing that Decomposed LWE implies Succinct LWE.
## 2026/1830
* Title: The Extended Wedge Attack
* Authors: John Baena, Javier Verbel, Luis Villota
* [Permalink](https://eprint.iacr.org/2026/1830)
* [Download](https://eprint.iacr.org/2026/1830.pdf)
### Abstract
The wedge attack of Ran (EUROCRYPT 2026) recovers the secret oil space of a UOV public key over fields of characteristic two by exploiting the fact that the polar forms of the public map are alternating. It has since been generalized in several directions, each carrying its own algebraic tools, e.g., Jin et al. (PKC 2026). Working directly with the polynomials of an oil and vinegar map, we give a simpler description of the attack, based on a dual decomposition of oil-vinegar polynomials, and we recover the original wedge attack and its odd-characteristic analogue as special cases. This framework leads to a generalization, which we call the extended wedge attack. We identify two explicit conditions on the parameters that guarantee that the attack terminates with the recovery of the secret space. We also prove that the matrix of the extended wedge attack is permutation equivalent to the truncated Macaulay matrix in the attack by Furue-Ikematsu (CRYPTO 2026).
## 2026/1831
* Title: Silent-Share: Decoupling Hidden Threshold Matching from Pairing Operations via Group-Valued Oblivious Key-Value Stores
* Authors: Jie Zhang, Xiaohong Li, Ruitao Feng, Guangdong Bai
* [Permalink](https://eprint.iacr.org/2026/1831)
* [Download](https://eprint.iacr.org/2026/1831.pdf)
### Abstract
Matchmaking encryption (ME) enables bilateral access control with private policies, but existing pairing-based constructions tie receiver-side authorization cost to the policy size. This is especially problematic when one party holds a large hidden policy while the other holds only a small attribute set.
We present Silent-Share, a bilateral hidden-policy threshold access-control protocol that decouples policy representation from pairing-based authorization. The construction combines a one-sided hidden-threshold policy-based key encapsulation mechanism (PB-KEM) with a sparse group-valued oblivious key-value store (GOKVS). The GOKVS compactly encodes policy-dependent group elements, so a receiver holding attribute set $\mathcal{A}$ performs exactly $2|\mathcal{A}|$ pairings, independent of the policy size $|\mathcal{P}|$ and threshold $d$. Total decapsulation additionally incurs a hidden-threshold reconstruction cost, characterized separately. Two independent one-sided instances are composed and bound with AES-GCM to realize bilateral authorization.
We prove one-sided KEM confidentiality and policy hiding in the random-oracle model under a hidden common exponent assumption, and extend these guarantees to the bilateral composition. Our implementation on BN254 shows that, when the correct $d$-subset is provided, one-sided decapsulation for $|\mathcal{A}|=10$ takes about $394$ ms, dominated by pairing operations. The pairing-based authorization layer remains flat as $|\mathcal{P}|$ grows from $50$ to $800$, confirming the policy-size independence. The hidden-threshold reconstruction cost is reported separately and can dominate when $|\mathcal{A}|$ is large. Encapsulation is approximately $2$--$3\times$ faster than fuzzy matchmaking encryption across the tested parameter range.
## 2026/1832
* Title: Universally Composable Hybrid PAKE Secure Against Harvest-Now-Decrypt-Later Attacks
* Authors: Yasmine Vazirinejad, Feng Hao, You Lyu, Shengli Liu
* [Permalink](https://eprint.iacr.org/2026/1832)
* [Download](https://eprint.iacr.org/2026/1832.pdf)
### Abstract
We present a hybrid password-authenticated key exchange (PAKE) protocol that is secure against harvest-now-decrypt-later (HNDL) attacks by quantum adversaries, and is universally composable under the parallel composition framework of Lyu and Liu (EUROCRYPT 2025). Existing hybrid PAKE constructions combine a classical PAKE with a post-quantum (PQ) PAKE, with the overall security intended to rely on the stronger of the two. However, identifying which PAKE is stronger is non-trivial, given the limited maturity of post-quantum PAKE designs. Recognizing that the immediate quantum threat is passive, we propose a different hybrid compiler: rather than combining two PAKEs, we encapsulate a classical PAKE within a standard post-quantum Key Encapsulation Mechanism (KEM). This modular separation avoids the fragility of post-quantum password handling while neutralizing HNDL attacks. Our compiler works with any two-pass or three-pass PAKEs. As a concrete instantiation, we construct a three-pass protocol that combines J-PAKE and a post-quantum KEM. We also implement the resulting protocol and provide performance results demonstrating that the hybrid construction remains practical, with the complete handshake executing in $2.81\text{ ms}$. This construction has the distinctive advantage that it does not require any ideal cipher, (constant-time) hash-to-curve, or trusted setup assumptions. Within the Lyu-Liu framework, we show that J-PAKE satisfies the notion of a Full DH-type PAKE. We model the KEM as a password-independent Simulatable DH-type component satisfying the minimal simulation properties required for parallel composition. To capture the prospective quantum threat, we formalize a stronger variant of the standard HNDL threat modelrCowhere the quantum adversary is explicitly granted the plaintext passwordrCoand prove that our protocol achieves Session Key Security and Post-Quantum Forward Secrecy. Our construction relies solely on standardized and widely deployed primitives, yielding a hybrid PAKE that is UC-secure, efficient, and well-suited for real-world deployment during the post-quantum transition.
## 2026/1833
* Title: On the Fault Injection Security of White-box Ciphers
* Authors: Md Alamgir Alam, Avik Chakraborti, Takanori Isobe, Sajani Kundu, Sayandeep Saha
* [Permalink](https://eprint.iacr.org/2026/1833)
* [Download](https://eprint.iacr.org/2026/1833.pdf)
### Abstract
White-box security settings assume an extremely powerful adversary having full visibility and control of the software implementation and internal computations.
Leakage-based attacks extract secret information via a local passive attacker (e.g., malware) and transmit it to a remote server.
However, an active adversary, who can perform fault injections in a white box setting, has received limited attention, especially in the symmetric-key setting.
In this paper, we initiate a formal study of active data-only adversaries in the white-box setting. Such adversaries preserve the control flow of the implementation but corrupt a bounded number of key-embedded lookup-table entries, enabling precise and repeatable manipulation of table values.
Unlike leakage-based attacks, which are constrained by the bandwidth and existence of firewalls, such fault attacks can operate entirely locally. We focus
on a data-only tampering adversary that preserves the control flow of the white-box implementation, but corrupts a bounded number of key-embedded lookup-table entries.
Even under this stealth-preserving restriction, the
adversary can cryptographically weaken the implementation and make faulty ciphertexts significantly easier to decrypt. We formalize such an active adversary by defining a new security notion and studying its impact on contemporary table-based white-box implementations.
Our analyses reveal a structural disparity between two major design paradigms: Feistel-based white-box ciphers appear significantly more vulnerable to fault injection than SPN-based designs. Finally, we propose a software-based fault detection mechanism that detects fault injections with high probability, strengthening resilience. We provide detailed analysis of the SPN-based cipher WEM (the same analyses also work for other SPN-based ciphers like SPNbox), and two Feistel-based ciphers SPACE and Galaxy. Our analyses reveal that SPACE and Galaxy are significantly more vulnerable than WEM, under our fault-based security setting. Precisely, we show that WEM achieves high security under all the adversarial models, whereas SPACE and Galaxy instances can be attacked with a very high message recovery probability of $2^{-8}$, when the adversary can choose the fault positions and the values and corrupts up to one fourth of the implementation table entries.
--- Synchronet 3.22a-Linux NewsLink 1.2