From Newsgroup: sci.crypt

## In this issue
1. [2025/888] Bootstrapping GBFV with CKKS
2. [2026/168] Beyond Feedforward Networks: Cryptanalytic ...
3. [2026/237] Exploiting SNOVArCOs Structure in the Wedge Product ...
4. [2026/867] On the (Privacy) Harms of the European Digital ...
5. [2026/975] Functional Bootstrapping for a Single LWE ...
6. [2026/1140] Tree Encodings II: Correlation Intractability for ...
7. [2026/1164] Algebraic Cryptanalytic Extraction on Hard-Label ...
8. [2026/1579] Slipway: Accessing Finite Subspace Trails in Poseidon
9. [2026/1718] On Post-Quantum Multi-Key Security of GCM
10. [2026/1836] FHE for ALU over Large Prime Moduli and Application ...
11. [2026/1907] Higher-order differential attacks on the full DuX
12. [2026/1919] Second Round Key Recovery and a Floating-Point ...
13. [2026/1984] Improving GIJS Key Recovery for Classic McEliece
14. [2026/1999] Revisiting Single-Color Initial Structures in Meet- ...
15. [2026/2011] CauchyFold: Residue-Optimal High-Arity Lattice ...
16. [2026/2019] The Residue Is the Resource: Exact Fresh-State ...
17. [2026/2031] Mind Small Integers in MDS Matrix: Collision ...
18. [2026/2033] Efficient Single-Server Online-Offline PIR without ...
19. [2026/2045] Practical Key Recovery Attacks on Full DuX and ...
20. [2026/2048] Linear list size bounds for Reed-Solomon beyond the ...
21. [2026/2055] A Locality-Sensitive Hashing Framework for Reducing ...
22. [2026/2056] Reed-Solomon Codes Beyond Johnson: Efficient ...
23. [2026/2057] Low-Space Quantum Discrete Logarithms on Genus-Two ...
24. [2026/2058] Trace-Factored BigSwitch for Matrix-Friendly FHE
25. [2026/2059] On Aborts in Differential Privacy
26. [2026/2060] DelegProof: A Machine-Checked Security Analysis of ...
27. [2026/2061] Normal Alignment: Improved Cryptanalytic Sign ...
28. [2026/2062] Hamming Ideals and Grobner Bases for ISD-like ...
29. [2026/2063] Witness Encryption for NP from SNARGs and Groups
30. [2026/2064] Area-Time Efficient NTRU Prime Decapsulation: ASIC ...
31. [2026/2065] Differentially Oblivious Resizing for Group-By ...
32. [2026/2066] Optimizing HAETAE and SMAUG-T on Cortex-M4 for ...
33. [2026/2067] Maltese: Succinct Polynomial Commitment from Lattices
34. [2026/2068] Distributed SNARGs Resilient to Corrupt Verifiers
35. [2026/2069] Default Correct: A New Fault Surface in the ...
36. [2026/2070] Polynomial Time Algorithms for the Kadison-Singer ...
37. [2026/2071] Soft Analytical Side-Channel Attacks on SHA-2 and HMAC
38. [2026/2072] Sunshine Systems: Enabling Privacy-Preserving ...
39. [2026/2073] Revisiting ML Training under Fully Homomorphic ...
40. [2026/2074] Revisiting Malicious Private Aggregation: ...
41. [2026/2075] Bounding the Excess Risk for Linear Models Trained ...
42. [2026/2076] Symmetry-Graded Digit Extraction Framework for ...
43. [2026/2077] Practical Group Signatures from Tag-Based NTRU Sampler
44. [2026/2078] Radical Ring-LWR: Efficient Key Encapsulation and ...
45. [2026/2079] Period-Aligned Secure Cosine Evaluation Based on ...
46. [2026/2080] Lightweight Cryptography for Secure UAV Data ...
## 2025/888
* Title: Bootstrapping GBFV with CKKS
* Authors: Jaehyung Kim
* [Permalink](https://eprint.iacr.org/2025/888)
* [Download](https://eprint.iacr.org/2025/888.pdf)
### Abstract
Generalized BFV (GBFV) replaces the integer plaintext modulus of BFV with a polynomial plaintext modulus, yielding a flexible tradeoff between precision and SIMD parallelism. This framework encompasses both BFV and CLPX, with CLPX corresponding to the extreme large-precision endpoint where very large plaintext moduli can be supported without increasing the underlying RLWE dimension. However, bootstrapping remains a bottleneck throughout the large-precision GBFV regime: existing GBFV bootstrapping methods rely on BFV-style linear transformations, whose noise growth becomes prohibitive as the plaintext precision grows. We introduce a GBFV bootstrapping method that treats the noise of a GBFV ciphertext as a CKKS plaintext and bootstraps it through CKKS. The main obstacle is that the BFV-from-CKKS bootstrapping technique of Kim et al. (CCS'24) relies on integer plaintext scaling and does not directly apply to GBFV, whose scaling factor involves a polynomial plaintext modulus. We overcome this by developing a noise-extraction and recovery procedure tailored to polynomial plaintext moduli. Our implementation bootstraps large-precision GBFV instances, including CLPX for the first time, supporting plaintext moduli of more than $500{,}000$ bits in less than $20$ seconds. We also introduce GBFV-to-CKKS and CKKS-to-GBFV conversions, interpreting the former as an approximate digit-decomposition toolkit for non-arithmetic operations over large GBFV plaintext spaces.
## 2026/168
* Title: Beyond Feedforward Networks: Cryptanalytic Extraction of RNNs
* Authors: Longxiang Wei, Hao Lei, Xiaokang Qi, Xiaohan Sun, Lei Gao, Kai Hu, Wei Wang, Meiqin Wang
* [Permalink](https://eprint.iacr.org/2026/168)
* [Download](https://eprint.iacr.org/2026/168.pdf)
### Abstract
Recurrent neural networks (RNNs) play an important role in time series modeling, signal processing, and resource constrained applications. Their parameters encode valuable functionality and constitute proprietary intellectual property. Cryptanalytic extraction tests whether black box queries reveal functionally equivalent parameters. Such analysis is important for assessing the security of deployed RNNs. However, prior cryptanalytic attacks mainly target feedforward networks such as fully connected networks (FCNs) and convolutional neural networks (CNNs). RNNs reuse their recurrent parameters at every time step, which existing extraction pipelines do not address.
We present cryptanalytic extraction of ReLU RNNs, including single-layer and stacked (a.k.a. multi-layer) RNNs, in both the hard-label and raw-output settings. To the best of our knowledge, this is the first such extraction. Using controlled inputs, we construct equivalent feedforward models whose depths depend on the number of recurrent layers, independently of the sequence length. However, parameter recovery from the equivalent models may yield recurrent weights with incompatible neuron orderings and positive scalings for the previous and current hidden states. We develop recurrent parameter alignment to make these transformations consistent and enable parameter reuse across time. Stacked RNNs are harder, because one equivalent model contains coupled branches, which prevent direct use of FCN sign recovery and complicate signature recovery. We therefore further develop two techniques, recurrent parameter recovery and folded bias difference. The former uses the recovered input weights to guide clustering and recover the remaining recurrent parameters, including their signs. The latter handles neurons that are otherwise difficult to recover.
We demonstrate end-to-end extraction across five RNN architectures with up to three recurrent layers in both observation settings. An additional raw-output experiment extends the sequence length from 20 to 1024 using the same target parameters.
## 2026/237
* Title: Exploiting SNOVArCOs Structure in the Wedge Product Attack
* Authors: Maxime Bros, Thai Hung Le, Jacob Lichtinger, Brice Minaud, Ray Perlner, Daniel Smith-Tone, Cristian Valenzuela
* [Permalink](https://eprint.iacr.org/2026/237)
* [Download](https://eprint.iacr.org/2026/237.pdf)
### Abstract
Post-quantum cryptography (PQC) aims to develop cryptographic schemes secure against quantum adversaries. One promising class of digital signature schemes is based on multivariate quadratic equations, where Unbalanced Oil and Vinegar (UOV) is a leading example. UOV has been extensively studied since its introduction by Kipnis, Patarin, and Goubin at Eurocrypt 1999, and it has remained secure. The signature sizes the scheme allows are quite small; however the key sizes are very large, making the scheme less attractive for some common protocols. To remediate this deficiency, some schemes---such as MAYO, QRUOV, and SNOVA---add a structure to reduce the size of the public key. These multivariate schemes are candidates that made it to the third round of the National Institute of Standards and Technology's Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process. In this work, we revisit a recently proposed algebraic attack by Ran at Eurocrypt 2026 on UOV and extend this approach to a new attack on SNOVA by exploiting its block-ring structure. In addition to improving the attack complexity, the exploitation of the block-ring structure rules out spurious solutions, which prevents the generic version of Ran's attack from applying to SNOVA. This attack breaks 6 of the 11 second-round SNOVA parameter sets and improves on the previous best result for an additional 2 sets; it is significantly more effective against larger $\ell$ in comparison to several earlier attacks. For example, for SNOVA-V with parameters $(v,o,\ell) = (29,6,5)$, the estimated security drops to $181$ bits, compared to $310$ bits for the previous best known attack.
## 2026/867
* Title: On the (Privacy) Harms of the European Digital Identity Framework
* Authors: Christian Knabenhans, Shannon Veitch, Mathilde Raynal, Theresa Stadler, Sylvain Chatel, Wouter Lueks, Carmela Troncoso
* [Permalink](https://eprint.iacr.org/2026/867)
* [Download](https://eprint.iacr.org/2026/867.pdf)
### Abstract
As digital identity frameworks (DIFs) gain traction around the world, many see privacy-enhancing technologies (PETs) as the key to prevent their potential negative societal impacts such as discrimination or surveillance. We critically examine whether PETs can achieve this goal using the European Digital Identity Framework (EUDIF) as an example. We develop a harm analysis methodology based on harm trees that illustrates how information leakage, certain design decisions, or a DIF's deployment context lead to harms. We leverage techniques from cryptographic modeling to formally capture the leakage of the core functionality of the EUDIF and its proposed applications. Our harm modeling elucidates which pathways to harm are inherent to the EUDIF's core functionality, and which pathways can be mitigated through PETs. Our analysis shows that, while PETs can reduce information flows, they fall short in actually mitigating the harms that deploying digital identity can bring to individuals and society.
## 2026/975
* Title: Functional Bootstrapping for a Single LWE Ciphertext with \(\tilde{O}(1)\) Polynomial Multiplications
* Authors: Xiaopeng Zheng, Hongbo Li, Dingkang Wang
* [Permalink](https://eprint.iacr.org/2026/975)
* [Download](https://eprint.iacr.org/2026/975.pdf)
### Abstract
Bootstrapping is the key technique that turns leveled homomorphic encryptionc into fully homomorphic encryption, but it remains a major efficiency bottleneck. Recent work by Z. Liu and Y. Wang (ASIACRYPT 2023) showed how to bootstrap \(N\) LWE ciphertexts with total cost of \(\widetilde{O}(N)\) polynomial multiplications based on the BFV scheme. However, their results achieve \(\widetilde{O}(1)\) complexity only through amortization over large batches, and do not give a genuine non-amortized \(\widetilde{O}(1)\) bound for a single ciphertext.
In this paper, we present a BFV-based functional bootstrapping algorithm for arbitrary functions over large plaintext spaces with total cost of \(\widetilde{O}(1)\) polynomial multiplications for one LWE ciphertext. The same construction also supports small and moderate batches, and processes a batch of \(m\) ciphertexts with total cost \(\widetilde{O}(m)\) in the supported parameter range. The main technical ingredient is a sparse-packing polynomial-evaluation method for BFV ciphertexts, which exploits the duplicated-slot structure to evaluate an arbitrary polynomial on \(m\) encrypted inputs with total cost of \(\widetilde{O}(m)\).
We implement the scheme in Lattigo using the BFV scheme. At 128 bit security and on a single thread, bootstrapping an arbitrary function takes 3.15 seconds for one ciphertext encrypting a 9-bit plaintext and 3.77 seconds for 128 such ciphertexts in one batched invocation. For 16-bit plaintexts, it takes 10.63 seconds for one ciphertext and 18.07 seconds for 16 ciphertexts. These results show that non-amortized single-ciphertext functional bootstrapping, as well as small and moderate batch bootstrapping, can be practical for arbitrary functions over relatively large plaintext spaces.
## 2026/1140
* Title: Tree Encodings II: Correlation Intractability for all Batched Relations
* Authors: Damiano Abram, Giulio Malavolta, Lawrence Roy
* [Permalink](https://eprint.iacr.org/2026/1140)
* [Download](https://eprint.iacr.org/2026/1140.pdf)
### Abstract
The Fiat-Shamir transform is a central tool in cryptography and understanding its soundness is both a theoretically challenging and practically pressing question. Correlation intractable hash functions offer a method to instantiate Fiat-Shamir in the standard model. In short, a hash function is correlation-intractable for a relation $\mathcal{R}$ if it is computationally hard to find an input $x$ such that $\mathcal{R}(x, \mathsf{Hash}(x)) = 1$.
In this work we present the first construction of a correlation-intractable hash function family, where the complexity of the hash does not depend on the complexity of the relation. Besides being better aligned with the way Fiat-Shamir is used in practice, our construction implies correlation intractability for all (possibly inefficient) batched searchable relations, i.e., searchable relations that can be decomposed as a direct product of other searchable relations. Using complexity leveraging, we then compile our construction into correlation intractability for all sufficiently sparse batched relations. All of our results follow from the hardness of the decomposed short-integer solution (DSIS) problem, the natural search analogue of decomposed LWE, which we show to be at least as hard.
As a direct consequence from prior work, our result implies that {sufficiently many parallel repetitions} of any perfectly complete public-coin three-message proof {for a language outside $\mathrm{BPP}$ are not zero-knowledge}. Moreover, we obtain non-interactive zero-knowledge (NIZKs) arguments for $\mathrm{NP}$ from the sub-exponential hardness of DSIS.
## 2026/1164
* Title: Algebraic Cryptanalytic Extraction on Hard-Label Neural Networks
* Authors: Zirui Chen, Shi Tang, Zhengchao Gao, Yongjia Su, Lingyue Qin, Xiaoyang Dong
* [Permalink](https://eprint.iacr.org/2026/1164)
* [Download](https://eprint.iacr.org/2026/1164.pdf)
### Abstract
Although the state-of-the-art model extraction attack on the hard-label Fully-connected Neural Network (FCN) by Carlini et al. at EUROCRYPT 2025 has polynomial-time complexity in theory, its dual-point clustering relies on singular value decomposition (SVD) with a time complexity of $\mathcal{O}(n^2 (d^{(k)})^3)$, resulting in huge runtime in practice. To address this computational bottleneck, this work transforms Carlini et al.'s geometric-view hard-label attack into an algebraic framework, and proposes two efficient clustering methods: Normal Rank Check (NRC) and Approximate Signature Vector (ASV). The NRC and ASV methods replace Carlini et al.'s heavy SVD-based rank checking with simple rank checking or inner-product operations, reducing the clustering complexity to $\mathcal{O}(n (d^{(k)})^3)$ on average. Furthermore, this paper presents the first model extraction attack against hard-label max-pooling Convolutional Neural Networks (CNNs) by combining the ASV method with the kernel-centric clustering scheme instead of the neuron-centric clustering, which fully exploits the property of weight sharing in convolutions and fills a cryptanalysis gap. Experiments on FCNs and the max-pooling LeNet-5 demonstrate that our NRC/ASV methods drastically cut clustering time, and improve the overall efficiency in the model extraction.
## 2026/1579
* Title: Slipway: Accessing Finite Subspace Trails in Poseidon
* Authors: Giuseppe Vitto
* [Permalink](https://eprint.iacr.org/2026/1579)
* [Download](https://eprint.iacr.org/2026/1579.pdf)
### Abstract
Poseidon is an algebraic permutation designed for efficient use in proof systems. Its nonlinear layer consists of power-map S-boxes. In a full round, the S-box is applied to every state coordinate; in a partial round, it is applied to only one coordinate, reducing the arithmetization cost. Each round also applies an MDS linear layer to diffuse information across the state.
To study algebraic degree, we let the input depend on variables and follow the resulting family of states through the permutation. If the coordinate entering a partial-round S-box is constant across that family, the S-box adds no degree in the family variables. Directions with this property over several consecutive partial rounds form finite subspace trails. Such trails exist for every linear layer, but their existence does not by itself explain how a constrained family can pass through the preceding full rounds and enter them without first acquiring high degree.
We address this reachability problem by constructing a constrained input family and a round-constant-dependent MDS matrix together. The prescribed matrix images carry the family through the four initial full rounds and into a chosen finite trail. After an explicit change of variable, the state at the end of the full-round prefix is linear in the new root variable, so the prefix acts as a controlled reparametrization rather than as a source of degree growth. We call this effect full-round absorption.
For the KoalaBear instance $(t,\alpha,R_F,R_P)=(16,3,8,20)$, we construct a two-parameter family whose first two input coordinates are zero. On this family, the four initial full rounds act as a reparametrization and deliver the variable directions into a two-dimensional trail, so those four rounds and the next fourteen partial S-boxes add no degree. For the exhibited control, the polynomials representing the first two output coordinates have exact degree $3^{R_F+R_P-4-14}=3^{10}$, rather than the expected degree $3^{R_F+R_P}=3^{28}$. We exhibit a common base-field root, yielding a complete CICO-2 solution for the full-round Poseidon instance.
The resulting matrices are MDS and satisfy the relevant matrix checks prescribed by the Poseidon designers, yet they make a finite trail reachable through the full-round prefix. We generalize the construction to CICO-$k$, derive bounds on trail dimension and matrix images, and provide a concrete MDS matrix that meets the CICO-3 matrix-image bound with equality.
## 2026/1718
* Title: On Post-Quantum Multi-Key Security of GCM
* Authors: Akinori Hosoyamada
* [Permalink](https://eprint.iacr.org/2026/1718)
* [Download](https://eprint.iacr.org/2026/1718.pdf)
### Abstract
This paper studies the post-quantum multi-key security of Galois/Counter Mode (GCM) in the Quantum Ideal Cipher Model (QICM).
GCM is one of the most widely used AEAD schemes.
In practice, widely deployed cryptosystems are often instantiated under many independent keys, making the multi-key setting practically relevant.
A trivial reduction from the multi-key setting to the single-key setting incurs a security loss proportional to the number of keys.
In particular, in the post-quantum setting, the term corresponding to exhaustive key search becomes \(up^2/2^k\), where \(u\) is the number of keys, \(k\) is the key length, and \(p\) is the number of quantum queries to the underlying block cipher \(E\) and its inverse, with \(p\) serving as a coarse measure of the amount of offline (quantum) computation performed by the adversary.
For example, when \(u=2^{32}\), the term \(up^2/2^k\) reaches constant order at \(p=2^{48}\) for \(k=128\) and at \(p=2^{80}\) for \(k=192\).
We show that, at the cost of additional loss terms, the \(u\)-dependent quantum key-search term \(up^2/2^k\) can be replaced by a term of order \(\sqrt{dp^2/2^k}\), where \(d\) denotes the maximum number of keys under which the same nonce appears in encryption queries.
Thus, when \(d\) is much smaller than \(u\) and the additional loss terms remain small, our bound improves upon the trivial multi-key bound in that the security bound reaches constant order only at a substantially larger value of \(p\).
This can be viewed as a post-quantum counterpart of the classical result of Hoang et al. (CCS 2018).
As in their work, for randomized nonce-generation mechanisms that abstract patterns used in protocols such as TLS, the parameter \(d\) remains small even when \(u\) is large.
Although our bounds are not tight and leave room for improvement, they give non-trivial post-quantum multi-key guarantees for several concrete parameter settings.
To the best of our knowledge, this is the first non-trivial post-quantum multi-key security bound for an AEAD mode in the QICM.
Our proof combines the reprogramming-and-resampling approach of Alagic et al. (EUROCRYPT 2022) with counting arguments used in the classical multi-user analysis of GCM by Hoang et al.
## 2026/1836
* Title: FHE for ALU over Large Prime Moduli and Application to One-Round Threshold ECDSA
* Authors: Yuchen Wei, Kaisheng Ma, Mingyu Gao, Hongren Zheng
* [Permalink](https://eprint.iacr.org/2026/1836)
* [Download](https://eprint.iacr.org/2026/1836.pdf)
### Abstract
Fully Homomorphic Encryption (FHE) has served as a theoretical building block for cryptographic primitives, but concrete instantiations remain limited by the cost of generic homomorphic computation. One example is the universal thresholdizer that compiles any (deterministic) signature scheme into a multi-party threshold signature scheme with a one-round signing protocol (Boneh et al., Crypto'18), where the signing algorithm is homomorphically evaluated without communication with other parties. Practically, however, the signing algorithm itself often involves different types of computation. For example, ECDSA requires a hash function, point arithmetic over the high-precision defining field $\mathbb{F}_p$, and base-point group arithmetic over $\mathbb{F}_u$. Generic schemes like DM/CGGI take days to complete the homomorphic evaluation. Recent schemes like Boneh--Kim (Crypto'25), Cha--Park--Lee (Eurocrypt'26) and Gao--Zheng (Crypto'26) either support only one computation type, or lack efficient conversion methods.
We propose a new FHE scheme whose arithmetic logic unit supports both large prime modulus arithmetic and bit-level operations. We then specialize it to the $\mathbb{F}_p$ mode, the $\mathbb{F}_u$ mode and the Boolean mode for ECDSA. Our key component is a homomorphic canonicalization operation that restores the unique bit representation of the encrypted messages. It requires a constant number of CKKS bootstrapping operations regardless of the bit-width of the prime moduli, and it therefore enables efficient high-precision conversions like $\mathbb{F}_p$-to-$\mathbb{F}_u$ modular reduction and $\mathbb{F}_u$-to-Boolean conversion. The conversion to Boolean mode is essential to allow noise flooding in the threshold decryption process.
For the workload of $\mathbb{F}_u$ modular multiplication followed by conversion to bit representation in GPU, we estimate a 14.5$\times$ and $\sim$19000$\times$ better amortized latency compared with Montgomery-based approach in Cha--Park--Lee and TFHE-rs based approach, respectively. Our end-to-end homomorphic ECDSA signing experiment takes 56s on an NVIDIA RTX Pro 6000 GPU. To the best of our knowledge, it is the first concrete FHE-based construction towards threshold ECDSA with one-round signing.
## 2026/1907
* Title: Higher-order differential attacks on the full DuX
* Authors: Guoqiang Liu, Bing Sun
* [Permalink](https://eprint.iacr.org/2026/1907)
* [Download](https://eprint.iacr.org/2026/1907.pdf)
### Abstract
DuX is a family of substitution-permutation block ciphers over $\mathbb{F}_q^{16}$ with $q\in\{2^{8},2^{16},65537\}$ and twelve rounds. For the two large-word instances its designers estimate that integral and higher-order differential distinguishers in the encryption direction reach at most six rounds, and fix the number of rounds accordingly. We bound the word-wise algebraic degree of DuX by exponent sets in the decryption direction, where the decryption S-box has coordinate degrees $(2,3,4,2)$ against the $(5,3,2,8)$ of the encryption S-box. Each row of the inverse diffusion matrix is supported on two residue classes of word indices modulo four. An active set equal to one class therefore keeps the vector of degree bounds constant within each class at every layer, and we prove that the four class-wise bounds then obey an exact recursion with base $2+\sqrt{3}$ instead of four. This yields higher-order differential distinguishers for eleven rounds of DuX($2^{16}$) and DuX($65537$) with $q^{4}$ chosen ciphertexts, and for seven rounds of DuX($2^{8}$) with $2^{88}$. Extending one round towards the plaintext gives three successive systems of equations. Every unknown there has a coefficient computed from the returned plaintext words, and the key words recovered at one stage are substituted into the next; for DuX($65537$) the last two systems are replaced by bivariate interpolation. Once each system attains the maximal rank that its structure permits, a condition that can be checked during the attack, solving the systems recovers all sixteen master-key words of the full twelve-round DuX($2^{16}$) and DuX($65537$). The data and time complexity is $2^{67.32}$ and $2^{67.58}$ with constant memory, and eight rounds of DuX($2^{8}$) are covered with $2^{91.32}$. The two diffusion layers differ by a rotation of four words, so the analysis is the same for each of the $2^{11}$ key-dependent choices of diffusion layers.
## 2026/1919
* Title: Second Round Key Recovery and a Floating-Point Attack on DNN-based AES Implementations
* Authors: Sisung Kim, Minjae Lee, Dongjae Lee
* [Permalink](https://eprint.iacr.org/2026/1919)
* [Download](https://eprint.iacr.org/2026/1919.pdf)
### Abstract
At EUROCRYPT 2026, G|-rault et al. introduced natural DNN implementations of block ciphers: ReLU networks that agree exactly with the underlying cipher on binary inputs but extend it continuously to real-valued inputs. They showed that this extension exposes the first round key to recovery, and proposed a generic Secure Blackbox Transformation that turns an arbitrary DNN-based implementation into a provably secure implementation. We revisit both sides of their result. On the attack side, the known attacks on the unprotected implementation reach only the first round key. Under the same threat model, we refine the absorption property of the natural S-box and combine it with a chosen-plaintext collision test, validated empirically, to recover the second round key of AES-256 in about $2^{39}$ queries. On the defense side, their transformation is provably secure over the reals, but that guarantee does not carry over to finite precision, where any neural-network implementation must ultimately run. We give a floating-point attack that recovers the first round key of the protected AES-128 implementation in 128 chosen queries, driven by an input value that the defense fails to round to a bit. Such a value exists in bfloat16, float16, float32, and float64, so moving to higher precision does not remove the weakness. We confirm the recovery in all four formats. Finally, we block the attack with a clamp placed before the defense's rounding step, which keeps every finite input in $[0,1]$ in the working precision and changes neither the cipher nor the exact-real security guarantee.
## 2026/1984
* Title: Improving GIJS Key Recovery for Classic McEliece
* Authors: Stephen A. Weis
* [Permalink](https://eprint.iacr.org/2026/1984)
* [Download](https://eprint.iacr.org/2026/1984.pdf)
### Abstract
Ghoshal, Ishai, Jain and Sun (GIJS) recently gave the first distinguisher for Classic McEliece public keys that is cheaper than generic decoding, at an estimated $2^{114}$ to $2^{124}$ bit operations for the five NIST candidate parameter sets, and have since extended it to a key-recovery algorithm. The distinguisher is one large sparse linear-algebra computation. We show that this computation already contains the secret key, and we give two ways to extract it. The first takes the gradients of the polynomials that the distinguisher computes. We prove which subcode of the public code they span at each column, and the key follows from these subcodes by linear algebra, at the cost of $100$ to $1400$ runs of the distinguisher. The second builds on the key recovery of GIJS and reads the whole support from a single run.
We also lower the cost of a run by about $20$ bits, using two facts about binary Goppa codes that we prove and two heuristic assumptions that we test. Key recovery then costs $2^{94}$ to $2^{102}$ bit operations in the model of GIJS, against $2^{151}$ to $2^{287}$ for information-set decoding. That model does not charge for memory, and nine tenths of the operations fetch a bit from a vector of $2^{48}$ to $2^{52}$ bits. Charging for memory as the Classic McEliece security guide does gives $2^{110}$ to $2^{128}$. The cost depends on $m$ and $t$ but not on the length $n$, and it grows by about eight bits per unit of $m$. Raising $m$ to $18$, $26$ and $34$, with $n$ well below $2^m$, puts a run above $2^{143}$, $2^{207}$ and $2^{272}$ at public keys of about $0.6$, $2$, and $7$ MB.
None of this is close to practical, and several ingredients are heuristic. We state each as an explicit assumption and test it by running the attacks end to end on small keys and, where no run is needed, at full Classic McEliece size. As a demonstration we recovered the secret key of instance 253 of the TII McEliece key-recovery challenges ($m=8$, $t=9$, $n=214$), a toy-sized code that had not been solved, with two sparse kernel computations of about $10^7$ unknowns and $700$ core-hours each.
## 2026/1999
* Title: Revisiting Single-Color Initial Structures in Meet-In-The-Middle Attacks
* Authors: Shiyao Chen, Jian Guo, Wenjie Nan, Danping Shi, Tianyu Zhang
* [Permalink](https://eprint.iacr.org/2026/1999)
* [Download](https://eprint.iacr.org/2026/1999.pdf)
### Abstract
The meet-in-the-middle (MITM) attack framework is one of the most powerful cryptanalytic techniques with broad influence to preimage, key recovery, and collision attacks. In this paper, we present two generic techniques. First, we observe that the constant space in MITM attacks is an exploitable source of degrees of freedom: its value-independence enables MITM-style partition and acceleration of attack subprocesses. With this intuition in mind, we revisit the single-color initial structure technique by Chen et al. at Asiacrypt 2025, and find an improved algorithm that relaxes the canonical optimization objective in automatic search for MITM attacks. Second, we extend the partial-target-preimage-to-collision conversion by Li, Isobe, and Shibutani at FSE 2012 used in MITM-based collision attacks to the settings of chosen-prefix collision and diamond structure construction. We demonstrate the practical relevance of our techniques by presenting a number of improved results in (pseudo-)preimage, (chosen-prefix) collision, and herding attacks on AES-like constructions over the state-of-the-art.
## 2026/2011
* Title: CauchyFold: Residue-Optimal High-Arity Lattice Folding via Scaled Cauchy Challenges
* Authors: Xiang Wang
* [Permalink](https://eprint.iacr.org/2026/2011)
* [Download](https://eprint.iacr.org/2026/2011.pdf)
### Abstract
High-arity folding combines several relation instances in one step, but a direct quadratic expansion exposes quadratically many mixed terms. Scaled Cauchy challenges admit a carrier: a polynomial representing the mixed contribution with linearly many field coordinates [58]. CauchyFold turns this representation into a committed lattice folding protocol.
Two algorithms construct this carrier without enumerating all source pairs. One uses multipoint evaluation; the other computes residues at the Cauchy poles. Both have quasi-linear arithmetic cost in the arity when relation dimensions are fixed. The protocol commits the carrier before the Cauchy challenge. It encodes the folded field values as bounded commitment openings, checks the folded relation over an extension field, and reduces the remaining linear claims through a finite sequence of lattice relations.
For a classical prover that can be reset to a complete checkpoint, extraction returns valid source openings or a short nonzero vector in the kernel of a specified commitment matrix. The analysis accounts for bounded retries and expected extraction time, and averages the reduction over the joint setup distribution. A deterministic compiler instantiates a sparse quadratic relation at arity sixteen. For this instance, we give exact statistical and communication bounds, operation counts separated by arithmetic type, and lattice-attack estimates for all twenty independently sampled commitment matrices. The communication includes all independent verifier randomness.
## 2026/2019
* Title: The Residue Is the Resource: Exact Fresh-State Complexity, Reconstruction Limits, and Challenge Design in Folding
* Authors: Xiang Wang, Ji Xiang
* [Permalink](https://eprint.iacr.org/2026/2019)
* [Download](https://eprint.iacr.org/2026/2019.pdf)
### Abstract
Folding protocols cross public-randomness boundaries: input-dependent information must be fixed before a challenge is known, while the required output may depend on it. We ask how much state must be retained after accounting for information already available at the boundary. With unrestricted prechallenge preprocessing and linear postchallenge readout, a retained representation is feasible exactly when its coordinates span, modulo this available information, every output direction induced by the supported challenges. Thus the minimum retained width is the dimension of this residual output space.
The width depends on both the admissible source domain and the actual challenge support. Coordinatewise multiplication of length-\(n^2\) vectors has width \(n^2\) on the full product domain but \(2n-1\) when both inputs lie in the dimension-\(n\) Reed--Solomon code evaluated at \(n^2\) distinct points. Below the exact-width threshold, for independent uniform inputs to a bilinear map, we characterize the optimal exact-reconstruction probability by a rank-weighted subspace optimization. Bilinear side information couples the missing directions through a common linear correction, so optimizing them independently can fail.
Applying the framework to direct homogeneous quadratic folding on a full product domain, an algebraic separation condition on the challenge family forces width at least \(rk\), where \(r\) is the dimension of the span of mixed bilinear outputs. Scaled-Cauchy challenges attain this bound on any support of at least \(2k+1\) distinct non-pole values and yield an explicit matching \(rk\)-coordinate polynomial representation.
## 2026/2031
* Title: Mind Small Integers in MDS Matrix: Collision Attacks on Round-Reduced Reinforced Concrete
* Authors: Jiamin Cui, Fukang Liu, Jianqiang Ni, Willi Meier
* [Permalink](https://eprint.iacr.org/2026/2031)
* [Download](https://eprint.iacr.org/2026/2031.pdf)
### Abstract
The rapid advancement of Zero-Knowledge Proofs (ZKP) has motivated the design of ZK-friendly hash functions.
A relatively new design strategy for ZK-friendly hash functions is using the composition of small look-up tables (LUTs) to build a nonlinear transform (called \bars layer) over a large prime field $\Fp$. This not only improves the plain performance but also enhances its security against algebraic attacks since the \bars layer is equivalent to a complex and high-degree polynomial over $\Fp.$ This design strategy was first proposed at CCS 2022 for the ZK-friendly hash function \rc. However, there has been no third-party collion attacks of \rc since then, and all existing attacks on such LUT-based ZK-friendly ciphers like \tip, \mono and \sky mainly exploit the differential or linear properties of \bars.
In this paper, we demonstrate that the \bars layer surrounded by MDS matrices (called \conc layers) with small integers, i.e., $\conc\circ\bars\circ \conc$, might lead to weaker differential properties of the round function. This key observation leads to a novel collision attack on 4.5 out of 7 rounds of \rc, successfully bypassing the \bars layer as well as the subsequent \conc layer and power-map-based nonlinear layer (called \brick layer). The attack is verified by providing a practical collision for 3.5-round \rc where the last 4 layers are $\bricks \circ \conc \circ \bars\circ \conc$.
Furthermore, we provide constructive countermeasures by designing an algorithm to generate an improved \conc layer that thwarts this specific attack without increasing the number of arithmetic constraints compared to the original design.
Finally, we also applied our framework to \tip but found that its MDS matrix can effectively prevent this attack. This is the first time to exploit the weak combination of \bars layer and \conc layer to mount efficient attacks on LUT-based ZK-friendly hash functions. We believe that it sheds new insight into the security of these hash functions.
## 2026/2033
* Title: Efficient Single-Server Online-Offline PIR without Periodic Preprocessing
* Authors: Hoang-Dung Nguyen, Jorge Guajardo, Thang Hoang
* [Permalink](https://eprint.iacr.org/2026/2033)
* [Download](https://eprint.iacr.org/2026/2033.pdf)
### Abstract
Private Information Retrieval (PIR) allows a client to retrieve an entry from a public database without revealing the entry of interest. Standard PIR, however, requires the server to perform expensive computation that is linear in the database size per client query. To reduce this online cost, Online-Offline PIR (OO-PIR) was proposed, allowing the client to precompute a query-independent hint table that enables sublinear online
query complexity. Unfortunately, existing OO-PIR protocols require either a non-colluding two-server setting or a single-server setting with expensive periodic preprocessing, where the entire hint table must be rebuilt after a limited number of online queries. This results in extremely high bandwidth or computation overhead.
We present ESCAPE, a novel OO-PIR protocol for the single-server setting that completely eliminates the expensive periodic preprocessing, supporting unlimited online queries in sublinear time with low constant response bandwidth. The core innovation in ESCAPE lies in reconciling a new hint sampling strategy with Linearly Homomorphic Encryption (LHE) to conceal the correlation between any hint and any online query, while allowing the consumed hint to be refreshed on the fly in sublinear time. We design a random sampling structure that aligns with deterministic, precomputable linear functions, enabling the protocol to exploit the streamlined preprocessing of efficient LHE instantiations. We fully implement ESCAPE, evaluate it on large-scale databases, and release our implementation as open source. Experimental results show that ESCAPE radically reduces end-to-end latency to under a second for 1-8 TiB database sizes and 8-16 KiB entries, achieving up to two orders of magnitude lower bandwidth and up to three orders of magnitude lower computation than state-of-the-art PIR.
## 2026/2045
* Title: Practical Key Recovery Attacks on Full DuX and Reduced-Round YuX
* Authors: Xingwei Ren, Bo Xu, Zhenyu Xiong, Yongqiang Li, Mingsheng Wang
* [Permalink](https://eprint.iacr.org/2026/2045)
* [Download](https://eprint.iacr.org/2026/2045.pdf)
### Abstract
DuX and YuX are recent block cipher families designed for efficient evaluation under fully homomorphic encryption. Both keep sixteen words of a large finite field in four blocks, with a low-degree block-wise S-box and a circulant linear layer. We show that, in the chosen-ciphertext model, the algebraic degree of their decryption functions grows far more slowly than the designers' encryption-side evaluation suggests, and we turn this into practical key-recovery attacks.
Our starting point is a sufficient criterion for zero sums. It treats affine subspaces in characteristic 2, full prime fields, and multiplicative cosets uniformly, then over prime fields it is tight on every cell we could compute exactly. To turn it into attacks, we add full-block structures, cheap-coordinate elimination, and weighted moments. The first makes the
initial S-box layer free, the second extracts equations from states that are only partially balanced, and the third yields thousands of equations from a single structure.
We recover the master key of the full twelve-round DuX over $\mathbb{F}_{65537}$ from $2^{32}$ chosen ciphertexts in 45 core-hours, executed on random keys. For YuX, we recover the key of eleven of the fourteen rounds of both YupX-65537 and Yu2X-16 from $2^{32}$ chosen ciphertexts, with both attacks experimentally executed, reducing the data complexity for Yu2X-16 from the previously reported $2^{96}$ to $2^{32}$. Our distinguishers on DuX coincide with those of independent concurrent work by Liu and Sun (eprint 2026/1907). Furthermore, our key recovery attack lowers the data complexity of their full-round attack from $2^{67.58}$ to $2^{32}$.
## 2026/2048
* Title: Linear list size bounds for Reed-Solomon beyond the Johnson radius
* Authors: Ariel Gabizon
* [Permalink](https://eprint.iacr.org/2026/2048)
* [Download](https://eprint.iacr.org/2026/2048.pdf)
### Abstract
Based on techniques discovered in the better.codes autoresearch project, we show that Reed-Solomon codes of rate $\rho$ and block length $n$ over a field of sufficiently large characteristic, have $C\cdot n$ list size bound when requiring fractional agreement $\alpha$ with a received word; where $C,\alpha$ are constants depending only on $\rho$ and $\alpha<\sqrt{\rho}$. This complements the recent breakthrough results [BCPZZ26,Jeronimo26] achieving $n^c$ list size bounds with agreement $\rho+\epsilon$ for any constant $\epsilon>0$ with an unspecified constant exponent $c$.
## 2026/2055
* Title: A Locality-Sensitive Hashing Framework for Reducing Bounded Distance Decoding to EDCP
* Authors: Ryann Cartor, Felice Manganiello, William Youmans
* [Permalink](https://eprint.iacr.org/2026/2055)
* [Download](https://eprint.iacr.org/2026/2055.pdf)
### Abstract
Bounded Distance Decoding (BDD) is a fundamental primitive in both code- and lattice-based post-quantum cryptography. Prior work of Regev (FOCS~2002) and Brakerski, Kirshanova, Stehl\'e and Wen (PKC~2018) connected lattice BDD and Learning With Errors (LWE) to the Extrapolated Dihedral Coset Problem (EDCP), but these reductions rely heavily on geometric structure and do not naturally extend to coding-theoretic metrics. We present a general quantum reduction from BDD over finite Abelian groups equipped with translation-invariant metrics to EDCP, requiring only the existence of an appropriate locality-sensitive hash family. Instantiating this framework yields new reductions for decoding in the Hamming metric, rank metric, and the $p$-Lee metric (which coincides with the standard Lee metric when $p = 1$). For the Hamming and rank metrics, our reductions only yield a non-negligible number of EDCP states in parameter regimes where known decoding algorithms are already efficient. However, we recover the LWE-to-EDCP reduction within our framework by combining known equivalences between lattice CVP/BDD in the $\ell_p$ norm and $p$-Lee metric decoding.
## 2026/2056
* Title: Reed-Solomon Codes Beyond Johnson: Efficient Decoding and Smaller Cryptographic Proofs
* Authors: Quang Dao, Scott Duke Kominers, Justin Thaler
* [Permalink](https://eprint.iacr.org/2026/2056)
* [Download](https://eprint.iacr.org/2026/2056.pdf)
### Abstract
List decoding ReedrCoSolomon codes is a central problem in coding theory and, together with mutual correlated agreement (MCA), underpins the soundness of many succinct cryptographic proofs. In this work, we give precise quantitative bounds on ReedrCoSolomon list decoding and MCA up to capacity, provide deterministic decoding algorithms that remain efficient over cryptographically large fields, and specialize our bounds to reduce proof sizes in implemented proof systems. Our bounds apply to arbitrary prescribed evaluation domains; beyond Johnson, they require sufficiently large field characteristic.
Refining the hidden-derivative method of Brakensiek, Chen, Putterman, Zhang, and Zheng, we obtain an explicit agreement threshold $a_1(\rho)$ strictly below the Johnson bound $\sqrt{\rho}$, using only the first derivative, without requiring its evaluations in the received word. At agreement $a_1(\rho)+\eta_1$, where $\eta_1>0$, our sharper interpolation and candidate counts give list size $O_\rho(n/\eta_1^2)$ and MCA error $O_\rho(n^2/(q\eta_1^4))$ for codes of length $n$ over $\mathbb{F}_q$. Higher derivatives give explicit quantitative bounds up to capacity, uniformly over all rates, sharpening prior MCA results in Zheng's unpublished manuscript and Jeronimo's work, concurrent with ours. At fixed rate, for agreement gap $\eta_0>0$ above Johnson, we improve the MCA error bound of Ben-Sasson et al. (BCHKS) from $O_\rho(n/(q\eta_0^5))$ to $O_\rho(n/(q\eta_0^3))$, in every characteristic.
Our decoders use agreement constraints to recover close messages without enumerating initial field values. With fast explicit field arithmetic, at fixed rate and a fixed positive agreement margin above the respective threshold, deterministic decoding takes $\widetilde O(n\log q)$ bit operations above Johnson in every characteristic and $\widetilde O(n^2\log q)$ above our first-order curve in sufficiently large characteristic. Decoding remains polynomial in $n$ and $\log q$ at every fixed positive gap from capacity, under the same requirement of sufficiently large characteristic.
Our first-derivative bounds give the first proof-size reductions in existing proof-system implementations from provable ReedrCoSolomon proximity-gap bounds beyond the Johnson radius. At unchanged security targets, we save 79.4 KB (11.1%) for ProveKit passport proofs, 13.2 KB (4.63%) for ZisK compressed final proofs, and 59.8 KB (4.85%) for LambdaVM CPU subproofs. We have formally verified the list-decoding and MCA bounds and concrete parameter certificates in ArkLib, a Lean library for verified cryptographic proofs, and proved correctness of a simplified version of our list-decoder.
## 2026/2057
* Title: Low-Space Quantum Discrete Logarithms on Genus-Two Jacobians
* Authors: Yan Huang, Yuling Chen, Fangguo Zhang
* [Permalink](https://eprint.iacr.org/2026/2057)
* [Download](https://eprint.iacr.org/2026/2057.pdf)
### Abstract
Generic divisor-addition formulas use little arithmetic workspace but fail on exceptional inputs. We prove a randomized reduction that makes such formulas usable in quantum phase computation. Over any finite abelian group of odd order, two independent public group seeds make each child pair in a complete balanced addition tree independent and uniform for every fixed input. A bound on the density of exceptional pairs then controls both the total failure probability and the error of the randomized quantum channel.
We apply the reduction to an odd prime-order subgroup of size $r$ in a genus-two Jacobian over $\mathbb F_q$, where $q$ is an odd prime and the model is a monic quintic with zero quartic coefficient. An integer lift of weighted Mumford arithmetic, a phase-only terminal polynomial, and an independent shifted Legendre symbol give useful-sample probability $1-O(L/q)$ on the exact domain $\mathbb Z_r^2$ when $r=\Theta(q^2)$, where $L$ is the number of tree leaves; this bound assumes exact preparation and Fourier readout. Explicit height certificates, streaming CRT reconstruction, and clean modular primitives yield a sampler using $10n+o(n)$ logical qubits, including both scalar registers, for $n=\lceil\log_2q\rceil$. The model permits intermediate measurements, reset, and classical feedforward.
For the Gaudry--Schost instance over $\mathbb F_{2^{127}-1}$, a $16$-bit window gives an analytic allocation of $1{,}923$ qubits, $37.2\%$ below the matched $3{,}063$-qubit Chen-derived allocation. Its capped-run bound is below $2^{60}$ Toffoli gates, with rotation synthesis charged separately. A $32$-bit window reduces the allocation to $1{,}618$ qubits at substantially greater table and gate cost. The construction therefore provides an explicit space--time tradeoff.
## 2026/2058
* Title: Trace-Factored BigSwitch for Matrix-Friendly FHE
* Authors: Dong Jin Park, Hyunseok Jeong, Minwook Jeong, Jaeky Oh, Yongwoo Lee, Young-Sik Kim
* [Permalink](https://eprint.iacr.org/2026/2058)
* [Download](https://eprint.iacr.org/2026/2058.pdf)
### Abstract
Evaluation keys represent a primary memory and initialization bottleneck in matrix-native fully homomorphic encryption (FHE). In the GentryrCoLee (GL) framework, each Trace product yields a four component ciphertext whose BigSwitch procedure requires two extended-ring keys, dominated by a massive product-secret key (sXsY raA sX). We present Trace-Factored BigSwitch (TFB), which structurally eliminates this product-secret evaluation key by exploiting the rank one tensor structure of the Trace-generated key, (1, sX, sY , sXsY ) = (1, sY ) reu (1, sX). By routing the product secret through an sY raA sX switch followed by standard base ring (s^2)X raA sX relinearization, TFB achieves an exact evaluation-key memory saving of (n reA 1)/(2n) (ree 50%) without ever generating or storing evk_XY raAX. To amortize TFBrCOs recurring base-ring relinearization cost in blocked matrix multiplication, we introduce FRee-L (Fused Relinearization with noise reduction). FRee-L accumulates K Trace products componentwise in the four-component domain and invokes BigSwitch only once per output tile, reducing post-processing noise injections from K to one and amortizing the latency overhead as O(1/K). In our OpenFHE-linked prototype (n = 256), TFB reduces the coefficient-domain BigSwitch key footprint from 768.0 to 385.5 MiB (49.80%), peak RSS by 15.31%, and cold key preparation by 51rCo63%. On real GPT-2 attention kernels (K = 4), FRee-L lowers TFBrCOs paired overhead to 5.90%, which further diminishes to 0.1933% (K = 160) and 0.0618% (K = 512) in deep accumulation workloads, confirming that substantial key savings are achieved with negligible workload-level compute penalty.
## 2026/2059
* Title: On Aborts in Differential Privacy
* Authors: Fredrik Meisingseth
* [Permalink](https://eprint.iacr.org/2026/2059)
* [Download](https://eprint.iacr.org/2026/2059.pdf)
### Abstract
There is a growing literature on differential privacy (DP) in multiparty protocols, enabling use in distributed settings and reduced trust assumptions. A largely overlooked aspect of such protocols is the extent to which an adversary can undermine the DP guarantees by making the protocol abort. Another is the DP properties of the honest parties' outputs. We initiate the study of both these issues.
First, we propose an idealized model of aborts, where an aborter is leaked some information about a DP mechanism execution and then chooses whether or not to let an independent malicious analyst learn the mechanism output. We bound the effects of aborts according to what information (the database, randomness, output, or any combination of these) is leaked. These bounds are not only applicable to multiparty DP via general-purpose multiparty computation (MPC) but may also be used in the analysis of other methods to certify DP properties of a protocol.

Second, we apply these bounds to analyze ideal protocol executions in MPC. We show, for the first time, that the ideal execution with fairness gives strictly stronger DP guarantees than that for security-with-abort, for the outputs to the honest parties. Further, solitary-output functionalities satisfy guarantees similar to those of the execution with fairness.
Finally, we analyze multiparty protocols with respect to the way in which they realize the respective ideal functionalities. We show that partially fair and fully fair protocols have very similar DP guarantees. Since partial fairness, as opposed to full fairness, can be achieved in dishonest-majority settings, and in particular the two-party setting, this opens up for enhanced DP guarantees in two-party computation.
## 2026/2060
* Title: DelegProof: A Machine-Checked Security Analysis of EIP-7702 Delegation * Authors: Rong Qian, Yu Cheng, Lingyu Gao, Yuchang Zhang, Zengli Guo
* [Permalink](https://eprint.iacr.org/2026/2060)
* [Download](https://eprint.iacr.org/2026/2060.pdf)
### Abstract
EIP-7702, live on Ethereum since the Pectra upgrade, lets externally owned accounts delegate their execution to arbitrary contract code with a single signature. The consequences are measurable: 63% of observed delegations point to malicious contracts, with $2.36M in confirmed losses, and ecosystem guidance already warns about cross-chain replay and front-run initialization. What is missing is a formal account of the problem: the 7702 delegation lifecycle has no formal treatment, and none of the recommended mitigations has been machine-verified. We present DelegProof, to our knowledge the first symbolic formal analysis of EIP-7702 authorization semantics composed with the ERC-4337 EntryPoint pipeline. Our Tamarin models are calibrated by reproducing four documented attack classes, and yield ten machine-checked attack patternsrCoamong them the silent failure of the advertised temporary-delegation bundle, storage confusion across re-delegation, and an ERC-1271 substitution attack that reaches into the signature checks of relying contractsrCotogether with the security invariants that do hold. Formalizing the recommended mitigations shows that banning chainId-0 authorizations eliminates cross-chain replay, that an account-bound initialization gate restores init authorization while an unbound gate is provably still bypassable, and that namespaced storage slots make the storage-confusion class structurally inexpressible. All models and proofs are available at https://anonymous.4open.science/r/delegproof-artifact-F7FE/.
## 2026/2061
* Title: Normal Alignment: Improved Cryptanalytic Sign Recovery on Hard-Label Networks
* Authors: Shi Tang, Zirui Chen, Yongjia Su, Zhengchao Gao, Lingyue Qin, Xiaoyang Dong
* [Permalink](https://eprint.iacr.org/2026/2061)
* [Download](https://eprint.iacr.org/2026/2061.pdf)
### Abstract
At EUROCRYPT 2025, Carlini {\em et al.} proposed a breakthrough in the cryptanalytic extraction on hardrCalabel (S1) deep neural networks (DNNs), demonstrating polynomial-time signature and sign recovery. However, Carlini {\em et al.}'s signrCarecovery method ({which we call \em Future Toggle}) suffers only a marginal advantage over random guessing, producing highrCaconfidence wrong sign predictions in deeper layers. Such errors trigger expensive exponentialrCatime enumeration.
This work presents {\em Normal Alignment}, a novel statistical signrCarecovery approach for S1 DNNs. Drawing on the expected length difference between projected normals of adjacent decision facets at dual points, our method infers neuron signs via normalrCasignature alignment. It delivers higher voting accuracy and pushes erroneous predictions to lowrCaconfidence ranks, which further enables a more efficient combined method, {\em eSOE + Alignment}, by combining {\em Normal Alignment} with the hardrCalabel {SOE} extension. This combined strategy removes heavy enumeration overhead and realizes exact polynomialrCatime full sign recovery.
Experiments demonstrate the effectiveness of our method, especially for deep layers. For example, with our method, the signs for CIFAR-10 (architecture 192-64$\times$8-10) and MNIST (architecture 64-96$\times$3-32-10) models can be fully recovered in polynomial time; in contrast, Carlini {\em et al.}'s signrCarecovery method would require exponentialrCatime enumerations involving $2^{52}$ or $2^{82}$ guesses of the signs, respectively.
## 2026/2062
* Title: Hamming Ideals and Grobner Bases for ISD-like Syndrome Decoding
* Authors: Roberto La Scala, Marco Marchesin, Sharwan K. Tiwari
* [Permalink](https://eprint.iacr.org/2026/2062)
* [Download](https://eprint.iacr.org/2026/2062.pdf)
### Abstract
We investigate an algebraic approach to the Syndrome Decoding Problem, based on a reformulation of the Hamming weight constraint and its integration with the Information Set Decoding paradigm. We begin with a systematic analysis of the Hamming variety, deriving its defining equations in terms of elementary symmetric functions. Since these equations may have high degree, we exploit convolution identities for elementary symmetric functions, together with factorizations based on Lucas' identity, to derive an equivalent formulation with auxiliary variables and equations of bounded degree.
Building on this modeling, we generalize the ISD paradigm through an ISD-like decoding strategy, implemented by the GBDecode algorithm, in which only a subset of an information set is fixed. This approach reduces the size of the combinatorial search space at the cost of solving the associated multivariate nonlinear systems. To handle this algebraic component, we employ the MultiSolve algorithm, which replaces a single Grobner basis computation with a collection of computations on simpler systems, obtained by exhaustively assigning a varying number of indeterminates over the finite field. This provides a tunable balance between combinatorial search and algebraic solving.
We evaluate the resulting approach experimentally on instances of the Syndrome Decoding Problem for random binary linear codes, using parameters corresponding to the NIST Security Category 1 parameter set of the Classic McEliece cryptosystem. The experiments assess the feasibility of this combinatorial-algebraic approach and provide insights into the practical behavior of Grobner basis techniques within an ISD-like decoding framework.
## 2026/2063
* Title: Witness Encryption for NP from SNARGs and Groups
* Authors: Zhengzhong Jin
* [Permalink](https://eprint.iacr.org/2026/2063)
* [Download](https://eprint.iacr.org/2026/2063.pdf)
### Abstract
We construct the first witness encryption for NP in the generic group model from succinct non-interactive arguments (SNARGs) for NP. Our construction applies to any SNARG with subexponential soundness and polylogarithmic online verification time after input preprocessing.
Central to our result is the first Karp-Levin reduction from satisfiability for circuits of size $\mathrm{polylog}(\lambda)$ to the minimum-distance problem for linear codes (GapMDP) over a prime field of size $\lambda^{\omega(1)}$, with an approximation factor of $\omega(\log \lambda)$, where $\lambda$ is the security parameter. We obtain this reduction by adapting Hair and Sahai's recent hardness result for GapSVP. Combining our reduction with the witness encryption framework due to Barta, Ishai, Ostrovsky, and Wu [CRYPTO 2020], we obtain the first unconditional extractable witness encryption for circuits of size $\mathrm{polylog}(\lambda)$ in the generic group model. These techniques may be of independent interest.
## 2026/2064
* Title: Area-Time Efficient NTRU Prime Decapsulation: ASIC Evaluation of the First Five-Way Char-3 Multiplier
* Authors: Esra Yeniaras
* [Permalink](https://eprint.iacr.org/2026/2064)
* [Download](https://eprint.iacr.org/2026/2064.pdf)
### Abstract
Streamlined NTRU Prime (sntrup761) is a lattice-based key encapsulation mechanism that, although not a NIST standard, remains widely deployed in critical internet infrastructure. It is the post-quantum key-exchange default in OpenSSH, standardized in RFC 9941, and used well beyond SSH, in Red Hat Enterprise Linux, the liboqs library, PQConnect, and commercial VPNs. Its decapsulation performs a polynomial multiplication over the characteristic-three ring $\mathbb{Z}_3[x]/(x^{p}-x-1)$, so faster methods for this operation directly improve these protocols. We use the Yeniaras-Cenk 5-way multiplier (U1-hybrid), which has the lowest arithmetic complexity among characteristic-three multipliers and gives a 35.52% scalar-C software speedup over Bernstein's three-way method (B1). Yet every prior NTRU Prime hardware design, on FPGA or the single existing ASIC, uses only schoolbook or a single layer of two-way Karatsuba. Three-way splits have been implemented only in software; no 5-way split had been implemented at all before this work. We present the first ASIC evaluation of the Yeniaras-Cenk 5-way multiplier (U1-hybrid), synthesized to the Nangate 45 nm library and compared against the state-of-the-art parallel schoolbook multiplier of Peng et al. On the area-delay product (ADP), the Yeniaras-Cenk 5-way multiplier is 6.8x better than the Peng schoolbook at the multiplier level, and 1.27x better in the sntrup761 decapsulation core, which it completes in 2471 cycles against Peng's 3829, a 35.5% core reduction (12.4% once the fixed hash is included). We also compare against a 3-way Karatsuba baseline (Bernstein's B1), noting that no optimized hardware B1 exists and we do not build one; the comparison there is at the operation-count level only. Synthesizing U1 and B1 as combinational circuits isolates where the five-way advantage comes from. It is not gate count: each $\mathbb{F}_9$ product expands into four $\mathbb{F}_3$ products, so at the same architecture the two use nearly the same area. The gain is in depth, as those four $\mathbb{F}_3$ products run in parallel: 138.27 ps against 57.95 ps for one $\mathbb{F}_3$ multiplier, 2.4x rather than 4x. The advantage is thus a hardware effect: it grows with design parallelism and matches the scalar-C software figure across two parameter sets. All Verilog, testbenches, and synthesis scripts are openly available.
## 2026/2065
* Title: Differentially Oblivious Resizing for Group-By Aggregations
* Authors: James Bell-Clark, Albert Cheu, Adria Gascon, Jonathan Katz, Lukas Gerlach
* [Permalink](https://eprint.iacr.org/2026/2065)
* [Download](https://eprint.iacr.org/2026/2065.pdf)
### Abstract
Systems for private group-by aggregation (e.g., computing histograms, min/max values, or averages) let a confidential virtual machine (CVM) generate statistics from streaming user data. A particular challenge in such systems is ensuring that the CVM's memory-access patterns do not reveal (too much) private information to the untrusted host.
While it is possible to rely on oblivious RAM (ORAM), doing so imposes a significant performance penalty and requires allocating sufficient memory to handle a worst-case data stream.
We introduce ROGA, a scheme for Resizable Oblivious Group-by Aggregation. ROGA uses an extension of oblivious single-access machines and thus improves performance, both asymptotically and concretely, relative to using ORAM. It also incorporates a novel, differentially oblivious resizing mechanism that ensures the allocated memory is within a constant factor of the memory used by a non-oblivious solution. ROGA also parallelizes cleanly across multiple cores for improved performance.
We implement ROGA in Rust and use Binsec/Rel to verify trace noninterference of its compiled fixed-capacity operations, resize estimator, and fixed-work noise sampler, showing that executions with equal public parameters have identical branch-target and memory-address traces for all secret inputs. The only data-dependent branch is the differentially private resize decision. Compared to state-of-the-art oblivious schemes for confidential analytics (which
do not support private resizing), ROGA is up to 50.4$\times$ faster when sharded across 64 logical cores, and private resizing cuts memory by up to 14$\times$ compared to domain-provisioned instances. In a case study, ROGA using 16 cores processes the standard network statistics of a 277-million-packet backbone trace with $5.3\times$ end-to-end overhead over a non-oblivious pipeline while exactly matching the reference output.
## 2026/2066
* Title: Optimizing HAETAE and SMAUG-T on Cortex-M4 for Resource-Constrained IoT Devices
* Authors: JunHyeok Choi, DongHyun Shin, Seog Chung Seo
* [Permalink](https://eprint.iacr.org/2026/2066)
* [Download](https://eprint.iacr.org/2026/2066.pdf)
### Abstract
The practicality of post-quantum cryptography (PQC) on IoT devices depends on both operation cycle counts and communication costs from public values (public keys, ciphertexts, and signatures). The DSA HAETAE and the KEM SMAUG-T, both selected in the KpqC competition, provide smaller public values than ML-DSA and ML-KEM; however, the lack of platform-specific optimization leaves their operation cycle counts high, which can offset this advantage. In this paper, we optimize HAETAE and SMAUG-T on the Cortex-M4, a representative 32-bit embedded MCU, and conduct a multi-faceted evaluation. We fix two bugs in the existing implementation of the HAETAE $\mathcal{N}(\mathbf{s})$ evaluation and propose Autocorrelation-based Spectral-Norm Evaluation (ASNE), which replaces the per-polynomial FFTs with a single autocorrelation FFT. Together with further optimizations, we achieve improvements of up to 309.1%, 4.8%, and 6.0% in KeyGen, Sign, and Verify, respectively, over the state-of-the-art implementation. For SMAUG-T, we analyze the coefficient ranges of the polynomial multiplication operands to select an auxiliary NTT-friendly modulus $q'$, and count the number of operations per layer to apply the optimal NTT. As a result, we achieve improvements of up to 266.7%, 348.9%, and 341.0% in KeyGen, Encaps, and Decaps, respectively, over the reference C implementation. Furthermore, we apply static analysis and dudect measurements to the optimized kernels and observe no evidence of timing leakage. Using models anchored to prior IoT protocol measurements, we estimate the transmission-unit count, end-to-end latency, and energy, showing that HAETAE and SMAUG-T can be competitive PQC alternatives in constrained wireless environments.
## 2026/2067
* Title: Maltese: Succinct Polynomial Commitment from Lattices
* Authors: Katarina Cheng, Wilson Nguyen, Nirvan Tyagi
* [Permalink](https://eprint.iacr.org/2026/2067)
* [Download](https://eprint.iacr.org/2026/2067.pdf)
### Abstract
Succinct polynomial commitment schemes are a key building block in succinct non-interactive arguments of knowledge (SNARKs). Existing succinct lattice-based polynomial commitment schemes take a "split-and-fold" strategy making use of homomorphism to compress proof size to $O(\text{polylog} N)$ for polynomials of size $N$. Prior works either (1) incur superlogarithmic verifier work (e.g., $O(\sqrt{N})$), (2) incur concretely large proof sizes and verifier work (e.g., hundreds of MB), or (3) rely on non-standard lattice assumptions. We proprose a new succinct polynomial commitment scheme Maltese that operates over a Merkle tree commitment of the lattice-based Ajtai hash function. We employ a folding strategy and propose new sum-check-based reductions for managing norm growth of the tree commitment over folding rounds. Maltese is secure under the standard Module-SIS assumption and produces opening proofs of $335$KB for multilinear polynomials of size $N=2^{30}$; proofs are around $300\times$ smaller than prior work with polylogarithmic verifier complexity but between $2$-$6\times$ larger than prior work with larger verifier complexity or stronger structured assumptions.
## 2026/2068
* Title: Distributed SNARGs Resilient to Corrupt Verifiers
* Authors: Elette Boyle, Lalita Devadas
* [Permalink](https://eprint.iacr.org/2026/2068)
* [Download](https://eprint.iacr.org/2026/2068.pdf)
### Abstract
Distributed certification is a method for monitoring the correctness of a distributed system. The model consists of a centralized prover in addition to multiple verifiers lying on the nodes of a communication network, where the goal is to assert that the network satisfies a desired property. In doing so, the prover generates certificates for each verifier; the verifiers can then communicate in a small number of rounds, and accordingly accept or reject. The proverrCOs assertion is accepted if all verifiers accept.
A significant body of work has gone toward developing and understanding limitations of distributed certification schemes, predominantly in the setting of information-theoretic soundness, and recently with computational soundness, achieving a form of distributed (locally verifiable) Succinct Non-interactive Arguments (SNARGs) (Aldema Tshuva et al, TCC 2023). As is standard in the model, soundness holds in existing constructions assuming that all verifiers in the network are honest.
In this work, we introduce and explore the notion of robust distributed SNARGs (rdSNARGs) which retain (computational) soundness guarantees even when the cheating prover can collude with some nodes in the network. Addressing cheating verifiers presents several challenges. We construct rdSNARGs for any distributed language in P with succinct certificate size and communication from extended versions of RAM SNARGs (Kalai et al, STOC 2023), where the level of succinctness scales with the threshold of corrupt nodes. Complementarily, we demonstrate a lower bound showing that an rdSNARG with significantly smaller certificates and communication implies a SNARG for NP.
## 2026/2069
* Title: Default Correct: A New Fault Surface in the Comparison Booleanisation of Kyber-KEM
* Authors: Anirudh Jaiswal, Abhilash Kumar Das, Dhiman Saha
* [Permalink](https://eprint.iacr.org/2026/2069)
* [Download](https://eprint.iacr.org/2026/2069.pdf)
### Abstract
The FujisakirCoOkamoto (FO) transform protects Kyber-KEM against chosen- ciphertext attacks and is based on a ciphertext comparison step. This comparison is usually treated as a single atomic check. However, in every mainstream implementation it is a short pipeline of independently faultable stages. It comprises a byte-wise mismatch accumulation, a tworCOs-complement Booleanisation, and a conditional move (cmov). In this work, we expose a previously unexamined stage of this pipeline, the Booleanisation, as a new attack surface. Our research reveals that a
single sub-instruction clock glitch forces the mismatch flag fail to 0, so decapsulation accepts any ciphertext. Every prior fault attack on this comparison targets the equality test or the conditional move. So does the only countermeasure proposed for it: the default-fail cmov ordering of Xagawa et al. Our surface sits upstream of that move, so it escapes both. We instantiate this Default Correct fault on an ARM Cortex-M4 (ChipWhisperer-Lite) and demonstrate it across the pqm4, PQClean, and
reference implementations of Kyber-512/768/1024 at all optimisation levels (-O0rCoO3). Crucially, every one of these implementations already carries XagawarCOs default-fail ordering, yet the fault succeeds on all of them: the surface is therefore not merely new but structurally beyond the reach of the state-of-the-art defence for this comparison. The Booleanisation is thus a single point of failure common to all three code bases. Leveraging the accept-everything behaviour, we use the standard plaintext-checking
oracle and recover the full secret key of Kyber-512, Kyber-768, and Kyber-1024 in a single on-device run each. Finally, we analyse why defences that protect only the cmov or a single fail flag cannot address a fault that targets an upstream stage of the comparison, and we propose a producer-side countermeasure: an integrity-checked Booleanisation that computes the same flag while folding in an execution counter, so that any partial instruction skip is detected, at negligible overhead.
## 2026/2070
* Title: Polynomial Time Algorithms for the Kadison-Singer Problem
* Authors: Zhao Song, Song Yue
* [Permalink](https://eprint.iacr.org/2026/2070)
* [Download](https://eprint.iacr.org/2026/2070.pdf)
### Abstract
Marcus, Spielman, and Srivastava [MSS15] established the existence of Kadison--Singer partitions. We provide polynomial-time algorithms for the Kadison--Singer problem. For Hermitian matrices $A_1,\ldots,A_m\in\mathbb C^{n\times n}$ of rank at most one, we give two algorithms that find signs $\sigma\in\{\pm1\}^m$ satisfying $\|\sum_i \sigma_iA_i\|\le C\|\sum_i A_i^2\|^{1/2}$. The deterministic algorithm achieves $C=3.3443$ using $\widetilde O(mn^2+n^{56})$ arithmetic operations. The randomized algorithm achieves $C=4.8628$ using $\widetilde O(mn^2+n^{5.88})$ arithmetic operations in expectation. For vectors satisfying $\sum_i a_ia_i^*=I$ and $\|a_i\|^2\le\alpha$, the algorithms yield partitions $[m]=I_1\cup I_2$ satisfying $\|\sum_{i\in I_j}a_ia_i^*-I/2\|\le (C/2)\sqrt\alpha$ for $j=1,2$.
## 2026/2071
* Title: Soft Analytical Side-Channel Attacks on SHA-2 and HMAC
* Authors: Maxime Lecomte, Julien Maillard, Antoine Moran, Gu|-na|2l Renault, Benjamin Smith
* [Permalink](https://eprint.iacr.org/2026/2071)
* [Download](https://eprint.iacr.org/2026/2071.pdf)
### Abstract
We investigate the use of bit-level Soft Analytical Side-Channel Attacks (SASCA) to recover secret inputs of the SHA-256 hash function, and secret keys of HMAC-SHA-256, using Sentential Decision Diagrams to overcome the computational challenge posed to classical Belief Propagation by multiple-word modular addition.
Our attack on HMAC requires no control nor knowledge of the input, and exploits its double manipulation of the key to improve key-recovery performance. We make comprehensive simulations to evaluate the attackerrCOs recovery capacity for both SHA-256 and HMAC-SHA-256. Finally, we study the profiling capabilities of load instructions in a multiposition EM probe setup on a STM32F303RET6 microcontroller, and use these results to evaluate the capability of our attack against software implementations of HMAC-SHA-256 in a realistic scenario.
## 2026/2072
* Title: Sunshine Systems: Enabling Privacy-Preserving Compliance with Freedom of Information Laws
* Authors: Aarushi Goel, Gabriel Kaptchuk, Yuange Li
* [Permalink](https://eprint.iacr.org/2026/2072)
* [Download](https://eprint.iacr.org/2026/2072.pdf)
### Abstract
Freedom of information laws (informally known as Sunshine Laws), such as the US Federal Freedom of Information Act, provide legal pathways for members of the public to compel governments to produce internal documentation. These laws have become a powerful tool for government accountability, allowing journalists and activists to uncover malfeasance and advocate for change. However, because compliance with these laws requires government actors---the same entities who may be accused of malfeasance---to produce documentation, there is a risk that evidence of malfeasance may be suppressed rather than produced in response to a query.
In this work, we introduce a cryptographic framework called Sunshine Systems, designed to constrain government actors' ability to circumvent freedom of information laws. At a high level, Sunshine Systems enable agencies to prove, in zero knowledge, that they have produced the complete and correct set of documents responsive to a given request. We instantiate a Sunshine System that supports keyword queries, building on recent advances in lookup arguments. We implement and evaluate our approach on low-cost hardware, demonstrating its practicality even for small government agencies.
## 2026/2073
* Title: Revisiting ML Training under Fully Homomorphic Encryption: Convergence Guarantees, Differential Privacy, and Efficient Algorithms
* Authors: Yvonne Zhou, Mingyu Liang, Ivan Brugere, Danial Dervovic, Yue Guo, Antigoni Polychroniadou, Min Wu, Dana Dachman-Soled
* [Permalink](https://eprint.iacr.org/2026/2073)
* [Download](https://eprint.iacr.org/2026/2073.pdf)
### Abstract
We present the first theoretical convergence analysis of machine learning training under fully homomorphic encryption (FHE), combined with a differentially private (DP) training algorithm tailored to encrypted computation. Our approach improves computational efficiency over standard differentially private gradient descent (DP-GD) while achieving comparable utility. In particular, we prove convergence of approximate gradient descent using polynomial approximations of activation and loss functions, which are required for FHE compatibility. To preserve privacy in downstream tasks, we integrate differential privacy without relying on costly per-sample gradient clipping, enabling scalable encrypted learning. We also provide data-independent hyperparameter selection and theoretically grounded strategies for polynomial approximation which can be of independent interest. Together, these contributions advance the feasibility of efficient, private, and secure machine learning on sensitive data.
## 2026/2074
* Title: Revisiting Malicious Private Aggregation: Formalization, Weaknesses, and Enhancements
* Authors: Ananya Appan, Pranav Shriram Arunachalaramanan, David Heath, Ling Ren
* [Permalink](https://eprint.iacr.org/2026/2074)
* [Download](https://eprint.iacr.org/2026/2074.pdf)
### Abstract
Private aggregation schemes enable aggregation of sensitive data across clients without leaking any individual client's input. Their applications include privacy-preserving federated learning, private heavy hitters, and anonymous systems.
Many private aggregation schemes assume two non-colluding servers and aim to guarantee privacy even when one server is malicious, i.e., the malicious server learns an aggregation result that includes all honest client inputs. However, many private aggregation schemes in the literature fail to achieve privacy, which we believe is in large part due to a lack of formalism for the nuanced variations of privacy guarantees.
In this work, we present ideal functionalities for several variants of private aggregation. We also formalize a common paradigm underlying most prior private aggregation schemes. The formal treatment helps us identify security flaws or underspecifications in existing private aggregation schemes. We then present modular modifications or fill in critical details to help prior schemes in the share-aggregate paradigm securely realize the private aggregation functionalities we formally define, including in settings where clients may have unreliable networks.
## 2026/2075
* Title: Bounding the Excess Risk for Linear Models Trained on Marginal-Preserving, Differentially-Private, Synthetic Data
* Authors: Yvonne Zhou, Mingyu Liang, Ivan Brugere, Danial Dervovic, Antigoni Polychroniadou, Min Wu, Dana Dachman-Soled
* [Permalink](https://eprint.iacr.org/2026/2075)
* [Download](https://eprint.iacr.org/2026/2075.pdf)
### Abstract
The growing use of machine learning (ML) has raised concerns that an ML model may reveal private information about an individual who has contributed to the training dataset. To prevent leakage of sensitive data, we consider using differentially-private (DP), synthetic training data instead of real training data to train an ML model. A key desirable property of synthetic data is its ability to preserve the low-order marginals of the original distribution. Our main contribution comprises novel upper and lower bounds on the excess empirical risk of linear models trained on such synthetic data, for continuous and Lipschitz loss functions. We perform extensive experimentation alongside our theoretical results
## 2026/2076
* Title: Symmetry-Graded Digit Extraction Framework for Faster BGV Bootstrapping
* Authors: Zhenyu Xiong, Mingsheng Wang, Zhedong Wang, Han Wang
* [Permalink](https://eprint.iacr.org/2026/2076)
* [Download](https://eprint.iacr.org/2026/2076.pdf)
### Abstract
Bootstrapping is the bottleneck of BGV/BFV homomorphic encryption, and for large plaintext primes $p$ its cost is dominated by digit extraction. Recently, this stage has been accelerated along two separate routes. The first lowers the degree of the digit-extraction polynomial: the bounded-support construction of Ma et al. (Eurocrypt'24) confines its support, and the order-four filter of Xiong et al. (to appear in Asiacrypt'26) removes three quarters of its monomials. The second lowers the depth of its evaluation: the Galois norm map of Okada et al. (Asiacrypt'23) and Zhao et al. (Crypto'26) evaluates a degree-$d$ factor in logarithmic depth. However, how the two routes relate and whether they compose has remained open.
We propose a symmetry-graded framework that views the two evaluation routes as commuting group actions on the digit-extraction polynomial. Under this unified perspective, the existing evaluators correspond to different specializations of $\mathrm{cost}(D;r,d)$. For lower degree, we identify a novel rank-two lattice structure underlying digit extraction. The crystallographic restriction limits the filter order to $r\in\{1,2,3,4,6\}$. In particular, the methods of Ma et al. and Xiong et al. correspond to $r=2$ and $r=4$, respectively. Moreover, our framework derives a sparser order-six digit-extraction polynomial, enabling order-six symmetry for Mersenne primes. For lower evaluation cost, we construct a composed evaluator that first folds $P_A$ using the scalar filter and then evaluates the folded polynomial via the slot ring's Galois norm map. Since the rotation and Frobenius actions commute, the two optimizations can be combined within the same framework. Consequently, for any $(p,m)$ we select the optimal $(r,d)$ and evaluate digit extraction in $2\sqrt{D/(rd)}+O(\log D)$ non-scalar multiplications.
On 13 general cyclotomic rings at $\geq 80$-bit verified security, our single-threaded HElib implementation improves upon the state-of-the-art evaluator of Ma et al., accelerating digit extraction by $2.4$rCo$4.9\times$ and thin bootstrapping by $1.3$rCo$2.8\times$, while modifying only the digit-extraction stage. In particular, on Ma et al.'s set IV with the Mersenne prime $p=8191$ and set V with $p=65537$, digit extraction is accelerated by $3.6\times$ and $3.8\times$, respectively, reducing the total bootstrapping time from 180.4 s to 85.5 s and from 217.6 s to 103.1 s. The implementation is publicly available, and the core analysis is machine-checked in Lean 4.
## 2026/2077
* Title: Practical Group Signatures from Tag-Based NTRU Sampler
* Authors: Corentin Jeudy
* [Permalink](https://eprint.iacr.org/2026/2077)
* [Download](https://eprint.iacr.org/2026/2077.pdf)
### Abstract
The post-quantum migration for key agreements and signatures being well underway, the focus naturally shifts to other properties and primitives that still lack efficient solutions. One such area is that of privacy-enhanced primitives, with a growing number of post-quantum constructions. Among the most fundamental are group signatures, which represent an important milestone of anonymity and accountability towards more involved designs. However, despite recent progress, most compact lattice constructions are either computationally intensive or suffer large key materials, or both.
In this paper, we introduce a new lattice group signature scheme that reaches compact signatures and keys, while being runtime-efficient in all its procedures. Our key element is a new tag-based gadget sampler that properly interfaces with NTRU, then benefiting from the desirable properties of such trapdoor frameworks for advanced constructions while leveraging the compactness of NTRU. Although applied to group signatures, our sampler may be of independent interest and used for more expressive privacy-driven primitives like anonymous credentials. We also introduce two assumptions, which can be seen as hybrid versions of NTRU and ISIS, that independently underly the security of our group signature. Despite their similarities with the recently introduced NTRU-ISIS$_f$ assumption, they appear strictly harder and even admit reductions from R-ISIS in some parameter settings.
## 2026/2078
* Title: Radical Ring-LWR: Efficient Key Encapsulation and Signatures from Structured Rounding
* Authors: Joost Renes, Joppe W. Bos, Haochen Huang, Selim Kirbiyik, Alberto Ovena, Sujoy Sinha Roy, Frederik Vercauteren, Peng Wang, Fangyu Zheng, Chenxin Zhong
* [Permalink](https://eprint.iacr.org/2026/2078)
* [Download](https://eprint.iacr.org/2026/2078.pdf)
### Abstract
State-of-the-art lattice-based cryptography requires a power-of-two cyclotomic field that limits the attainable security levels, or a module structure for which the cost grows quadratically in the module rank. Radical rings were recently proposed as a solution in the context of Learning With Errors (LWE) based Key Encapsulation Mechanisms (KEMs) with heuristic hardness arguments for the Ring-LWE security and failure probability. We develop the Learning With Rounding counterpart, Radical Ring-LWR (RR-LWR). We give a proved closed-form bound on the distortion incurred from the error sampling independent of the radical ring parameters: this places RR-LWR inside the regime identified by Peikert as safe for instantiating Ring-LWE/LWR. We instantiate two schemes: Mithril, an IND-CCA KEM, and Octarine, an EF-CMA signature scheme. They are built on a single radical-ring arithmetic foundation based on powers of two (favorable for sampling, rounding and masking) and we provide security reductions in the QROM to RR-LWR and SelfTarget-RR-SIS, a radical-ring variant of SIS. We show that the KEM failure probability estimators used for power-of-two cyclotomics are insufficient and provide an exact solution tailored to the RR-LWR setting. Finally, we instantiate Mithril and Octarine with concrete parameters and benchmark optimized AVX2 and Arm Cortex-M4 implementations, showing that both are competitive with (and in some cases significantly faster than) the MLKEM and MLDSA standards.
## 2026/2079
* Title: Period-Aligned Secure Cosine Evaluation Based on Two-Party Computation * Authors: Qingyu Mo
* [Permalink](https://eprint.iacr.org/2026/2079)
* [Download](https://eprint.iacr.org/2026/2079.pdf)
### Abstract
The cosine function is widely used in machine-learning applications,
but evaluating it on secret-shared data is difficult. Conventional
approaches use polynomial approximations or lookup tables, whose costs
grow substantially over large input domains. More recent protocols first
reduce the private input modulo the cosine period, but securely performing
this modular reduction also incurs significant cost. We present a period-aligned two-party cosine protocol. Based on the cosine addition rule, it rescales each share so that a wrap of the input modulus corresponds to
a full $2\pi$ period and therefore does not change the recombined cosine.
Each party evaluates sine and cosine locally on its share, while the
secure computation uses only two cross-party products and one fixed-point output conversion. We evaluate the protocol directly on synthetic inputs
and within private RFF-based RBF-SVM prediction. Comparisons with the protocol of Xing et al. (NDSS 2025) and Guo et al. (USENIX Security 2026) demonstrate better efficiency of our proposed protocol.
## 2026/2080
* Title: Lightweight Cryptography for Secure UAV Data Integrity Using Ascon-XOF128 and SHAKE128
* Authors: Mehul Kumar Das, Varun Shukla, Prabhavi Tripathi, Vivek Shukla, Divya Mishra, Atul
* [Permalink](https://eprint.iacr.org/2026/2080)
* [Download](https://eprint.iacr.org/2026/2080.pdf)
### Abstract
The increasing deployment of unmanned aerial vehicles (UAVs) in communication, surveillance, and other mission-critical applications has created a growing requirement for efficient mechanisms to preserve the integrity of exchanged data. UAV platforms may operate under computational, memory, energy, and communication constraints, making lightweight cryptographic techniques an important consideration for secure data processing. This paper investigates the applicability of lightweight cryptography for UAV data integrity using two extendable-output functions (XOFs), Ascon-XOF128 and SHAKE128. A mathematical framework is developed to represent UAV messages, cryptographic processing, integrity verification, and relevant security and performance metrics. The two XOF constructions are analyzed with respect to their internal structures, sponge-based processing, security properties, computational characteristics, and suitability for resource-constrained UAV communication. A comparative evaluation framework is established using message-size and output-length variations, with performance and integrity-related measures including execution time, throughput, computational cost, memory usage, communication overhead, and Hamming-distance-based analysis. The study aims to provide an evidence-based comparison of Ascon-XOF128 and SHAKE128 for UAV data-integrity workloads and to identify the practical trade-offs between lightweight resource requirements and cryptographic integrity performance.
--- Synchronet 3.22a-Linux NewsLink 1.2