From Newsgroup: sci.crypt

## In this issue
1. [2026/230] Rule Variant Restrictions for the Tamarin Prover
2. [2026/1054] Improved Complexity Estimates for Underdetermined ...
3. [2026/1565] How to Back Up High-Value Secret Keys
4. [2026/1645] Track me if you can: Ephemeral coin tracing
5. [2026/1775] A Note on the Security Proof of SQIsign
6. [2026/1920] Compact Lattice Anonymous Credentials from Tighter ...
7. [2026/1986] Two-Anchor Holdout/Hermite: Solving the TII-254 ...
8. [2026/2092] Indifferentiability of the Sum of Two Permutations: ...
9. [2026/2097] End-to-End Hard-Label Cryptanalytic Model ...
10. [2026/2141] BitZ: proofs and commitments in arbitrary rings ...
11. [2026/2147] ReedWeave: Faster Reed-Solomon Polynomial ...
12. [2026/2157] Jolt-QED: Formally Verifying Bytecode Expansions In ...
13. [2026/2160] Accordion: Efficient Batch Proving via Algebraic ...
14. [2026/2178] Breaking the Spell: Cryptanalysis of VDOO
15. [2026/2179] Capacity-Approaching Pseudorandom Code for ...
16. [2026/2180] Gaussian Kernel Lattices and Smoothing Bounds from ...
17. [2026/2181] Attacking UOV-based Signatures with Schur--Macaulay ...
18. [2026/2182] Lexicure: Efficient, Encrypted Lexical Search
19. [2026/2183] Vespa: Efficient Secure Aggregation with Integrity ...
20. [2026/2184] Static Group Signature with Post-Compromise ...
21. [2026/2185] Instantiating Microcrypt: Obstacles and ...
22. [2026/2186] Provable FFT-Accelerated Dual Attack on LWE Using ...
23. [2026/2187] Rethinking Zero-Knowledge TLS: Proof of Protocol ...
24. [2026/2188] SPRUCE: Scalable Multiparty Private Set Union in ...
25. [2026/2189] SafeCast: End-to-End Security for Ultra-High- ...
26. [2026/2190] Stay in Your Lane: Fast Arithmetic over Large ...
27. [2026/2191] Building Quantum Circuits with Qarton
28. [2026/2192] Distribution-Aware Encryption with Optimal Recovery ...
29. [2026/2193] Square-Root Log-Rank Standard Deviations for the ...
30. [2026/2194] A Black-Box Impossibility Result for Threshold ...
31. [2026/2195] Multi-Key FHE Almost as Fast as Single-Key FHE
32. [2026/2196] Revisiting Fuzzy Password-Authenticated Key ...
33. [2026/2197] MultLA: A Framework of Fast Correlation Attack ...
34. [2026/2198] Lifting Symmetries for Dimension Reduction in ...
35. [2026/2199] PulpoPay for Auditable Privacy CBDCs: Introducing ...
36. [2026/2200] On the Power of Slicing and Dicing: Linear Garbling ...
37. [2026/2201] Dance with Noise: Safely Trade Minor Decryption ...
38. [2026/2202] Fully Anonymous Perfect Threshold Secret Sharing: ...
39. [2026/2203] On FROST and Unconditional LDVR Security
40. [2026/2204] Provenance Proofs: Linkable Zero-Knowledge ...
41. [2026/2205] DKG Is All You Need
42. [2026/2206] GovBind: From Authenticated Fetch to Zero-Knowledge ...
43. [2026/2207] Two Laws of Public-Key Cryptography
44. [2026/2208] A Note on CDS for Random Functions
45. [2026/2209] The Cost of Rewinding for Succinct Arguments: ...
46. [2026/2210] Skyhook: Trustless Cross-Chain Value Transfer with ...
47. [2026/2211] Structural Cryptanalysis of Polar-KEM: Direct ...
48. [2026/2212] Hidden-Bits Generators with Succinct CRS and Openings
49. [2026/2213] Practical Attacks Against EALPN Using Belief ...
50. [2026/2214] Communication Preserving SFE from Obfuscation
51. [2026/2215] Quantum security analysis of unrestricted isogeny- ...
52. [2026/2216] On the Multi-User Security of CSI-FiSh with Tight ...
53. [2026/2217] Interactive Proofs of Proximity for Model Evaluation
54. [2026/2218] Codetta: High-Capacity, Keyless, and Undetectable ...
55. [2026/2219] Incrementally Verifiable Computation without Extraction
56. [2026/2220] Threshold Key Encapsulation Mechanisms via MPC: ML- ...
57. [2026/2221] Dimension-4 SQIsign at Round-3 Parameters: Sizes ...
58. [2026/2222] SoK: The Landscape of Post-Quantum Multi-Party ...
59. [2026/2223] Linear Key Recovery in the BAG-Loong Reference ...
60. [2026/2224] The Tower of Babel: Large Language Models for Side- ...
61. [2026/2225] Breaking the G\'omez-Torrecillas--Lobillo--Navarro ...
62. [2026/2226] FALCON++: Shorter Signatures without NTRU Smoothing ...
63. [2026/2227] A Fiat-Shamir Transformation for Private-Coin Protocols
64. [2026/2228] Adelic reduction of module lattices
65. [2026/2229] Local Rewriting under Assumed Erasure
66. [2026/2230] Indistinguishability of Sum of Permutations: A ...
## 2026/230
* Title: Rule Variant Restrictions for the Tamarin Prover
* Authors: Felix Linker
* [Permalink](https://eprint.iacr.org/2026/230)
* [Download](https://eprint.iacr.org/2026/230.pdf)
### Abstract
We introduce an optimization to the Tamarin prover that reduces its search space. The optimization applies to protocol models that use equational theories with cancellative operators, for example, when modelling Diffie-Hellman groups or bilinear pairings. We prove the optimization's soundness and evaluate its performance.
## 2026/1054
* Title: Improved Complexity Estimates for Underdetermined MQ Systems via Generalized Variable Partitioning
* Authors: Hideki Asanuma, Yilong Chen, Hiroki Furue, Kosuke Sakata, Tsuyoshi Takagi
* [Permalink](https://eprint.iacr.org/2026/1054)
* [Download](https://eprint.iacr.org/2026/1054.pdf)
### Abstract
Multivariate quadratic (MQ) signature schemes are an important class of post-quantum digital signatures. These schemes rely on the hardness of solving underdetermined MQ systems, where the number of variables \(n\) exceeds the number of equations \(m\). Therefore, analyzing the efficiency of algorithms for underdetermined MQ systems is essential for evaluating the security of MQ-based signature schemes. Several algorithms have been proposed to solve underdetermined MQ systems efficiently. Among them, Hashimoto's method is one of the best known partition-based direct attacks; it partitions the variables into three groups and reduces the original problem to two smaller MQ subproblems.
In this paper, we propose a generalized partition-based algorithm for solving underdetermined MQ systems. The proposed algorithm extends Hashimoto's method by partitioning the variables into more groups and reducing the original problem to smaller MQ subproblems. We derive its applicability conditions and time complexity, and develop an efficient parameter search strategy to find the best partition parameters without a naive exhaustive search. Finally, we evaluate the proposed algorithm on parameter sets of MAYO, QR-UOV, and SNOVA, and compare the resulting estimates with those of existing algorithms for underdetermined MQ systems. In the classical case, the proposed method improves on Hashimoto's method for some parameter sets; in particular, it reduces the estimate for MAYO1 from \(2^{156}\) to \(2^{145}\). In the quantum case, the proposed method gives estimates smaller than both Just Guess and Hashimoto's method for many parameter sets.
## 2026/1565
* Title: How to Back Up High-Value Secret Keys
* Authors: Sanjam Garg, Noemi Glaeser, Abhishek Jain, Michael Lodder, Hart Montgomery
* [Permalink](https://eprint.iacr.org/2026/1565)
* [Download](https://eprint.iacr.org/2026/1565.pdf)
### Abstract
Consider a cryptocurrency exchange that secures the bulk of its reserves under a small set of keys, each of which is only used to transfer cryptocurrency once a year; or the backup codes for an account login or a password manager, which are again rarely used but provide access to crucial systems or information. Securing such infrequently-used high-value secrets is crucial, but existing solutions, such as threshold wallets and 'cold' (offline) wallets, are unsatisfactory.
In this work, we envision a system that allows users to conveniently back up their rarely-used, high-value keys. This new setting necessitates a novel set of design requirements. Specifically:
- We allow user keys to be threshold secret-shared among a large number of custodians where each custodian wallet comprises of a hot (i.e., online) and a cold (i.e., offline) portion. The cold part of the wallet is not touched during the backup process (thus, it is independent of the number of system users) but must be accessed for recovery.
- We provide a mechanism to continually assure users that their keys are safely stored. This feature is critical because our system is not designed for frequent key use. We also enable proactive key refresh.
- Finally, in our approach, restoring a backed-up key is equivalent to generating a signature. Thus, signatures made by users of this system should look the same as "normal" signatures to avoid exposing holders of high-value keys to targeted attacks.
Based on these requirements, we develop new security definitions and a UC-secure protocol that implements threshold BLS signatures in our new model. Our protocol is practically efficient for the envisioned large numbers of custodians: for a 67-out-of-100 threshold configuration, creating a new backup takes 10s, while recovery takes less than 2ms.
## 2026/1645
* Title: Track me if you can: Ephemeral coin tracing
* Authors: Ignacio Amores-Sesar, Christian Cachin, Rohit Chatterjee, Luiza Soezima, Fran|oois-Xavier Wicht, Michelle Yeo
* [Permalink](https://eprint.iacr.org/2026/1645)
* [Download](https://eprint.iacr.org/2026/1645.pdf)
### Abstract
Privacy-preserving payment systems are well understood, yet concerns about their misuse for financial crime have led to only limited adoption in regulated settings such as central bank digital currencies (CBDCs) and institutional stablecoins. Tracing is one tool for addressing these concerns: acting on external evidence implicating a user, law enforcement follows the suspect's funds through the ledger to uncover laundering routes and accomplices. Existing coin-tracing schemes, however, provide no cryptographic bound on tracing reach: once initiated, a trace may propagate indefinitely through the transaction graph or persist across all future transactions of a targeted user. Keeping surveillance targeted and temporary therefore depends on the restraint of the authority or a committee.
We introduce ephemeral coin tracing (ECT), a primitive that bounds tracing reach by construction. Each account carries an encrypted tag that records which traced identifiers its funds carry while hiding its tracing status from users. When funds move, the sender's tag degrades and merges with the recipient's tag. Each tracing contribution expires independently after a policy-defined number of hops and then becomes unrecoverable even to the tracing authority, without affecting other live contributions in the same tag. Public parameters also bound how many identifiers a tag can distinguish simultaneously. We formalize ECT and give constructions based on exponential ElGamal, Damg|Nrd-Jurik encryption, and Ring-LWE, the last providing post-quantum security.
## 2026/1775
* Title: A Note on the Security Proof of SQIsign
* Authors: Maher Mamah, David Jao
* [Permalink](https://eprint.iacr.org/2026/1775)
* [Download](https://eprint.iacr.org/2026/1775.pdf)
### Abstract
Aardal et al. (CRYPTO 2025) provided the first complete security proof of SQIsign; however, their reduction incurs a square-root loss in the prime characteristic due to the application of a loose bound on the min-entropy. For instance, at NIST security level I, an adversary making $2^{64}$ signing queries renders the security proof vacuous. In this note, we show that the min-entropy of SQIsign is optimal, namely $\mathcal{O}(1/p)$. Although this improvement does not yield full $\lambda$-bit security, we show that it preserves two-thirds of the expected bit-security. We show that this artifact comes from an information-theoretic loss in the zero-knowledge simulation of SQIsign, suggesting a new proof technique is needed to achieve full $\lambda$-bit security at the current parameters.
## 2026/1920
* Title: Compact Lattice Anonymous Credentials from Tighter Approximate Range Proofs
* Authors: Corentin Jeudy, Olivier Sanders
* [Permalink](https://eprint.iacr.org/2026/1920)
* [Download](https://eprint.iacr.org/2026/1920.pdf)
### Abstract
Accommodating cryptographic authenticity with strong user privacy assurances has been the primary motivation for anonymous credentials systems. Their features have recently come into the spotlight with the European Digital Identity (EUDI) wallet initiative, insisting on the need for efficient and private solutions based on well-understood security foundations for high assurances. This coincides with the post-quantum transition, but current quantum-safe solutions based on standard assumptions are still lagging behind the ones on ad-hoc interactive assumptions performance-wise.
In this paper, we present several techniques to improve the efficiency of anonymous credentials from standard lattice assumptions, narrowing the gap with more efficient but also more exotic ones. Alongside other optimizations, our main contributions focus on the zero-knowledge protocol of Lyubashevsky, Nguyen, Plan|oon (Crypto'22), currently the efficiency bottleneck of lattice privacy-oriented constructions, for which we identify several sources of improvements that may be on independent interest.
## 2026/1986
* Title: Two-Anchor Holdout/Hermite: Solving the TII-254 McEliece Key Recovery Challenge
* Authors: Markku-Juhani O. Saarinen
* [Permalink](https://eprint.iacr.org/2026/1986)
* [Download](https://eprint.iacr.org/2026/1986.pdf)
### Abstract
We report on the solution to the TII-254 McEliece key recovery challenge -- currently the hardest solved challenge under the original brute-force metric ($2^{254}$). The parameters of TII-254 are $(m,t,n) = (8,12,223)$, defining a binary $[223,127]$ code specified by a full-rank $(96 \times 223)$ parity-check matrix. We state the method as a thirteen-step process, separating heuristic and non-heuristic choices. At a high level, we computed two complete $121$-dimensional relation kernels conditioned at distinct public coordinates, combined them to isolate a certified $80$-dimensional pair core, removed a $64$-dimensional common nuisance space, and identified the remaining $16$ dimensions as an $\mathbb{F}_{2^8}$ projective-line geometry. This yielded all $87$ visible locators, after which a deterministic completion search recovered the full support and polynomial. The two final Krylov sequences alone used $27.2$ GPU-hours on NVIDIA GH200s, excluding GPU reconstruction and CPU processing. We provide a self-contained artifact with compact recovery inputs and code, an independent key verifier, and Lean proofs of the reusable linear-algebraic steps.
## 2026/2092
* Title: Indifferentiability of the Sum of Two Permutations: Tight 3n/4 Security for the Uniform Simulator and a New Simulator for 4n/5 Security
* Authors: Sunyeop Kim
* [Permalink](https://eprint.iacr.org/2026/2092)
* [Download](https://eprint.iacr.org/2026/2092.pdf)
### Abstract
We study the regular indifferentiability of the sum of two n-bit permutations. Previous work proved 2n/3-bit security and gave a 5n/6-bit attack against the uniform simulator. We prove 3n/4-bit se curity for the simulator and give a matching attack. Our proof bounds the KL divergence between response distributions by tracking the bias in unrevealed construction values through their conditional distribution, which was not analysed in detail in previous work. To exceed this thresh old, we introduce the Gyroscope simulator, which adjusts inverse-query acceptance probabilities to compensate for the bias left by earlier re sponses. The Gyroscope simulator achieves 4n/5-bit security.
## 2026/2097
* Title: End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery
* Authors: Akira Ito, Takayuki Miura, Yosuke Todo
* [Permalink](https://eprint.iacr.org/2026/2097)
* [Download](https://eprint.iacr.org/2026/2097.pdf)
### Abstract
The importance of deep neural networks (DNNs) is widely recognized, and the parameters obtained through training are regarded as valuable assets. Recently, attacks that extract these parameters using only oracle queries to a DNN have been actively studied at IACR conferences. The hard-label setting is the most challenging setting for model extraction, where an adversary can observe only the final output label, such as rCLdogrCY or rCLcat.rCY At Eurocrypt 2025, Carlini et al. proposed polynomial-time hard-label extraction of ReLU-based MLPs. However, one step of this attack process, i.e., sign recovery, requires a large number of queries and substantial computation. Implementing this step in a black-box setting remains difficult. Consequently, a fully black-box end-to-end demonstration on trained deep ReLU MLPs has remained a challenge. In this paper, we propose a new sign-recovery algorithm based on a completely different principle from the existing method. Our method requires no dedicated queries for sign recovery. In our experiments, it achieves higher sign-recovery accuracy than the existing method. Consequently, it enables efficient sign recovery even for trained models. With our sign-recovery algorithm, all steps of hard-label model extraction can be implemented in a black-box setting. By combining these implementations, we demonstrate end-to-end model extraction from models trained on MNIST and Fashion-MNIST, with width 16 and 4 or 6 hidden layers, achieving over 98% label agreement.
## 2026/2141
* Title: BitZ: proofs and commitments in arbitrary rings through binary fields * Authors: Remco Bloemen, Albert Garreta, Marcin Kostrzewa, Shreyas Londhe, John Wu
* [Permalink](https://eprint.iacr.org/2026/2141)
* [Download](https://eprint.iacr.org/2026/2141.pdf)
### Abstract
We introduce BitZ, a hash-based Polynomial Commitment Scheme (PCS) for committing to multilinear polynomials $\mathbf{f}$ with coefficients in an arbitrary finitely generated ring $S$, e.g.\ a finite field $\mathbb{F}$, the integers $\mathbb{Z}$, a cyclotomic ring, etc. Moreover, given another arbitrary ring $R$ and a ring homomorphism $\psi:S\to R$, BitZ then proves evaluation claims over $R$ for the polynomial $\psi(\mathbf{f})$. BitZ's costs depend almost exclusively on the number of bits in the coefficients of $\mathbf{f}$, and not on $S$, $R$ or $\psi$. Moreover, BitZ provides range checks (or more generally, bit-size checks) essentially for free.
BitZ can thus be used as a PCS in essentially any proof system. We do so to build a SNARK, called BitZ-SNARK, for integer polynomial constraints, following the fingerprinting technique of Campanelli and Hall-Andersen, where one commits over $\mathbb{Z}$ and proves the constraints over a random prime field $\mathbb{F}_q$, i.e. BitZ is deployed with $S=\mathbb{Z}$, $R=\mathbb{F}_q$, and $\psi$ reduction modulo $q$. BitZ applies equally to other ring-based proof systems, or field-based ones.
To commit to $\mathbf{f}$, BitZ first decomposes $\mathbf{f}$ into a string of bits, and then commits to it over a binary field $\mathbb{F}_{2^{\nu}}$, in packed form. The scheme then proves the linear claim on $\psi(\mathbf{f})$ over the arbitrary ring $R$, even though it committed to the bits forming $\mathbf{f}$ over a binary field.
We implement BitZ-SNARK and use it to prove, among others, SHA-256 hashing followed by ECDSA signature verification; RSA modular exponentiation and Poseidon hashing; integer multiplication; and SHA-256 hashing followed by multiplication modulo $2^{32}$, consistently obtaining better performance than prior approaches on most tasks. As an example, we achieve a throughput of $5$ million proved 32-bit integer multiplications per second on a MacBook Air M5 24 GB (10 threads, CPU-only) with proof sizes under $150$ kB. We prove a SHA-256 hash of a $2$ kB ($2^5$ compressions) message followed by a P-256 ECDSA signature verification with $50$ ms and $3.3$ ms prover and verifier time, respectively, and with a proof of $76$ kB, single-threaded. With $10$ threads the times are $20$ ms and $3.4$ ms.
## 2026/2147
* Title: ReedWeave: Faster Reed-Solomon Polynomial Commitments from Interleaving and Folding
* Authors: Yuhao Jia, Zhe Li, Chaoping Xing, Yizhou Yao, Chen Yuan, Jielong Zhang
* [Permalink](https://eprint.iacr.org/2026/2147)
* [Download](https://eprint.iacr.org/2026/2147.pdf)
### Abstract
Polynomial commitment schemes (PCSs) allow a prover to commit to a polynomial and later prove its evaluations succinctly. Among hash-based constructions, FRI (Ben-Sasson et al., ICALP 2018) and its follow-up works achieve polylogarithmic proofs by recursively ``folding'' Reed-Solomon (RS) codes. However, their concrete evaluation costs remain relatively high, as the first few folding rounds operate on the largest codewords and dominate the prover work.
We present \emph{ReedWeave}, a Reed-Solomon PCS that successfully incorporates interleaving with folding, achieving the best of the two worlds. ReedWeave decomposes a degree-$d$ polynomial into $m$ smaller components and commits to their RS encodings over a common domain. Under our novel decomposition, a random linear combination of these codewords is exactly an $m$-ary folding. At a high level, ReedWeave starts with an $m$-ary folding, followed by standard binary folding as in FRI. The prover costs are substantially reduced in the sense that at the very beginning it suffices to do interleaved-RS encoding rather than standard RS encoding. That is, we reduce prover costs from $\mathcal{O}(d \log d)$ to $\mathcal{O}(d\log(d/m))$ for constant code rate while maintaining efficient polylogarithmic verification. Moreover, our approach essentially works for arbitrary $m$, relaxing the smoothness requirements of the underlying fields by a multiplicative factor of $m$.
We benchmark our Rust implementation over Goldilocks using
32 threads and targeting 100-bit security. At $d=2^{24}$, $\rho=1/4$, and $m=64$, the DEEP variant commits in $475.0$ ms, opens in $111.6$ ms, verifies in
$2.07$ ms, and produces a $594.7$ KiB proof. Compared with FRI (ICALP 2018), commitment, opening, and verification are $6.9\times$, $51.5\times$, and $4.2\times$ faster, respectively. Against STIR (CRYPTO 2024), the corresponding speedups are $2.9\times$, $68.5\times$, and $2.1\times$. Its proof is only $0.69\times$ the size of FRI's and $2.31\times$ that of STIR's.
## 2026/2157
* Title: Jolt-QED: Formally Verifying Bytecode Expansions In Lean
* Authors: Ari Biswas, Quang Dao, Daniel Ross, Justin Thaler
* [Permalink](https://eprint.iacr.org/2026/2157)
* [Download](https://eprint.iacr.org/2026/2157.pdf)
### Abstract
In this work, we verify, using the Lean 4 proof assistant, that the Jolt zk-VM's expanded programs faithfully emulate a RISC-V CPU. Prior work translated the official Sail specification of RISC-V into Lean. We extend this model to define the Jolt ISA in Lean. We build a generator that runs Jolt's Rust bytecode expander and renders its output as Lean programs. Finally, for 51 out of 58 such programs, we prove these expansions are equivalent to their corresponding RISC-V instructions. This lays the groundwork for proving completeness and soundness of further stages of Jolt's proving pipeline.
## 2026/2160
* Title: Accordion: Efficient Batch Proving via Algebraic Folding
* Authors: David Balb|is, Anca Nitulescu, Maxime Plan|oon
* [Permalink](https://eprint.iacr.org/2026/2160)
* [Download](https://eprint.iacr.org/2026/2160.pdf)
### Abstract
We present $\mathsf{Accordion}$, a new proof system that works in two steps:
- $\textit{Accumulate}$: The first building block is a multi-folding scheme that efficiently accumulates $k$ different instances of a degree-$d$ polynomial relation into a single accumulated instance, without using recursion. Our scheme builds on the Protostar [B|+nz & Chen, ASIACRYPT '23] and Protogalaxy [Eagen & Gabizon, ePrint 2023/1106] line of work, improving further the verifier efficiency.
It supports the same expressive class of relations, arbitrary-degree polynomial constraints, enabling efficient folding for CCS, Plonkish constraints, and even custom gates.
- $\textit{Decide}$: The second block is a SNARK decider for the folding scheme, which efficiently proves the validity of the resulting accumulated instance using off-the-shelf optimized building blocks. We give a concrete instantiation consisting of a Plonk-based proof plus an additional KZG polynomial commitment opening.

This design is especially attractive in batch-aggregation settings where a prover collects many independent witnesses, folds them into a single accumulator, and then runs one succinct decider to certify the entire batch. Our scheme avoids costly recursion overheads.
We implement $\mathsf{Accordion}$ and evaluate it against a highly optimized Plonk proving pipeline ($\texttt{midnight-zk}$). For $k=64$ instances, $\mathsf{Accordion}$ is up to $2.5\times$ faster than computing $k$ Plonk proofs for SHA-256 preimages, with a $3\times$ faster verifier and $4\times$ smaller proofs. Its prover is also an order of magnitude faster than using IVC to aggregate the $k$ proofs.
## 2026/2178
* Title: Breaking the Spell: Cryptanalysis of VDOO
* Authors: Max Cartor, Ryann Cartor, Ansta Rakotondrafara
* [Permalink](https://eprint.iacr.org/2026/2178)
* [Download](https://eprint.iacr.org/2026/2178.pdf)
### Abstract
VDOO is a Rainbow-like multivariate signature scheme with additional ``diagonalrCY structure intended to resist structural attacks. We show that its security is governed primarily by the first two oil layers, while the diagonal structure has negligible impact, and that all proposed parameters fail to meet their claimed NIST security levels. We provide a corrected complexity analysis of the Simple and Rectangular MinRank attacks, introduce a hybrid SimplerCoPadded MinRank attack, and compare their effectiveness. Open-source code is provided for independent validation, clarifying VDOOrCOs true security and informing future Rainbow-type post-quantum designs.
## 2026/2179
* Title: Capacity-Approaching Pseudorandom Code for Stochastic Edit Channels
* Authors: Leshui Wang, Kenji Yasunaga
* [Permalink](https://eprint.iacr.org/2026/2179)
* [Download](https://eprint.iacr.org/2026/2179.pdf)
### Abstract
Pseudorandom codes (PRCs) are error-correcting codes whose codewords are computationally indistinguishable from uniformly random strings to any efficient adversary. Most prior PRC work focuses on Hamming error channels; nevertheless, the few proposed constructions on edit channels are not optimized for a stochastic channel with both Hamming and synchronization errors.
We study PRC over a stochastic memoryless Binary Substitution-Insertion-Deletion (BSID) channel and its generalized $q$-ary version. At each current input symbol, the channel inserts a uniformly random symbol without advancing with probability $P_i$, deletes and advances with probability $P_d$, or transmits and advances otherwise; a transmitted symbol is then replaced uniformly by another alphabet symbol with probability $P_s$.
We first prove that the majority based PRC construction of Christ and Gunn remains robust over the BSID channel whenever $1-P_i-P_d>0$ and $P_s<1/2$, by proving its majority decoding after the BSID channel recovers more than half of the original coordinates by a constant margin with overwhelming probability. Then we propose a unique-decodable public-key multi-bit PRC on a constant alphabet constructed by letting the Christ--Gunn majority component protect control information and the Haeupler--Shahrasbi synchronization/list-recovery construction encodes the high-rate payload. For every sufficiently large admissible constant alphabet q depending on the channel parameters, the PRC is robust against a q-ary SID channel bounded by $P_i+P_d<1$, $P_s<$1, and its rate approaches the genie-aided capacity upper bound of the channel when q approaches infinity.
## 2026/2180
* Title: Gaussian Kernel Lattices and Smoothing Bounds from Theta Integrals
* Authors: Samed D|+zl|+, Nihar Gargava, Erkan Tairi
* [Permalink](https://eprint.iacr.org/2026/2180)
* [Download](https://eprint.iacr.org/2026/2180.pdf)
### Abstract
A Gaussian leftover hash lemma (LHL) states that, for a matrix $\mathbf{X}$ with discrete Gaussian columns and a sufficiently wide Gaussian vector $\mathbf{v}$, the product $\mathbf{X}\mathbf{v}$ is close to a discrete Gaussian. Over the integers this is a classical tool, and Albrecht-Felderhoff-Lai-Lapiha-Woo (EUROCRYPT'26) recently extended it to modules over a number field $K$ of degree $d$. In every version, the lemma rests on two facts about the kernel lattice of $\mathbf{X}$: that $\mathbf{X}$ is surjective, and that the smoothing parameter of the kernel is small.
We prove both facts with a single analytic estimate. An exact identity expresses the Gaussian mass of the dual kernel, multiplied by the index of the image of $\mathbf{X}$, as an integral of one-dimensional periodic Gaussian sums over a torus. Bounding this integral below two forces the index to be one, which is surjectivity, and bounds the smoothing parameter at the same time. No separate surjectivity argument and no GRH are needed.
For smoothing error $2^{-\lambda}$ the smoothing parameter is $O_K(\sqrt\lambda)$ with explicit constants, once $\mathbf{X}$ has $m\gtrsim dr\ln(srm)$ columns, and a deterministic lower bound shows that this order is optimal. The width $s$ of the matrix enters only through the number of columns. Over power-of-two cyclotomic fields the theorem even applies to matrices whose integer coefficients follow a discrete Gaussian of width one. In the SIS-to-$k$-SIS reduction of Albrecht et al. (EUROCRYPT'26), the new bound lowers the hint width from $d^{39/2}\lambda^{9/2}$ to $d^{3/2}\lambda^{3/2}$ and the norm loss from $d^{41/2}\lambda^{5}$ to $d^{3/2}\lambda^{2}$, up to logarithmic factors. Additionally, we also formalized the main results of the paper in Lean.
## 2026/2181
* Title: Attacking UOV-based Signatures with Schur--Macaulay Matrices
* Authors: Simon-Philipp Merz, Lars Ran
* [Permalink](https://eprint.iacr.org/2026/2181)
* [Download](https://eprint.iacr.org/2026/2181.pdf)
### Abstract
Unbalanced Oil and Vinegar (UOV) and its variants are among the candidates in the NIST call for additional post-quantum signatures. Their security rests on the hardness of recovering a hidden subspace on which a public system of quadratic forms vanishes. In characteristic $2$ the polar forms of such a system are alternating, which a recent attack exploits by working in the exterior algebra rather than the polynomial ring. Unlike its polynomial-ring counterparts, it either applies at a threshold fixed by the parameters or not at all, and for most proposed parameter sets it does not.
We remove this threshold and improve complexity in two independent ways. First, over the integers the square of an alternating polar form is $\omega \wedge \omega = 2\,\omega^{(2)}$, so in characteristic $2$ it vanishes only because the factor $2$ does. Dividing that factor out before reducing leaves the divided square $\omega^{(2)}$, which still vanishes on the oil space but is in general not a consequence of the original equations. Iterating gives a whole tower $\omega^{(2^j)}$ of new equations. Second, the symmetric powers $\textrm{Sym}^d\mathbb{F}_q^n$ and the exterior powers $\bigwedge^a\mathbb{F}_q^n$ are the two extreme shapes of the Schur modules $L_\lambda\mathbb{F}_q^n$. We introduce an extension of Macaulay matrices to an arbitrary shape $\lambda$ which we call Schur--Macaulay matrices. For both constructions we conjecture a Hilbert series and verify it experimentally. We also extend the approach to odd characteristic.
The attack then applies to every Round-2 parameter set of UOV, MAYO, SNOVA, and QR-UOV but one. Four of the alternate Round-2 parameter sets of MAYO fall below their claimed security level while being out of reach of all previous attacks. After disclosing preliminary results to the MAYO team, a parameter set designated for Round-3 was discarded and parameters increased. For SNOVA, the divided powers remove the spurious kernel elements that obstructed the exterior algebra attack, and seven of the eleven Round-2 parameter sets fall below their claimed security level, and the complexity estimates drop further compared to previous attacks.
## 2026/2182
* Title: Lexicure: Efficient, Encrypted Lexical Search
* Authors: Malvika Raj Joshi, Tal Wagner, Shai Halevi, Nina Mishra
* [Permalink](https://eprint.iacr.org/2026/2182)
* [Download](https://eprint.iacr.org/2026/2182.pdf)
### Abstract
Lexical search retrieves documents containing query keywords that require exact matches, such as rare terms, entity names or codewords. Search is increasingly hosted in the cloud, which places both the corpus and every query on infrastructure the data owner does not control. Encrypted lexical search addresses this concern by ensuring no third party, including the cloud provider, learns which queries are issued or which documents are retrieved. The key binding constraints are all on the client rCo accuracy, memory, computation, and communication rCo since cloud capacity is elastic. Existing approaches that guarantee full privacy without caveats require prohibitively high client-side persistent storage or communication.
We present Lexicure, a protocol for encrypted lexical search that reduces the search to arithmetic operations favorable to cryptographic primitives, such as encrypted matrixrCovector products (EMVP). Across sixteen diverse datasets, Lexicure retains over $95\%$ of plaintext BM25 accuracy on average. Lexicure sets a new baseline for leakage-free lexical search, requiring 2.6-9.9$\times$ less communication than alternative approaches and less than 1KB of client-side storage. A major challenge is that secure lexical search is inherently bandwidth-bound. We additionally describe an approach for compressing the communication further in exchange for a larger server. To do so, we introduce a new cryptographic primitive that modifies EMVP to securely compute quadratic and higher-degree functions, more efficiently than a direct reduction.
Lexicure demonstrates that leakage-free encrypted search with practical performance is achievable and opens new avenues for secure information retrieval systems.
## 2026/2183
* Title: Vespa: Efficient Secure Aggregation with Integrity Defense under Server Privacy
* Authors: Jia Hu, Hongwei Li, Meng Hao, Hanxiao Chen, Pengzhi Xing, Wenbo Jiang, Dongxiao Liu, Haiyang Xue, Robert H. Deng
* [Permalink](https://eprint.iacr.org/2026/2183)
* [Download](https://eprint.iacr.org/2026/2183.pdf)
### Abstract
Secure aggregation with input validation enables a server to securely compute the summation of private data from multiple clients while verifying that the inputs satisfy specific constraints. However, the practical deployment of this paradigm at scale is hindered by two primary limitations. First, existing schemes suffer from severe efficiency bottlenecks due to their reliance on generic, computationally expensive zero-knowledge proofs (ZKPs). Second, the scope of input validation is currently restricted to norm checks (e.g., $L_2$ and $L_\infty$) against public bounds.
This paper presents \textsf{Vespa}, a single-server secure aggregation scheme that simultaneously achieves practical efficiency and expands validation capabilities to support both \textit{norm checks against public bounds} and \textit{similarity checks against private server inputs}. Specifically, we design a novel validity-weighted secure aggregation protocol over committed inputs, built upon highly efficient vector oblivious linear evaluation (VOLE). To efficiently realize input validation, we introduce customized $L_2$ and $L_\infty$ norm checks based on VOLE-based ZKPs, centered around optimized range proofs with reduced range sizes. Furthermore, we extend our framework to support advanced similarity-based checks against private server inputs, instantiated with widely used Euclidean and cosine similarities. This allows \textsf{Vespa} to first filter out invalid inputs using norm checks, followed by performing fine-grained validation via similarity metrics.
We compare our scheme with the state-of-the-art secure aggregation works, including RoFL (S\&P 2023), ACORN (USENIX Security 2023), and Armadillo (CCS 2025), and extensive evaluation shows that our $L_2$ and $L_\infty$ norm checks achieve runtime improvements of up to $2\sim 3$ and $1\sim 3$ orders of magnitude, respectively.
Our similarity checks also achieve practical performance, consuming only around $94$ seconds for an $818$k-entry vector.
## 2026/2184
* Title: Static Group Signature with Post-Compromise Accountability
* Authors: Kyosuke Yamashita
* [Permalink](https://eprint.iacr.org/2026/2184)
* [Download](https://eprint.iacr.org/2026/2184.pdf)
### Abstract
Signatures with Post-Compromise Accountability (SPCA), introduced by Dayanikli et al. at SCN'26, are signature schemes that enable signatures generated before the compromise of a signing key to be distinguished from those produced after the compromise. In this paper, we extend this notion to static group signatures and introduce Group Signatures with Post-Compromise Accountability (GSPCA).
GSPCA preserves the anonymity and traceability guarantees of group signatures while enabling pre-compromise signatures to be revalidated after key compromise. The coexistence of opening and revalidation algorithms gives rise to a new consistency requirement, which we formalize as opening--revalidation consistency. We present a generic construction of GSPCA from public key encryption schemes, signature schemes, and simulation-sound non-interactive zero-knowledge proof systems. A central technical difficulty is that the encryption randomness in our construction is derived from a randomized signature component and may therefore have high min-entropy without being uniformly distributed. To address this issue, we introduce adaptive hedged security against adaptive chosen-ciphertext attacks (AH-CCA), which extends indistinguishability under adaptive chosen-ciphertext attack (IND-CCA2) to adaptively chosen high-min-entropy message--randomness distributions, and show how to realize the required randomness-recovering encryption in the random oracle model. We also give a generic signature-based mechanism that provides the required min-entropy and key-binding properties. Finally, we show that ordinary IND-CCA2 security alone is insufficient as a general assumption for our construction by exhibiting an IND-CCA2 secure encryption scheme for which the resulting GSPCA scheme fails to satisfy anonymity.
## 2026/2185
* Title: Instantiating Microcrypt: Obstacles and opportunities via tailored state certification
* Authors: Jose Carrasco, Jens Eisert, Soumik Ghosh, Dominik Hangleiter, Nicky Kai Hong Li, Ryan Sweke
* [Permalink](https://eprint.iacr.org/2026/2185)
* [Download](https://eprint.iacr.org/2026/2185.pdf)
### Abstract
Recent work has introduced the Hamiltonian phase state (HPS) assumptions, which postulate that Hamiltonian phase states can be used to instantiate pseudorandom and one-way state generators. Additionally, it has been conjectured that these assumptions can be true, even if one-way functions do not exist. This is exciting, because if true, then the HPS assumptions provide a route to the instantiation of Microcrypt. In this work we falsify this conjecture, by proving that if the HPS assumptions are true, then one-way functions exist. While this removes the possibility of instantiating genuine Microcrypt cryptography with Hamiltonian phase states, it shows that the HPS assumptions provide novel inherently quantum assumptions for the construction of classical cryptography. Technically we achieve this via a method for the construction of one-way puzzles from one-way state generators and tailored "measure first, ask later" state certification protocols. This generalizes prior constructions of one-way puzzles from one-way state generators via classical shadows and allows us to relate properties of the one-way puzzle to properties of the state certification protocol used in the construction. Specifically, if the state certification protocol admits efficient classical post-processing then one obtains an efficiently verifiable one-way puzzle, and if the state certification protocol can be efficiently classically simulated in a certain sense, then one obtains a classical one-way puzzle, which implies one-way functions. The latter observation allows us to prove that the HPS assumptions imply one-way functions, by exploiting properties of state certification protocols for phase states. The former observation provides a new toolbox for the construction of efficiently verifiable one-way puzzles by exploiting tailored state certification protocols for pseudorandom and one-way state generators.
## 2026/2186
* Title: Provable FFT-Accelerated Dual Attack on LWE Using the General Dual Lattice
* Authors: Jiale Li, Li-Ping Wang, Huaxiong Wang
* [Permalink](https://eprint.iacr.org/2026/2186)
* [Download](https://eprint.iacr.org/2026/2186.pdf)
### Abstract
The dual attack is a central tool for evaluating the security of the Learning with Errors (LWE) problem, which is the foundation of the lattice-based cryptosystems such as ML-KEM. Since the introduction of FFT acceleration by Guo and Johansson (ASIACRYPT 2021) and subsequent optimizations in the MATZOV report, FFT-based dual attacks have achieved concrete security estimates for ML-KEM. However, these results rely on one specific independence heuristic that is known to fail in certain parameter regimes (CRYPTO 2023).
Recent work by Pouly and Shen (EUROCRYPT 2024) initiated the study of provable dual attacks through explicit geometric analysis, but restricted the analysis to the orthogonal lattice, requiring approximately \(m\approx2n\) LWE samples. Qu and Xu (ASIACRYPT 2025) subsequently introduced modulus switching into the provable dual-attack setting, enabling evaluation over a smaller modulus, with a revised analysis given in their later version. More recently, a closely related ePrint revisited the concrete complexity estimates of these provable attacks after correcting the norm-bound formula used in the earlier analysis.
In this work, we provide a provable correctness analysis of the Guo--Johansson-style FFT-based dual attack over the general dual lattice. By extending the analysis from the orthogonal lattice to $L_q(\mathbf{A}^{T})$, where $\mathbf{y}$ is not restricted to $\mathbf{0}$, we reduce the required number of LWE samples from $m\approx2n$ to $m\approx n$ while retaining the computational efficiency of FFT-based score evaluation. We further derive an explicit upper bound on the false-positive probability via an integral estimate for a geometric distinguishing event.
For concrete complexity estimation, we follow the abstractions and cost models used in prior provable analyses while refining the probability-dependent treatment of the norm bounds. We obtain attack costs of $216$, $317$, and $426$ bits for ML-KEM-512, ML-KEM-768, and ML-KEM-1024, respectively. Compared with the recomputed estimates of the previous best published provable dual attack, these represent reductions of $22$, $30$, and $52$ bits, respectively.
## 2026/2187
* Title: Rethinking Zero-Knowledge TLS: Proof of Protocol Execution and the Reclaim Protocol
* Authors: Andrey Bozhko, Kirill Kutsenok
* [Permalink](https://eprint.iacr.org/2026/2187)
* [Download](https://eprint.iacr.org/2026/2187.pdf)
### Abstract
In a zkTLS protocol, a user proves to a third party a property of data obtained from an online service over TLS, revealing nothing beyond the statement proven. Each existing scheme, however, comes with its own security model, written for that scheme alone, so the schemes are not proven secure against a common definition. The root cause is a mismatch of levels: existing models are stated at the level of TLS and therefore reflect how each construction handles it. Yet TLS is only the transport, and a zkTLS proof is about the application-layer protocol executed over it. We therefore introduce the first transport-agnostic security model for zkTLS, stated at the application layer and mentioning neither TLS nor any particular construction. The resulting notion, Zero-Knowledge Proof of Protocol Execution (zkPoPE), defines what it means for a party that has executed an arbitrary two-party protocol with a counterparty to prove, in zero knowledge, that its private input and the reply it received satisfy a chosen property, and, crucially, that the reply comes from a real execution with that counterparty rather than being fabricated. This proof-of-execution requirement separates zkPoPE from a NIZK over the input--reply pair: knowing a satisfying pair does not by itself show that an execution occurred. We formalize zkPoPE as a UC ideal functionality F_{zkpope}. We then introduce the Reclaim Protocol, a zkTLS scheme that UC-realizes F_{zkpope} under a deployment-aligned trust model and underlies a production system. Reclaim builds on Distributed-AEAD, a new three-party authenticated-encryption primitive of independent interest. On a lower-mid-range phone, Reclaim attests to a 1200kB response in 7.28s, two orders of magnitude beyond any size previously benchmarked for zkTLS.
## 2026/2188
* Title: SPRUCE: Scalable Multiparty Private Set Union in Constant Rounds
* Authors: Zhengwei Tong, Saba Eskandarian, Jonathan Katz, Kartik Nayak
* [Permalink](https://eprint.iacr.org/2026/2188)
* [Download](https://eprint.iacr.org/2026/2188.pdf)
### Abstract
Multiparty private set union (MPSU) enables a group of mutually distrusting parties, each holding a private set, to learn the union of their sets without revealing additional information. MPSU is a fundamental primitive with applications to privacy-preserving tasks such as cyber-risk assessment and private record matching.
State-of-the-art MPSU protocols require parties to sequentially shuffle encrypted values in order to hide which party contributed which inputs to the final result. We introduce a new paradigm for semi-honest MPSU that eliminates the need for such shuffling. This allows the protocol to run in constant rounds regardless of how many parties are involved. The resulting protocol also benefits from improved parallelism, an information-theoretic online phase, and native support for unbalanced input sizes, a situation most prior works must handle by padding inputs to hide individual input sizes.
We implement and evaluate our protocol across a range of party counts, input sizes, and network conditions. In the unbalanced setting, where parties hold unequal-sized inputs, our protocol significantly outperforms the state-of-the-art schemes PULSE (CCS rCO25) and DZBC25 (USENIX Security rCO25). In the balanced setting, it achieves an order-of-magnitude improvement over PULSE in most settings and outperforms DZBC25 in WAN deployments with 100ms latency.
## 2026/2189
* Title: SafeCast: End-to-End Security for Ultra-High-Bitrate Broadcast Media
* Authors: Arman Kolozyan, Christian Knabenhans, Zayd Maradni, Carmela Troncoso * [Permalink](https://eprint.iacr.org/2026/2189)
* [Download](https://eprint.iacr.org/2026/2189.pdf)
### Abstract
To address the scalability and flexibility limitations of dedicated point-to-point cabling in broadcast production, the broadcasting community created a suite of standards for carrying media over IP multicast. This shift removes the inherent physical protection that dedicated cabling provides, exposing streams to tampering and eavesdropping. Such threats have been widely reported and pose major risks to broadcasters and their audiences. Despite almost a decade of deployment, the security of IP-based broadcast has received little academic attention.
We collaborate with the European Broadcasting Union (EBU) to establish the security and deployment requirements of this environment. We introduce SafeCast, a system to secure the transmission of ultra-high-bitrate multicast media. SafeCast builds on established and standardized protocols (the MLS group key agreement protocol and the SRTP media-protection protocol), while extending and adapting them to the demanding setting of broadcast media. SafeCast provides strong confidentiality and integrity guarantees, and exploits the precise clock synchronization of broadcast networks to achieve cheap per-sender authentication. We evaluate SafeCast against the stringent deployment requirements of production facilities (throughput, latency, large dynamic groups) and find that it can sustain the most common media formats with ample headroom.
## 2026/2190
* Title: Stay in Your Lane: Fast Arithmetic over Large Finite Rings with CKKS
* Authors: Hyeongmin Choe, Robin K||stler, Tim Seur|-
* [Permalink](https://eprint.iacr.org/2026/2190)
* [Download](https://eprint.iacr.org/2026/2190.pdf)
### Abstract
Recent CKKS-based constructions support homomorphic arithmetic modulo powers of two and more general moduli. We explore a complementary tradeoff: using polynomial rings native to CKKS simplifies arithmetic and refreshing but restricts the message spaces. Building on Kim's interpretation of GBFV ciphertexts as CKKS ciphertexts, we use the decomposition $\mathbb{R}[X]/\langle X^N+1\rangle \cong(\mathbb{R}[X]/\langle X^n+1\rangle)^{N/n}$ into $N/n$ polynomial lanes, where $2\leq n\leq N$ is a power of two dividing the RLWE dimension $N$. Following GBFV, each lane represents a message in $\mathbb{Z}[X]/\langle X^n+1,t\rangle$, where $t$ is coprime to $X^n+1$ over $\mathbb{Q}$. These message spaces include $\mathbb{Z}_{\beta^n+1}$ for $t=X-\beta$, products of modular integer rings, specific 128-, 256-, 512-, and 1024-bit prime fields, and extension fields such as $\mathbb{F}_{5^{16}}$, $\mathbb{F}_{17^4}$, and $\mathbb{F}_{37^{32}}$. Unlike the triangle encoding of Gao and Zheng's construction (GZ), our lanes occur at intermediate stages of conventional CoeffToSlot and SlotToCoeff transformations, avoiding additional encoding-specific linear maps. We thus "stay in our lane" by performing arithmetic and refreshing within CKKS-native polynomial rings. Our arithmetic bootstrapping restores ciphertext levels, bounds polynomial representatives, and reduces approximation error. At $N=2^{16}$, it takes less than 4.5 seconds in every tested configuration, with little variation across $t$ and $n$. Comparing our arithmetic modulo $2^n+1$ with GZ's arithmetic modulo $2^n$, same-machine, same-library experiments show a $2.2\times$rCo$3.8\times$ speedup for $2^3\leq n\leq 2^6$. Our bootstrapping time remains nearly constant as $n$ grows, whereas GZ's dense encoding-specific transformations increase its cost and, at larger $n$, exceed available memory, preventing direct comparisons. At $n=2^{14}$, extrapolating GZ's published timings suggests a $26\times$ speedup.
## 2026/2191
* Title: Building Quantum Circuits with Qarton
* Authors: Andr|- Schrottenloher
* [Permalink](https://eprint.iacr.org/2026/2191)
* [Download](https://eprint.iacr.org/2026/2191.pdf)
### Abstract
In order to estimate accurately the impact of large-scale computing devices, one requires a precise resource estimate of quantum algorithms for cryptographic problems. As a start, these algorithms can be described as quantum circuits. One then estimates the number of gates, qubits, and circuit depth that they require, as a first step towards physical resource estimates.
In order to simplify this task, different quantum programming languages have been used, targeting different circuit sizes and abstraction levels. Quantum cryptanalysis is indeed a domain in which one may consider both medium-scale circuits with fine-grained optimizations (such as optimizations of Shor's algorithm) and very large-scale circuits with well-defined building blocks (such as exhaustive key search on block ciphers using Grover's algorithm).
This paper presents Qarton, a python library to represent logical quantum circuits, focused on quantum cryptanalysis. It allows to study very large-scale circuits like Grover searches, to simulate classical or ``almost'' classical circuits such as the arithmetic building blocks of Shor's algorithm, and to analyze trade-offs between qubit and gate count when switching between different implementations of arithmetic operations. Qarton is equipped with a library of around 300 circuits and examples from different areas of quantum symmetric and asymmetric cryptanalysis.
## 2026/2192
* Title: Distribution-Aware Encryption with Optimal Recovery and Semantic Security
* Authors: Haijie Su, Haibo Cheng, Ping Wang
* [Permalink](https://eprint.iacr.org/2026/2192)
* [Download](https://eprint.iacr.org/2026/2192.pdf)
### Abstract
Distribution-aware encryption seeks guarantees tailored to the probability
law of the protected data and the secret key. We study simultaneous message-recovery, key-recovery, and target-distribution semantic security
for arbitrary finite joint distributions, without assuming that messages
and keys are independent. We represent encryption by a decomposition of
the joint probability matrix and construct this decomposition through capacity-controlled randomized rounding. A stepwise conditional sampler
turns the rounding process into a correct encryption algorithm without enumerating its output distribution or rejecting complete samples.
Let $p_\star$ and $q_\star$ be the largest message and key probabilities.
Our construction attains the exact message-recovery optimum $\max\{p_\star,q_\star\}$, has key-recovery success below $2q_\star$, and provides $O(\sqrt{q_\star})$ advantage against prediction of every fixed Boolean message predicate. The semantic guarantee follows from negative correlation of the binary row-rounding remainders.
We prove that the key-recovery factor cannot be uniformly improved while preserving exact message-recovery optimality, and that the semantic
bound has the optimal worst-case order. We also establish additive
robustness under distribution error and short-ciphertext existence by preserving only the moments needed for the security proof. The general
sampler runs in expected polynomial time in the explicit rational input size; short
ciphertexts do not by themselves imply efficient preprocessing or
compact public descriptions. Structured sources admit additional
efficient implementations.
## 2026/2193
* Title: Square-Root Log-Rank Standard Deviations for the Higher-Rank KadisonrCoSinger Problem: Polynomial-Time Algorithms via Schatten-Norm Potentials
* Authors: Zhao Song, Song Yue
* [Permalink](https://eprint.iacr.org/2026/2193)
* [Download](https://eprint.iacr.org/2026/2193.pdf)
### Abstract
We study the matrix signing problem for positive semidefinite matrices, assigning one sign to each original matrix regardless of its rank. This includes the higher-rank Kadison--Singer partition problem [KS59] when the matrices sum to the identity. For arbitrary positive semidefinite matrices $A_1,\ldots,A_m\in\mathbb C^{n\times n}$, we prove that there are signs $\sigma_i\in\{-1,1\}$ such that $\|\sum_i \sigma_i A_i\|\le 3.34963\|\sum_i \operatorname{tr}[A_i]A_i\|^{1/2}$. We give a deterministic algorithm achieving this bound in $\widetilde O(mn^2+n^{4.75})$ real arithmetic operations. Inspired by the Lee--Sidford barrier, we use a potential function built from Schatten norms to obtain a square-root logarithmic dependence on the rank. Under the additional assumptions $\sum_iA_i=I$, $\|A_i\|\le\alpha$, and $\operatorname{rank}(A_i)\le r$, we obtain a discrepancy of at most $\min\{1,3.48745\sqrt{\alpha\log(2r)}\}$. We also give a deterministic algorithm achieving a discrepancy of at most $\min\{1,4.171\sqrt{\alpha\log(2r)}\}$ in $\widetilde O(mn^2+n^{6.38})$ real arithmetic operations. This dependence on $\alpha$ and $r$ is optimal up to an absolute constant when $0<\alpha\le1/256$ and $r\ge256\alpha^{-6}$: even diagonal matrices can force every signing to have a discrepancy of at least $\min\{1,\sqrt{\alpha\log(2r)}\}$.
For a zero-one incidence matrix with at most $d$ ones in each row and each column, our deterministic algorithm achieves a discrepancy of $O(\sqrt{d\log(d)})$, recovering Harvey's bound [Har15] by a different method. We give a deterministic construction of a single spanning tree that is simultaneously spectrally thin with respect to any given collection of $k\ge1$ positive edge weightings of the same graph, assuming small edge leverage in every weighting. The tree retains the original edge weights, and its thinness bound grows only logarithmically with $k$.
## 2026/2194
* Title: A Black-Box Impossibility Result for Threshold Signing Standard Hash-Based Signatures
* Authors: Yashvanth Kondi, Naman Kumar
* [Permalink](https://eprint.iacr.org/2026/2194)
* [Download](https://eprint.iacr.org/2026/2194.pdf)
### Abstract
Hash-based signature schemes present an appealing proposition: they are broadly regarded as the most conservative in terms of assumptions, and their efficiency profiles suit many applications. However, little is known about their compatibility with threshold signing, which is common practice today in domains like digital asset security. Especially in the context of an impending migration to post-quantum cryptography, this gap in the literature leaves uncertain what hash-based standards would imply for applications that rely on threshold signing. In this work, we develop a new framework by which to analyze such hash-based schemes, and prove inherent barriers to designing an entire class of efficient (fully distributed) threshold signing protocols. Our framework is simple, and yet powerful. Our results encompass standard schemes such as XMSS and SLH-DSA.
Our approach is to connect hash-based signatures to the literature on straight-line extraction in the random oracle model. We then apply and build upon techniques from the recent work of Doerner et al. (Crypto '24) to show that threshold signing protocols for hash based schemes mustrCobeyond a certain number of signersrCouse the circuit representation of the hash function, i.e. it can not use the hash function as a black box. We then give a more fine-grained analysis for the specific case of the Winternitz signature schemerCoa building block of both NIST standardsrCoand show that it can not permit even two-party signing with blackbox use of the hash function.
## 2026/2195
* Title: Multi-Key FHE Almost as Fast as Single-Key FHE
* Authors: Abtin Afshar, Rishab Goyal
* [Permalink](https://eprint.iacr.org/2026/2195)
* [Download](https://eprint.iacr.org/2026/2195.pdf)
### Abstract
Multi-key fully homomorphic encryption (MKFHE) supports homomorphic computation over ciphertexts encrypted under independently generated keys. Known constructions accommodate independent keys by expanding every ciphertext under the concatenation of the participating secret keys, and then evaluating the circuit in that expanded dimension. A concatenated key is $N$ times longer than an individual key, so the ciphertext on each wire and the running time of each gate grow with $N$, the number of users. L\'opez-Alt, Tromer, and Vaikuntanathan, who introduced MKFHE, asked for a scheme in which all algorithms are independent of $N$. More than a decade later, no MKFHE scheme has a homomorphic evaluation whose cost is even sublinear in $N$.
We construct the first MKFHE whose homomorphic evaluation asymptotically matches that of single-key FHE, while users still generate their keys and encrypt independently and the participating set is chosen only after encryption. We insert a public, deterministic, and non-interactive preprocessing phase between encryption and evaluation: key aggregation combines the selected public keys, and ciphertext preparation converts each independently encrypted input into a short single-key ciphertext under a \emph{virtual key}, namely the sum of the participating secret keys. Evaluation then runs on ordinary single-key ciphertexts, so every wire ciphertext, every gate, and the decryptable output are independent of $N$.
We give two instantiations, a leveled GSW-based scheme over $\mathbb{Z}_q$ from standard LWE and a leveled BFV-based scheme over cyclotomic rings from circular Ring-LWE. Both retain single-round distributed decryption with statistically simulatable partial decryptions, where the published key material grows with $N$. As a proof of concept, we implement our ring-based construction in Go. For 32 users, its multiplication is $275.13\times$ and $45.50\times$ faster than CDKS and KKLSS, and its ciphertexts are $16.5\times$ smaller than both.
## 2026/2196
* Title: Revisiting Fuzzy Password-Authenticated Key Exchange: Unified Leakage and Improved Efficiency
* Authors: Sihang Pu, Li Yao, Yu Yu
* [Permalink](https://eprint.iacr.org/2026/2196)
* [Download](https://eprint.iacr.org/2026/2196.pdf)
### Abstract
Fuzzy Password-Authenticated Key Exchange (fuzzy PAKE) was introduced at Eurocrypt'18, enabling two parties to securely establish a shared cryptographic key using passwords that are close and potentially low-entropy. This is a generalization of standard PAKE and is particularly useful for handling mistyped passwords or inherently rCLnoisyrCY samples such as biometrics.
While this primitive sounds promising, existing definitions and protocols face several challenges: they may suffer from gapped leakage (namely, leakage of a small amount of information from failed authentications), or they may be restricted to Hamming distance.
We review the functionality and describe our contributions below:
1. Leakage under Reuse.
We show that, when a password may be reused across multiple sessions, any leakage from the functionality has the same eventual compromise consequence under repeated use. Concretely, we construct an efficient ideal-world adversary that recovers an n-character password within O(n) active sessions, assuming it starts from a password not too far from the target. Our attack applies to both Hamming distance and Minkowski (L_p) distance under reasonable parameter choices. This implies that, for common distance metrics in practical settings, several notions of leakage are effectively unified when passwords are reused, thereby resolving an open question from Eurocrypt'18.
2. Supporting L_p Distances.
We propose substantially more efficient protocols for generalized Minkowski (L_p) and Hamming distances in the random oracle model. As a key technical step, we show how to achieve malicious security using only a semi-honestly secure oblivious key-value store, while addressing several subtleties in the proof. Concretely, compared with existing approaches for L_2 distance, our protocol reduces runtime by about 86% and bandwidth by about 99%.
## 2026/2197
* Title: MultLA: A Framework of Fast Correlation Attack Exploiting Multiple Linear Approximations and Its Application to SNOW 5G
* Authors: Jiang Wan, Lin Ding, Jiekun Sun, Xinhai Wang
* [Permalink](https://eprint.iacr.org/2026/2197)
* [Download](https://eprint.iacr.org/2026/2197.pdf)
### Abstract
The complexity of fast correlation attack is fundamentally determined by the correlations of the linear approximations used. Conventional fast correlation attacks either rely on a single dominant linear approximation or use the lower bound to evaluate the resulting correlation of multiple linear approximations, which have the same output mask and distinct input masks. How to exploit multiple linear approximations with distinct output masks remains an open problem. In this paper, we propose a framework of fast correlation attack exploiting multiple linear approximations called \texttt{MultLA} to solve this problem. \texttt{MultLA} utilizes the arithmetic mean of the absolute correlations of linear approximations, rather than the lower bound of that. For SNOW 5G, our attack has time/memory/data complexities of
${{2}^{279.25}}/{{2}^{265.03}}/{{2}^{263.62}}$, which are all better than those of the existing work. When the time and memory complexities are slightly better than those of the existing work, the data complexity is significantly reduced from ${{2}^{265.4}}$ to ${{2}^{261.21}}$. To the best of our knowledge, our attacks achieve the best known cryptanalytic results of SNOW 5G up to now.
## 2026/2198
* Title: Lifting Symmetries for Dimension Reduction in Module-LIP: rank 2 and rank 4
* Authors: Hengyi Luo, Kaijie Jiang, Yanbin Pan
* [Permalink](https://eprint.iacr.org/2026/2198)
* [Download](https://eprint.iacr.org/2026/2198.pdf)
### Abstract
The module lattice isomorphism problem (module-LIP), introduced with HAWK, has attracted growing interest. Its most studied case is ${\mathcal O_{\mathbb{L}}}^2$-LIP, underlying HAWK key recovery, where $\mathbb{L}$ is a power-of-two cyclotomic field and ${\mathcal O_{\mathbb{L}}}$ its ring of integers. Three recent independent algorithms reduce this $2n$-dimensional problem to polynomially many exact-SVP calls: the Claude-derived algorithm uses dimensions at most $n/2+1$, and the ChatGPT-derived and Mureau--Pellet-Mary algorithms use $3n/4+1$. These improve Ducas's generic $\mathbb Z$LIP bound $n+1$ (DCC 2024). Although known SVP methods still give exponential running times, the impact on parameter selection led the HAWK team to withdraw the scheme. All three approaches rely substantially on rank-two structure. Higher-rank module-LIP is a possible direction for alternatives, calling for further study of its hardness.
We first use the symmetric square to obtain a rank-two reduction, matching the bound $3n/4+1$ above. Its auxiliary objects correspond geometrically and algebraically to those of the ChatGPT-derived algorithm, so this does not constitute a substantively new reduction; the differences lie in the interpretation and post-processing. This viewpoint nevertheless motivates our dimension reduction in rank four.
In rank four, the conjugate Hodge star on the exterior square yields a publicly computable fixed lattice isometric to $\mathbb Z^{3n}$, from whose orthonormal basis we reconstruct a module isomorphism. For ${\mathcal O_{\mathbb{L}}}^4$-LIP with the standard free module as reference, we reduce the $4n$-dimensional problem to polynomially many SVP calls in dimensions at most $3n/2+1$, improving the generic bound $2n+1$. All computation outside the oracle runs in deterministic polynomial time.
## 2026/2199
* Title: PulpoPay for Auditable Privacy CBDCs: Introducing High Concurrency and Offline Confirmation
* Authors: Chenke Wang, Shuangcheng Liu, Yu Long, Xian Xu, Dawu Gu
* [Permalink](https://eprint.iacr.org/2026/2199)
* [Download](https://eprint.iacr.org/2026/2199.pdf)
### Abstract
Central Bank Digital Currencies (CBDCs) aim to replicate the utility of physical cash in the digital era by balancing privacy with regulatory auditability. Despite recent advancements, existing CBDC schemes suffer from limited concurrency and the lack of offline payment confirmation, forcing users to process concurrent payments one by one and requiring counterparts to remain online. These constraints severely limit CBDC's applicability in high-frequency, real-world payment scenarios.
This paper proposes PulpoPay, the first CBDC scheme to provide high concurrency and offline confirmation, while maintaining auditable privacy. To achieve high concurrency and offline confirmation, PulpoPay, at its core, introduces a coin-based payment protocol that facilitates users to concurrently withdraw, transfer, and deposit coins without synchronization or online requirements for counterparts. For auditable privacy, we leverage signatures on randomizable ciphertexts to enable fine-grained auditing without compromising privacy. Furthermore, we design a coin identifier with offline-checkable uniqueness to resist double-spending attacks even in disconnected (offline) environments. We formally prove PulpoPay's security within the Universal Composability (UC) framework.
We implement a prototype of PulpoPay.
Experimental results demonstrate that (1) a payment with an offline receiver can be finished within 0.3~s using a mobile phone; (2) PulpoPay outperforms the state-of-the-art PEReDi [CCS'22] in the scenarios of concurrent payments. For a typical setting of 200 concurrent payments, PulpoPay reduces processing time by at least 66.89% and communication overhead by at least 76.45%. This advantage becomes even more significant as the number of concurrent payments grows.
## 2026/2200
* Title: On the Power of Slicing and Dicing: Linear Garbling Beyond Two-Input Gates
* Authors: Tianren Liu, Luojian Wei
* [Permalink](https://eprint.iacr.org/2026/2200)
* [Download](https://eprint.iacr.org/2026/2200.pdf)
### Abstract
Communication is a central efficiency bottleneck in garbled circuits. Rosulek and Roy (CRYPTO 2021) introduced \emph{slicing} and \emph{dicing}, obtaining a garbling scheme in which XOR gates require no communication and each two-input AND gate costs \(1.5\lambda + 5\) bits, where \(\lambda\) is the security parameter.
In this work, we investigate the power of these techniques for garbling gates of larger fan-in. We develop a linear-algebraic framework that yields concrete constructions and asymptotic bounds. For three- and four-input gates, we obtain constructions with communication costs $7\lambda/3 + 35$ and $15\lambda/4 + O(1)$ bits, respectively. For arbitrary fan-in \(n\), we give a construction for any single-output gate with communication cost bounded by \(22 \cdot 2^n\lambda/n + 2^n\) bits.
Our constructions are compatible with free-XOR, and all hash queries within each gate are nonadaptive. We prove security of the framework in the random-oracle model and under a circular correlation robustness (CCR) condition for any number of slices.
We also evaluate simple uses of the three-input construction against the best two-input circuits collected in our experiments, finding evidence of communication savings on control circuits.
## 2026/2201
* Title: Dance with Noise: Safely Trade Minor Decryption Failures for More Compact KEMs with Applications to IKEv2
* Authors: Zidi Zhuang, Yuyang Xiao, Long Chen, Qiang Tang, Zhenfeng Zhang
* [Permalink](https://eprint.iacr.org/2026/2201)
* [Download](https://eprint.iacr.org/2026/2201.pdf)
### Abstract
The standardization of post-quantum cryptography, notably ML-KEM, introduces a severe network bottleneck: large public keys and ciphertexts often exceed the Maximum Transmission Unit (MTU) limits of UDP-based protocols. This size explosion inevitably leads to unreliable IP-layer fragmentation or forces complex protocol workarounds.
To overcome this, we propose a novel design philosophy for post-quantum Authenticated Key Exchange (AKE). We challenge the rigid cryptographic paradigm that mandates negligible decryption failure rates (DFR). By safely trading minor, manageable decryption failures for aggressive size compression, we drastically reduce the bandwidth footprint of lattice KEMs in ephemeral exchanges. We demonstrate this approach via a compact AKE for the Internet Key Exchange protocol (IKEv2). Integrating standard ML-KEM into IKEv2 currently necessitates the high-latency IKE_INTERMEDIATE exchange (RFC 9242) to distribute large payloads. By employing our compressed KEM design (800-byte public key, 928-byte ciphertext), the entire key exchange fits within the initial IKE_SA_INIT packet, completely eliminating the need for RFC 9242.
To ensure that protocol aborts caused by decryption failures do not introduce security vulnerabilities, we formalize IND-CPAF (Indistinguishability under Chosen Plaintext Attack with Failures) to rigorously bound failure-dependent leakage. More importantly, we prove our IKEv2 instantiation still secure in the classical Canetti-Krawczyk model. Finally, our implementation in the strongSwan IPsec library confirms a fragmentation-free handshake: over 10,000 real-world connections, it achieves a 48.8 ms average setup time---matching classical ECDH---and keeps initial packets strictly under the 1280-byte IPv6 MTU, with merely a 0.002% retry rate.
## 2026/2202
* Title: Fully Anonymous Perfect Threshold Secret Sharing: Explicit One-Bit Construction and Rate Amplification
* Authors: Chongxu Ren, Hongbo Yu
* [Permalink](https://eprint.iacr.org/2026/2202)
* [Download](https://eprint.iacr.org/2026/2202.pdf)
### Abstract
Fully anonymous perfect threshold secret sharing combines exactly uniform unauthorized shares with reconstruction from unlabeled share values. Con, Li, and Mazor proved that short-share schemes exist for every threshold, leaving efficient general constructions and constant rate open. We address both questions. First, we give an explicit one-bit scheme with $(2t-3)\lceil\log_2n\rceil$-bit shares, expected-polynomial-time sharing, and deterministic polynomial-time reconstruction. The key is an exact sampler for localized affine relations, including collision patterns. Second, an affine-hull compiler turns any one-bit primitive with alphabet $\{0,1\}^b$ into a long-secret scheme with additive share overhead $b(t-1)\lceil\log_2(n+1)\rceil$, up to field-alignment padding. Authorized payloads determine an affine space; a short anonymously shared certificate identifies the secret within it. Instantiation gives $L+O(t^2\log^2n)$-bit shares and rate $1/2$ at $L=\Theta(t^2\log^2n)$. For fixed $2\le t<n$, the rate approaches one, which the classical bound of Kishimoto et al. shows is unattainable at any finite nontrivial secret alphabet. Finally, we prove the universal bound $|\Omega|\ge(n-t+1)(n-t+2)$ for $3\le t\le n-2$. Together with Con--Li--Mazor's specialized threshold-three construction, this establishes the exact fixed-length optimum of $2m$ share bits for $(t,n)=(3,2^m)$, $m\ge3$. All guarantees are information-theoretic and exact. The technical work is done by GPT 6 Astra.
## 2026/2203
* Title: On FROST and Unconditional LDVR Security
* Authors: Ian Goldberg, Chelsea Komlo, Stefano Tessaro
* [Permalink](https://eprint.iacr.org/2026/2203)
* [Download](https://eprint.iacr.org/2026/2203.pdf)
### Abstract
Inspired by the recent polynomial-time adaptive attacks on threshold Schnorr signatures, we contextualize the Low-Dimensional Vector Representation (LDVR) assumption and its impact on relevant threshold Schnorr signature schemes. Our analysis focuses in large part on FROST, a widely deployed threshold Schnorr signature scheme. However, our analysis is applicable to any relevant threshold Schnorr signature scheme, such as Lindell's three-round threshold Schnorr protocol.
We show that for cases where FROST is used with 131 parties and fewer, and for parameter choices of 128-bit generic (discrete log) security, FROST is secure for any signing threshold. This bound increases to 260 parties for parameter choices of 256-bit security; our analysis similarly can be extended to other parameter choices. This bound assumes the best possible LDVR adversary, even more powerful than the results by Rodr|!guez Garc|!a and Tessaro.
In other words, for real-world uses of FROST with parameter choices of 128-bit security, and with a small (131 and fewer) number of parties, the security of FROST is determined entirely by the hardness of the Algebraic One-More Discrete Logarithm (AOMDL) assumption, as LDVR is unconditionally hard for this parameter regime. It is an open research question whether the concrete attacks given by Rodr|!guez Garc|!a and Tessaro can be improved to approach the unconditional LDVR security bound considered in our analysis.
We then show for each additional party for 132 total number of signers and greater, again for parameter choices of 128-bit generic security, the resulting security of FROST is at worst reduced by approximately one bit (or less) of security for the worst-case choice of corruption threshold. This analysis can be used by practitioners to determine the worst possible security of even large-scale FROST deployments.
Finally, we give two variants to FROST that build upon prior masking techniques to allow for full adaptive security. The first variant allows for masking keys to be derived from Diffie-Hellman identity keys, allowing for constant memory overhead, at the tradeoff of increased computation. The second variant allows for a 50% reduction in memory overhead for storage of pairwise masking keys, by employing symmetric key predistribution techniques.
## 2026/2204
* Title: Provenance Proofs: Linkable Zero-Knowledge Derivation Relations for Hierarchical Deterministic Wallets
* Authors: Vincenzo Botta, Michal Pospieszalski, Emanuele Ragnoli, Justus Ranvier
* [Permalink](https://eprint.iacr.org/2026/2204)
* [Download](https://eprint.iacr.org/2026/2204.pdf)
### Abstract
ZKPoSP proves that a public key or address was honestly derived from a hidden wallet seed, without revealing the seed or the private derivation state. This paper studies relationships among several derived values: whether public keys or addresses, possibly on different curves and different blockchains, share a hidden origin, which is the seed or an anchor of the wallet, and who else can recognize this relation.
We give a model for such provenance proofs, with derivation proofs, which carry a link value, and provenance proofs, which show that several derivation statements share an origin. We define correctness, derivation soundness, provenance soundness, non-frameability and unlinkability. We give four constructions, which differ in who can link: only the user, with a joint proof or with commitments linked later; anyone within a linking context, with a deterministic tag, which can also act as a nullifier; or a designated authority, with an encryption of that tag. We prove, in sketch form, that the constructions satisfy the five properties under the security of the ZKPoSP derivation relations, the random oracle model, and the zero knowledge and simulation extractability of the proof system.
We describe an application to cross-chain transfers from Bitcoin to Solana, in which the payout address must come from the same wallet as the source address, so that an attacker cannot substitute the destination. We report Plonky3 benchmarks of the derivation proofs on which the constructions are built.
## 2026/2205
* Title: DKG Is All You Need
* Authors: Guru-Vamsi Policharla
* [Permalink](https://eprint.iacr.org/2026/2205)
* [Download](https://eprint.iacr.org/2026/2205.pdf)
### Abstract
We construct the first Batched Threshold Encryption scheme with a transparent setup where public parameters are independent of the batch size. As a result batches of arbitrary sizes can be decrypted, without imposing an a priori fixed bound. We prove security under a constant size assumption -- the decisional bilinear square Diffie-Hellman assumption.
Setup is just a distributed key generation protocol to sample secret shares of a random value. Ciphertexts consist of two G1 elements, one G2 element and the encrypted message, plus a NIZK for CCA security (two F elements with a sigma protocol). Partial decryptions are a single G1 element, computed with one scalar multiplication. Decrypting a batch of B ciphertexts costs O(B) pairings and O(B log^2 B) group operations.
## 2026/2206
* Title: GovBind: From Authenticated Fetch to Zero-Knowledge Predicate over Government Documents
* Authors: Yunus G|+rlek, Ahmet Ramazan A-f-#rta+f
* [Permalink](https://eprint.iacr.org/2026/2206)
* [Download](https://eprint.iacr.org/2026/2206.pdf)
### Abstract
Government portals often issue PDF certificates whose provenance can be verified only through a live HTTPS verification service. Proving a limited fact from such a document therefore commonly requires disclosing the complete document or giving the verifier access to the portal. We present GovBind, a protocol that combines zkTLS provenance with a zero-knowledge content proof, without requiring the issuer to modify its service or embed an independently verifiable signature. A baseline construction binds both stages through a commitment to the complete response body. To make client-side proving feasible for compressed PDFs, an optimized construction instead commits separately to private ranges, discloses the remaining bytes, requires their exact partition, and opens the claim-bearing compressed stream in a document profile-specific proof that constrains DEFLATE decompression.
We formalize GovBind with game-based definitions of correctness, soundness, and privacy, where soundness jointly captures authenticity, content validity, and binding, and we prove both constructions secure relative to the explicit leakage and trust assumptions of Proxy-mode TLSNotary. Our prototype supports proofs of no overdue tax debt, bounded traffic penalties, and residence city over documents returned by the Turkish government verification service, e-Devlet. Across 72 generated proofs in 24 sessions, end-to-end generation took 54-119 seconds, verification took 44-127 milliseconds, and proofs were 11-12 KiB.
## 2026/2207
* Title: Two Laws of Public-Key Cryptography
* Authors: Trey Li
* [Permalink](https://eprint.iacr.org/2026/2207)
* [Download](https://eprint.iacr.org/2026/2207.pdf)
### Abstract
We discover two laws governing public-key key exchange and public-key encryption. The first states that a non-interactive key-exchange scheme is secure only if it is kleptographically insecure. The second states that a public-key encryption scheme is secure only if it is kleptographically insecure. They give two impossibility results: no kleptographically secure non-interactive key exchange with pseudorandom shared keys exists, and no kleptographically secure public-key encryption with pseudorandom ciphertexts exists. More precisely, no non-interactive key-exchange scheme can simultaneously establish pseudorandom shared keys and support black-box execution in which the user observes only the public keys and the final shared keys output by the black box, and no public-key encryption scheme can simultaneously have pseudorandom ciphertexts and support black-box execution in which the user observes only the public keys and plaintexts input to the black box and the ciphertexts output by it. Our argument turns the very shield of a primitive into a spear against itself, showing that the security guarantee of the primitive is precisely what enables a kleptographic attack. We instantiate the laws with two post-quantum schemes: CSIDH and Regev encryption.
## 2026/2208
* Title: A Note on CDS for Random Functions
* Authors: Marshall Ball
* [Permalink](https://eprint.iacr.org/2026/2208)
* [Download](https://eprint.iacr.org/2026/2208.pdf)
### Abstract
We record the following bound: almost all Boolean functions $f : \{0,1\}^n \times \{0,1\}^n \to \{0,1\}$ require $2n - 2\log n - O(1)$ bits of communication for perfect two-party conditional disclosure of secrets with a one-bit secret. This only gives a factor 2 improvement over the previous best bound due to Applebaum, Holenstein, Mishra and Shayevitz [EUROCRYPT 2018], but at least (nearly) matches the input length. The proof is a straightforward compression argument that uses the birthday bound to give a succinct representation of transcript collisions (the latter being a technique from Feige, Kilian and Naor [STOC 1994], refined in Applebaum et al.).
Viewing transcript-collision testing as an elementary case of distribution testing extends the argument to imperfect correctness and privacy. We do not currently know how to extend the argument to an explicit hard predicate.
## 2026/2209
* Title: The Cost of Rewinding for Succinct Arguments: Strict-Time Barriers and Expected-Time Security
* Authors: Alessandro Chiesa, Ziyi Guan, William Wang, Yuetian Wu
* [Permalink](https://eprint.iacr.org/2026/2209)
* [Download](https://eprint.iacr.org/2026/2209.pdf)
### Abstract
Succinct arguments are central cryptographic objects, underlying various applications such as blockchains and image authentication. Almost all succinct arguments used in practice follow the commit-and-open paradigm introduced by Kilian (STOC 1992): commit to a probabilistic proof, then open the few locations the verifier queries. Decades of work have generalized and optimized this paradigm, yet its exact provable security in the standard model remains unclear. Existing analyses proceed by rewinding, and they leave gaps: strict-time analyses lose an inverse-polynomial factor, while expected-time analyses are sharper but apply only to special cases of this paradigm.
We resolve both gaps. On the negative side, we show that the strict-time loss is inherent: no strict polynomial-time reduction relying on a black-box extractor can achieve negligible knowledge error (unless the underlying language is easy). On the positive side, we give a new expected-time analysis, achieving negligible soundness and knowledge errors via an expected polynomial-time reduction against expected polynomial-time adversaries, at the full generality of the paradigm, capturing multi-round and functional variants such as polynomial and linear IOPs compiled with the corresponding commitments. This is the first standard-model analysis to reach this regime for succinct arguments deployed in practice.
## 2026/2210
* Title: Skyhook: Trustless Cross-Chain Value Transfer with a Fully Scriptless Pool
* Authors: Abhinav Vishnu
* [Permalink](https://eprint.iacr.org/2026/2210)
* [Download](https://eprint.iacr.org/2026/2210.pdf)
### Abstract
Facilitating value transfers with a scriptless chain is a longstanding problem in cryptography. We present a cross-chain messaging and value transfer protocol that maintains game-theoretic atomicity even when one party is operating on a chain which is fully scriptless, such as shielded Zcash, which has no scripting capabilities at all and requires transactions to be virtually identical.
The observation is that consensus protocols which utilise segregated witness schemes to ensure transaction ID unmalleability (such as ZIP244 in Zcash, SegWit in Bitcoin), segregate transaction data from transaction witness component (which is the part that is actually signed). The transaction identifier is, therefore, a virtually collision-resistant commitment to the effects intended by the transaction, computable before signing, and in many chains, even without the knowledge of the signer.
We then use this primitive to build a non-interactive zero-knowledge argument (NIZK) to prove that a given future transaction ID reliably commits to a specific effect, often without revealing the sender, confidential data, or requiring the recipient to sign. Combined with an SPV light client on the Turing-complete chain, this yields fully trustless verification that a shielded transaction occurred with a reliable guarantee, with no requirements of a validator consortium or multisig that can be hacked or stalled.
## 2026/2211
* Title: Structural Cryptanalysis of Polar-KEM: Direct Recovery of the Secret Isometry
* Authors: Yuyang Xiao, Long Chen, Zhenfeng Zhang
* [Permalink](https://eprint.iacr.org/2026/2211)
* [Download](https://eprint.iacr.org/2026/2211.pdf)
### Abstract
Polar-KEM is a lattice-based key encapsulation mechanism submitted
to the Next-generation Commercial Cryptographic Algorithms Program.
Its security is claimed to rely on a lattice isomorphism problem over polar-code-defined Construction-D lattices. In its core key-generation algorithm, a polar lattice basis is constructed from a polar-code chain, reduced using LLL, and left-multiplied by a secret orthogonal matrix.
The resulting matrix is published as the public key.
We show that the key-generation procedure does not instantiate a
general lattice isomorphism problem. The reduced reference basis is
generated through a public chain of computations: public parameters
determine frozen sets, the frozen sets determine a polar-code chain,
the code chain determines a Construction-D basis, and the basis is
then reduced by the public LLL procedure. Under the natural executable interpretation of the specification, an adversary can reproduce the
same reduced basis.
If the public key is
\ensuremath{B_{\mathsf{pk}}=O B_{\mathsf{red}}},
the secret orthogonal matrix is recovered by the single linear-algebra operation
$$
O=B_{\mathsf{pk}}B_{\mathsf{red}}^{-1}.
$$
The attack is polynomial time and recovers the exact secret isometry,
or its numerical representation, without solving a shortest-vector
problem or a general lattice isomorphism problem.
We also examine the erasure parameter used by the frozen-set selection algorithm. The specification neither assigns it a concrete value nor
defines it as a sampled secret with a distribution, encoding, entropy requirement, or storage mechanism. Treating this unspecified value or unspecified LLL tie-breaking as secret entropy would define a different
scheme and would not repair the published construction.
The present paper focuses on this direct basis-alignment weakness.
Additional structural and correctness analyses are left to an extended
version.
## 2026/2212
* Title: Hidden-Bits Generators with Succinct CRS and Openings
* Authors: Pedro Branco, Nico D||ttling, Yao-Ching Hsieh, Abhishek Jain, Akshayaram Srinivasan, Brent Waters
* [Permalink](https://eprint.iacr.org/2026/2212)
* [Download](https://eprint.iacr.org/2026/2212.pdf)
### Abstract
Feige, Lapidot, and Shamir [FOCS'90] presented a generic approach for building non-interactive zero-knowledge proofs via the notion of hidden-bits generators (HBGs). At a high level, an HBG allows a prover to statistically commit to a $k$-bit pseudorandom string in the CRS model with a succinct commitment. Later, the prover can open this pseudorandom string at an arbitrary subset $S \subseteq [k]$ of positions by providing a proof $\pi_S$. The hiding property requires that unopened positions remain pseudorandom.
In this work, we study the efficiency of HBGs, focusing on direct constructions that make black-box use of cryptography. We obtain the following results:
Succinct CRS: Assuming learning with errors (LWE), we construct an HBG with {\em succinct} CRS of size $\mathsf{poly}(\lambda,\log k)$ for generating $k$ hidden bits. This achieves an exponential improvement over a recent sequence of works by Waters [STOC'24], Branco et al.~[EUROCRYPT'25], and Waters, Wee, Wu~[EUROCRYPT'25] that required a CRS of size at least $k \cdot \mathsf{poly}(\lambda)$.
Batch opening: Using pairings, we construct an HBG with batch opening, where the proof size for any subset is $ \mathsf{poly}(\lambda)$. Previously, this was only known from the Naccache-Stern public-key cryptosystem [Groth, ASIACRYPT'10].
Succinct CRS and Batch opening: Assuming the hardness of RSA, we construct an HBG where both the CRS and the opening proof for any subset are of size $ \mathsf{poly}(\lambda,\log k)$. No black-box constructions achieving this efficiency were previously known.
## 2026/2213
* Title: Practical Attacks Against EALPN Using Belief Propagation
* Authors: Pierre Galissant, Guilhem Jazeron, L|-o Perrin
* [Permalink](https://eprint.iacr.org/2026/2213)
* [Download](https://eprint.iacr.org/2026/2213.pdf)
### Abstract
Weak and shallow pseudo random functions form a new class of symmetric primitives that is seeing a growing relevance, from their use in the initialization phase of some MPC protocols to the internals of some FHE-based protocols. However, their security is hard to ensure: "weak" means that chosen plaintext attacks are irrelevant, and "shallow" means that their construction cannot be round-based: in this exotic setting, how can we define secure PRFs?
In this paper, we investigate EALPN, a recent proposal of this type. We identify critical blind spots in the initial asymptotic analysis of the designers: the role of l, one of its parameters, turns out to be crucial. Indeed, we present a key recovery attack with a complexity that is polynomial in all other parameters, and whose complexity grows exponentially but still slowly with l. As a consequence, some parametrizations intended to provide 128 bits of security only offer 37 bits. Our attack is based on novel use of the belief propagation algorithm. Our analysis of its efficiency in our specific setting can be of independent interest.
## 2026/2214
* Title: Communication Preserving SFE from Obfuscation
* Authors: Omkant Pandey, Christopher Smith, Yuhao Tang
* [Permalink](https://eprint.iacr.org/2026/2214)
* [Download](https://eprint.iacr.org/2026/2214.pdf)
### Abstract
The communication complexity of computing a function in the two party setting can be much smaller than requiring one of the parties to send its input. We revisit how this communication complexity must change if the function must be computed securely.
Hub|i-iek and Wichs show that any protocol for computing a function
securely must communicate at least as many bits as the length of the function's output. However, all positive results in this direction require much more communication than optimal. In particular, the state of the art for general protocols requires a $\textit{multiplicative}$ overhead polynomial in the security
parameter, achieving only ''rate 0'' asymptotically.
We show that, assuming the existence of input-succinct
indistinguishability obfuscation for Turing machines, it is possible to achieve constant rate for this task. This compiler works even when the original protocol
communicates single bits in each round, which is the main obstacle in prior works, and necessitates the use of obfuscation. The compiler can be based on standard non-succinct indistinguishability obfuscation for circuits (instead of Turing machines) in the common random string or random oracle models.
## 2026/2215
* Title: Quantum security analysis of unrestricted isogeny-based group actions * Authors: Xavier Bonnetain, Max Duparc, Dania Lazzarini, Luciano Maino, Chloe Martindale, Christophe Petit, Sina Schaeffler, Andr|- Schrottenloher, Alessandro Sferlazza
* [Permalink](https://eprint.iacr.org/2026/2215)
* [Download](https://eprint.iacr.org/2026/2215.pdf)
### Abstract
Setting concrete parameters for group action based cryptographic protocols is notoriously difficult due to the incomplete understanding of the concrete efficiency of Kuperberg's subexponential quantum attack. Estimates for the CSIDH group action do exist in the literature, but they do not easily translate into meaningful estimates for the many recent and far more efficient alternative group actions.
In this paper, we implement the recent qt-Pegasis group action framework as a (simulated) quantum circuit, allowing for concrete estimation of its efficiency and Kuperberg's attack. Our results suggest that using a 2048-bit base field in qt-Pegasis offers reasonable quantum security, while a 4096-bit base field is required to reach NIST security level 1.
## 2026/2216
* Title: On the Multi-User Security of CSI-FiSh with Tight Reductions
* Authors: Seunghoon Lee, Maher Mamah, Bruno Sterner
* [Permalink](https://eprint.iacr.org/2026/2216)
* [Download](https://eprint.iacr.org/2026/2216.pdf)
### Abstract
The security of isogeny-based signatures is almost exclusively studied in the single-user setting, leaving a gap for realistic multi-user deployments. This gap is especially crucial for CSI-FiSh, where the small challenge space and parameter sensitivity directly impacts security estimates. We address the multi-user security of CSI-FiSh and obtain tight concrete classical multi-user bounds in the random-oracle model (ROM) plus generic group-action model (GGAM). Crucially, our analysis only incurs an additive degradation in the number of users rather than a multiplicative one. As a byproduct, we show that CSI-FiSh attains $125$ bits of provable classical security even with $2^{46}$ users. We extend this analysis to preprocessing attacks, where an adversary with nation-state resources can perform offline precomputations. We capture this by extending the preprocessing security framework of Coretti et al. to ROM+GGAM and obtain concrete multi-user bounds for CSI-FiSh with preprocessing. Finally, we address the multi-user security of CSI-FiSh in the quantum random-oracle model and obtain results in the algebraic group action model which also avoids this multiplicative loss. This gives a unified concrete security treatment of plain CSI-FiSh in the deployment regimes where multi-user and preprocessing effects are unavoidable.
## 2026/2217
* Title: Interactive Proofs of Proximity for Model Evaluation
* Authors: Geoffroy Couteau, Nikolas Melissaris, Tamara Paris
* [Permalink](https://eprint.iacr.org/2026/2217)
* [Download](https://eprint.iacr.org/2026/2217.pdf)
### Abstract
We study interactive proofs of proximity (IPP) for model evaluation: a resource-limited verifier interacts with an untrusted prover, typically the model owner, to certify statistical properties of a model under an unknown input distribution. Our formulation is shaped by the constraints of practical evaluation: it separates sampling the input distribution from querying the model and evaluating its output, allowing their costs and access patterns to be treated independently; it distinguishes real audit data (black-box sampling) from generated data (chosen-randomness, or gray-box, access to the sampler); and it allows the prover and the verifier to score outputs with different evaluators, as happens when scores come from human or judge models. We focus on doubly-sublinear $\mathsf{IPP}$s, in which both the verifier and the designated honest prover use sublinear resources, and on (weighted) Hamming weight properties, which capture the expectation of a Boolean evaluation rule under an unknown distribution and, consequently, a broad range of model-evaluation statistics.
As a first step, we give a tolerant $\mathsf{dsIPP}$ for ordinary Hamming weight. For completeness and soundness radii $\varepsilon_c <\varepsilon_f$ and gap $g=\varepsilon_f-\varepsilon_c$, its logarithmic-round instantiation uses $\tilde{O}(1/g)$ verifier queries and $O(1/g^2)$ honest-prover queries, improving the cubic dependence of Amir, Goldreich, and Rothblum [ITCS 2025]. We prove matching query lower bounds up to polylogarithmic factors.
We then study distribution-weighted Hamming weight under several access models. Under black-box sampling, the verifier uses $\Theta(1/g^2)$ samples but only $\tilde{O}(1/g)$ evaluations, and we show that the quadratic sample complexity is necessary in the interior regime. With chosen-randomness access to a sampler, the problem reduces to ordinary Hamming weight, giving $\tilde{O}(1/g)$ verifier calls and evaluations. When the two parties' evaluators may disagree arbitrarily on a $\rho$-fraction of the distribution and by up to $\gamma$ elsewhere, we give protocols that remain doubly sublinear whenever $g$ exceeds twice the mean mismatch $\kappa = \rho + (1-\rho)\gamma$. Finally, we show how our technical results can improve the efficiency of model evaluation in natural motivating scenarios by shifting the bulk of the evaluation burden to the model owner while letting any number of auditors verify claims cheaply; we apply them to auditing criteria including accuracy, group fairness, calibration, harmlessness, usefulness, and average-case robustness.
## 2026/2218
* Title: Codetta: High-Capacity, Keyless, and Undetectable Multi-Agent Collusion
* Authors: Qi Pang, Virginia Smith, Wenting Zheng
* [Permalink](https://eprint.iacr.org/2026/2218)
* [Download](https://eprint.iacr.org/2026/2218.pdf)
### Abstract
Multi-agent systems built on large language models (LLMs) are increasingly being deployed in high-stakes settings such as finance, healthcare, and software engineering, where agents coordinate through natural-language messages. These same communication channels, however, can also enable colluding agents to exfiltrate confidential information or coordinate unauthorized actions. Steganography makes such behavior particularly difficult to detect by hiding covert communication within outputs that appear ordinary to an auditor reading the transcript.
Existing provably undetectable LLM steganography protocols, however, are not suited to realistic deployments. High-capacity schemes typically assume a symmetric setting where the receiver can reproduce the sender's output distribution. The state-of-the-art practical protocol for asymmetric agents has very low capacity. Additionally, most existing approaches rely on a pre-shared secret key.
In this paper, we make the systematic threat of undetectable agent collusion concrete by proposing Codetta, a high-capacity steganographic protocol for independently deployed agents under realistic asymmetric settings. Codetta combines a shared public model for estimating the communication channel, a sampling mechanism that preserves the sender's output distribution, and an adaptive error-correcting code for high-capacity communication. It further removes the need for a pre-shared secret key through a steganographic key-exchange protocol, enabling independently deployed agents to establish a shared key while keeping their communication transcript computationally indistinguishable from ordinary model outputs.
Across three agent workloads and three sender models, Codetta achieves up to $94\times$ the capacity of the state-of-the-art asymmetric protocol. Its key exchange establishes a shared key using approximately 80k visible tokens, with an empirically certified failure probability of at most $4.1\times10^{-3}$ across all three workloads.
These results show that effectively undetectable collusion is becoming feasible even between independently deployed agents, and we suggest that auditing mechanisms must be amended with complementary techniques beyond simply inspecting agents' communication transcripts.
## 2026/2219
* Title: Incrementally Verifiable Computation without Extraction
* Authors: Abhishek Jain, Surya Mathialagan, Brent Waters
* [Permalink](https://eprint.iacr.org/2026/2219)
* [Download](https://eprint.iacr.org/2026/2219.pdf)
### Abstract
Incrementally verifiable computation (IVC) [Valiant, TCC '08] allows one to iteratively prove that a configuration $x_0$ reaches a configuration $x_T$ via $T$ repeated applications of a (possibly non-deterministic) machine $\mathcal{M}$. An IVC scheme is fully succinct if the proof size is independent of both $T$ and the size of the intermediate configurations.
In this work, we develop a new indistinguishability obfuscation ($i\mathcal{O}$)-based approach to IVC that avoids the extraction-based security analyses central to prior constructions. Assuming subexponential hardness of $i\mathcal{O}$ and one-way functions, we construct an adaptively sound fully succinct IVC scheme for deterministic computations. This yields the first IVC for deterministic computations that does not rely on algebraic assumptions.
Under the same assumptions, we further obtain a fully succinct two-hop IVC scheme for $\mathsf{NP}$ with non-adaptive soundness, allowing one to prove that $x_0$ reaches $x_2$ via an intermediate configuration $x_1$. This is the first IVC scheme for $\mathsf{NP}$ achieving full succinctness.
Our constructions are based on a new connection between IVC and secret sharing for $s$-$t$ connectivity in graphs.
## 2026/2220
* Title: Threshold Key Encapsulation Mechanisms via MPC: ML-KEM Compatibility and Optimization
* Authors: The-Anh Ta, Dongxi Liu, Sid Chau, Jiafan Wang
* [Permalink](https://eprint.iacr.org/2026/2220)
* [Download](https://eprint.iacr.org/2026/2220.pdf)
### Abstract
There is currently a strong interest in designing standard-compatible threshold cryptographic primitives, a trend bolstered by NIST's Call for Multi-Party Threshold Schemes (NIST IR 8214C). While Multi-Party Computation (MPC) can be applied to the construction of threshold Key Encapsulation Mechanism (KEM) from NIST standard ML-KEM scheme to preserve the compatibility with ML-KEM, such a direct construction yields a high number of threshold decapsulation rounds as many as 384 for MK-KEM-512. In this paper, we optimise the round complexity of MPC-based threshold ML-KEM decapsulation. Our first construction (Scheme A) uses masked predicates, parallel coin expansion and global scheduling methods to improve the round complexity of MPC-based ML-KEM decapsulation, while maintaining ML-KEM encapsulation, public key and ciphertext formats. For ML-KEM-512, 768 and 1024, our construction improves the round complexity to 145, 218, and 290, respectively. We also introduce a variant (Scheme B) that uses an MPC-friendly variant of Kyber KEM and KangarooTwelve hash to further improve the round complexity to $35$ at the security level of ML-KEM-512, without full ML-KEM compatibility. In the semi-honest MPC model, we prove Scheme A security by exact composition with ML-KEM, and Scheme B IND-CCA security in the QROM from Module-LWE and negligible decryption failure.
## 2026/2221
* Title: Dimension-4 SQIsign at Round-3 Parameters: Sizes and Costs of the Compact Format
* Authors: Dustin Ray
* [Permalink](https://eprint.iacr.org/2026/2221)
* [Download](https://eprint.iacr.org/2026/2221.pdf)
### Abstract
SQIsign holds the smallest known combination among post-quantum signatures, and its dimension-2 signature carries an auxiliary curve whose only role is to make the response computable in dimension 2. SQIsignHD's dimension-4 response has no such curve. We take that construction to the round-3 SQIsign primes, which replaced the round-2 primes in September 2026 after the attacks of Wesolowski and others, on our Rust port of the SQIsign reference code, and measure it in one session next to the reference's own assembly build. At NIST level I the dimension-4 signature is 142 bytes against 200 for the specification's format, with an 84-byte public key: 226 bytes for key and signature together, the smallest level-I combination we are aware of, among isogeny schemes and post-quantum signatures alike, at parameters that stand after those attacks. The price is verification: the dimension-4 verifier costs 9.9 times the dimension-2 verifier of the same code (120.3 against 12.2 megacycles). The dimension-4 parameters published with SQIsignHD are for its authors' own primes; we derive them for the round-3 primes, state which choices are SQIsignHD's and which are ours, and report what was built and measured.
## 2026/2222
* Title: SoK: The Landscape of Post-Quantum Multi-Party Signature Aggregation
* Authors: Gaurav Kumar
* [Permalink](https://eprint.iacr.org/2026/2222)
* [Download](https://eprint.iacr.org/2026/2222.pdf)
### Abstract
Post-quantum signature schemes such as ML-DSA, FN-DSA
(Falcon), and SLH-DSA have significantly larger keys and signatures
than their classical counterparts, making compact multiparty signing
an increasingly important research problem. We survey more than 30
schemes published between 2021 and 2026, covering threshold and dis
tributed signing, proof-based aggregation, and algebraic half-aggregation.
Our survey shows that most existing work is designed around blockchain
and validator-consensus applications, where large numbers of mostly ho mogeneous signers sign a common message and accountability is typically represented by a compact signer set.
We found that a different and practically important setting has received
little attention: institutional multiparty document signing, where tens to hundreds of signers may use different post-quantum schemes or parame
ter sets during a gradual migration, while requiring non-interactive sign
ing and exact per-signer accountability. To study this gap, we develop an eight-dimensional taxonomy based on deployment requirements and sys
tematically classify existing approaches. We also formulate three testable hypotheses and propose a common benchmark methodology for evalu
ating communication, computation, verification cost, scalability, signer heterogeneity, and accountability. Our analysis finds no published study
that quantitatively evaluates the institutional workload across the ag gregation paradigms covered in our survey. We therefore identify the key experimental and architectural requirements for assessing whether ex
isting post-quantum aggregation techniques can support heterogeneous, accountable, and non-interactive institutional signing.
## 2026/2223
* Title: Linear Key Recovery in the BAG-Loong Reference Implementation
* Authors: Zihan Liu
* [Permalink](https://eprint.iacr.org/2026/2223)
* [Download](https://eprint.iacr.org/2026/2223.pdf)
### Abstract
The BAG-Loong reference implementation samples its secret matrices X and Y from fixed, publicly known subspaces, although the specification calls for secret random supports.
This makes the public-key relation S = HX + Y , with public H, amenable to Gaussian
elimination. Expanding the relation over F2 and projecting away the support of Y leaves a
linear system for X. We prove an exact recovery criterion based on its column rank. All
40 supplied known-answer-test records, covering four parameter sets, satisfy this criterion:
two independent solvers recover each X exactly, and the unmodified decapsulation code
reproduces the corresponding session keys. For the largest parameter set, the reduced system
has 9360 equations in 728 unknowns per column; one elimination solves all 15 columns.
## 2026/2224
* Title: The Tower of Babel: Large Language Models for Side-channel Analysis
* Authors: Iris Dania Jimenez, Stjepan Picek, Michael Hutter
* [Permalink](https://eprint.iacr.org/2026/2224)
* [Download](https://eprint.iacr.org/2026/2224.pdf)
### Abstract
Deep learning-based side-channel analysis (DLSCA) is dominated by CNNs and from-scratch Transformer architectures, while pretrained Large Language Models (LLMs) as side-channel distinguishers remain largely unexplored. We present the first systematic study of seven off-the-shelf pretrained LLMs (DeepSeek, Falcon, GPT-J, GPT-2, GPT-2m, Qwen2, T5) on three masked AES datasets, i.e., ASCADf, ASCADv, and eShard. With lightweight fine-tuning and no architectural redesign of the backbone, Falcon and GPT-2m reach GE=1 on ASCADf in only 12 to 16 traces (16, 12 and 12 traces for Falcon and 15, 14 and 13 for GPT-2m on desync0, desync50 and desync100) and uniquely sustain this trace count under desynchronization, an order of magnitude below the best prior desynchronized results. The strongest reported alternatives, EstraNet (13 traces) and Order-vs-Chaos (1 trace), are bespoke architectures trained from scratch and report only synchronized results, while other CNN- and Transformer-based baselines degrade substantially under desynchronization. The pretrained LLMs additionally extract exploitable leakage from all 16 first-round AES key bytes, the first such result outside of multi-task CNNs trained from scratch. We further provide the first per-share evaluation and the first interpretability analysis of LLM-based SCA using Effective Perceived Information (EPI), revealing a correlation between the models' leakage extraction capability and their attack performance. Strikingly, randomly initialized backbones perform on par with their pretrained counterparts, indicating that much of the advantage is architectural rather than derived from language pretraining. Our findings establish LLM architectures as unexpectedly powerful, robust, and reusable side-channel distinguishers whose inductive bias yields very low trace complexity and strong robustness to desynchronization.
## 2026/2225
* Title: Breaking the G\'omez-Torrecillas--Lobillo--Navarro Cryptosystem: LLL Recovers the Secret Key Within Seconds
* Authors: Abul Kalam, Santanu Sarkar
* [Permalink](https://eprint.iacr.org/2026/2225)
* [Download](https://eprint.iacr.org/2026/2225.pdf)
### Abstract
We present a key-recovery attack on the knapsack McEliece-based public key cryptosystem recently proposed by G\'omez-Torrecillas, Lobillo, and Navarro in DCC 2026. Given the public key alone, the attack recovers the complete private key in time polynomial in the bit-length of the public key, and therefore constitutes a total break. The attack combines two observations based solely on the public key. An integer combination of the public entries whose coefficients sum to zero eliminates the secret mask. If such a combination is also orthogonal to the public key and sufficiently short, then its coordinates are divisible by the corresponding private key integers. The modulus required for correct decryption creates a large norm gap between these short vectors satisfying the hidden private key relations and the remaining vectors in the lattice. LLL reduction exploits this gap to recover the short vectors and hence the corresponding divisibility relations. The private key integers and the remaining secret parameters are then recovered by combining information from multiple overlapping lattices and using greatest common divisors. We implemented the attack in SageMath and recovered the complete private key for all twenty four parameter sets proposed by the authors within 3 seconds, despite claimed security levels ranging from $64$ to $156$ bits. Our analysis further shows that the weakness is structural rather than a consequence of the particular parameter choices.
## 2026/2226
* Title: FALCON++: Shorter Signatures without NTRU Smoothing Estimates
* Authors: Hao Yan, Nicholas Zhao
* [Permalink](https://eprint.iacr.org/2026/2226)
* [Download](https://eprint.iacr.org/2026/2226.pdf)
### Abstract
\Falcon{} is a digital signature scheme based on NTRU lattices,
known for its compact signatures.
Its weak-smoothness variant, \FalconWS{} (ASIACRYPT 2025),
reduces signature sizes by allowing narrower Gaussian sampling distributions. Further reductions require efficient sampling at narrower widths
and a security analysis that accounts for the resulting distributions.
We analyze the distribution of accepted preimages directly, without
estimating the smoothing parameter of the NTRU lattice.
We also modify the rejection-corrected Klein--GPV sampler to reduce
sampling cost while controlling the resulting distributional error.
We combine these results to construct \FalconPP{}, a variant of
\Falcon{}, and give UF-CMA and SUF-CMA bounds in the
classical random-oracle model.
For ring degrees $512$ and $1024$, our estimates give signature
sizes of $419$ and $921$ bytes, respectively.
These are $37.09\%$ and $28.05\%$ smaller than \Falcon{} signatures,
and $11.60\%$ and $5.92\%$ smaller than the estimates for \FalconWS{}
at their respective parameter sets.
## 2026/2227
* Title: A Fiat-Shamir Transformation for Private-Coin Protocols
* Authors: Shany Ben-David, Eylon Yogev, Agni Datta
* [Permalink](https://eprint.iacr.org/2026/2227)
* [Download](https://eprint.iacr.org/2026/2227.pdf)
### Abstract
The Fiat--Shamir transformation is a fundamental paradigm in cryptography for compiling interactive public-coin protocols into non-interactive arguments. While this transformation has been extensively studied for public-coin protocols, the setting of private-coin protocols, where the verifier's messages depend on secret randomness, remains largely unexplored. To date, there are no candidate transformations for private-coin protocols, neither in the standard model nor in idealized settings.
In this work, we present a generic transformation that compiles any 3-message private-coin interactive proof into a non-interactive argument in the standard model, while preserving zero-knowledge. Our construction relies on sub-exponentially secure indistinguishability obfuscation, pseudorandom functions, and input-hiding obfuscation (IHO). As a corollary, this rules out the existence of 3-message weak zero-knowledge proofs with small enough soundness error.
We complement this positive result by showing that the reliance on IHO is inherent: any secure Fiat--Shamir transformation for general private-coin protocols necessarily implies the existence of IHO.
Finally, we rule out Fiat--Shamir transformations for multi-round private-coin protocols. Specifically, assuming the existence of collision-resistant hash functions, we prove that no such transformation exists in the multi-round setting.
## 2026/2228
* Title: Adelic reduction of module lattices
* Authors: Henry Bambury, Seungki Kim, Changmin Lee, Phong Q. Nguyen
* [Permalink](https://eprint.iacr.org/2026/2228)
* [Download](https://eprint.iacr.org/2026/2228.pdf)
### Abstract
We give a strict generalization of the LLL algorithm over number fields, based on the reduction theory of $\mathrm{GL}(n)$ over the adele ring of a number field. Our algorithm is free of heuristics, with rigorous bounds on output quality and complexity. As a consequence, we obtain a hierarchy of reductions from module-(H)SVP to ideal-HSVP, an example of which has runtime and approximation factors subexponential in the field degree. More importantly, we uncover a close connection between structured lattice reduction and a Diophantine approximation over number fields.
## 2026/2229
* Title: Local Rewriting under Assumed Erasure
* Authors: Napassorn Litchiowong
* [Permalink](https://eprint.iacr.org/2026/2229)
* [Download](https://eprint.iacr.org/2026/2229.pdf)
### Abstract
We study local rewriting after an assumed erasure step in an ideal oblivious-transfer protocol. Bob transforms his retained record while Alice's actual record remains fixed. Exact rewriting between shared-source and independent-source records is possible in both directions precisely when the retained records of the shared source are independent. For balanced deterministic maps retaining $k$ and $\ell$ bits from an $n$-bit source, the optimal error over the maps is $\max\{0,1-2^{n-k-\ell}\}$. For fixed full-row-rank linear maps, it is $1-2^{-d}$, where $d$ is their row-space intersection dimension. A nonlinear example shows that an optimal approximate rewrite may change Bob's marginal distribution.
## 2026/2230
* Title: Indistinguishability of Sum of Permutations: A Fourier Analytic Route to Classical and Quantum Security
* Authors: Ritam Bhaumik, Chun Guo, Xiaoning Guo, Ashwin Jha
* [Permalink](https://eprint.iacr.org/2026/2230)
* [Download](https://eprint.iacr.org/2026/2230.pdf)
### Abstract
We study classical and quantum indistinguishability of sums of independent random permutations and related transformations from permutations to functions. Let $G$ be a finite abelian group of order $N$, and let $\pi^k_+(x)=\pi_1(x)+\cdots+\pi_k(x)$ for $k\geq2$ independent uniform random permutations of $G$. We give a unified Fourier analytic treatment in which the construction is represented by its probability density and a distinguisher by its acceptance function, with the classical and quantum query models imposing different restrictions on the Fourier support of the latter.
Classically, we obtain the bound $O_k(q/N^{k-1/2})$ for every $q<N$, and refine it below the birthday threshold to $O_k(q^2/N^k)$. In the quantum model, a simulation argument gives $O_k(N^{-(k-3/2)})$ for $q\leq(N-1)/2$, while Fourier interpolation gives concrete finite bounds up to $q\leq4N/15$ and the query-dependent bounds
\[
O\!\left(\min\left\{N^{-1/2},\frac{q^3}{N^2}+\frac1N\right\}\right),
\qquad
O_k\!\left(\min\left\{\frac{q^3}{N^k},N^{-(k-3/2)}\right\}\right),
\]
for $k=2$ and $k \geq 3$, respectively, throughout $1\leq q\leq(N-1)/2$. For $q = 1$, the first bound sharpens to $O(N^{-2})$. Over $G=\mathbb F_2^n$, a one-query Fourier attack matches the order of our one-query bound, while an $N/2$-query parity attack with advantage $1/2$ shows that our bounds reach the constant-advantage query threshold.
We further study two variants of sum of permutations over binary vector spaces. First, we allow arbitrary surjective linear postprocessing, which includes truncation, and obtain classical and quantum bounds that retain the output-size dependence. Second, we analyse Dinur's variable-output single-permutation construction, $\mathsf{LXoP}$, for every fixed output width, and derive its classical and quantum security bounds; for one- and two-block outputs, we give concrete quantum security bounds.
--- Synchronet 3.22a-Linux NewsLink 1.2