Tessera

Folgen

Boris Fouotsa

@borisfouotsa.bsky.social

Postdoc at EPFL, isogenies, and more... https://borisfouotsa.com

10 Posts114 Follower 61 Folgt

ePrint Updates @eprint.ing.bot · 3mo ago

Updatable Public-Key Encryption from FESTA (Andrea Basso, Tako Boris Fouotsa, Fatna Kouider, Péter Kutas, Luciano Maino, Laurane Marco) ia.cr/2026/1014

Abstract. Updatable public-key encryption (UPKE) is a cryptographic primitive that was proposed for secure messaging to provide forward secrecy in public-key settings. It extends standard public-key encryption with a key-update mechanism that lets anyone update a receiver’s public key and issue a corresponding token for updating the secret key. Unlike traditional forward secrecy where all past messages should remain secure after a key leakage, UPKEs guarantee security only as long as at least one honest update has occurred.
While classically-secure efficient instantiations of UPKE are known from Diffie-Hellman assumptions, constructing an UPKE scheme with updates remains an open problem. In this work, we propose an isogeny-based UPKE that relies on a dimension-four version of the FESTA public-key encryption scheme. It is practically efficient and supports an unbounded amount of updates. Moreover, we provide a formal security proof based on a problem in isogeny-based cryptography that has received considerable scrutiny.

COSIC @cosic.bsky.social · 9mo ago

Valerio Ardizio is the newest member of Frederik Vercauteren's team! "I chose COSIC because of its welcoming, inspiring, and stimulating research environment, as well as the outstanding expertise of the researchers who are part of this group." #choosecosic

@mccurley.bsky.social · 9mo ago

I spent two years building a piece of infrastructure for open access publishing in CS arxiv.org/abs/2504.10424. I've gotten positive feedback from authors, but most are quite ignorant about how publishing works (even in computer science). Thankfully we don't have to accept Microsoft Word.😁

Lowering the Cost of Diamond Open Access Journals

Many scholarly societies face challenges in adapting their publishing to an open access model where neither authors nor readers pay any fees. Some have argued that one of the main barriers is the actu...

arxiv.org

Deirdre Connolly¹ ² @durumcrustulum.com · 10mo ago

let's read some legal agreements www.youtube.com/watch?v=nmvf...

Is ML-KEM Patent-Encumbered?

YouTube video by Deirdre Connolly

youtube.com

Tibor Jager @tiborj.bsky.social · 10mo ago

The call for papers for PKC 2026 is out: pkc.iacr.org/2026/callfor...

PKC 2026 call for papers

Public Key Cryptography

pkc.iacr.org

ePrint Updates @eprint.ing.bot · 11mo ago

WaterSQI and PRISMO: Quaternion Signatures for Supersingular Isogeny Group Actions (Tako Boris Fouotsa) ia.cr/2025/1737

$Abstract. Isogeny group action based signatures are obtained from a sigma protocol with high soundness error, say $\frac{1}{2}$ for its most basic variant. One needs to independently repeat the sigma protocol O(λ) times to reduce the soundness error to negligible (with λ being the security parameter). These repetitions come with a considerable efficiency and size overhead. On the other hand, quaternion isogeny-based signatures such as SQIsign and PRISM are directly obtained from a sigma protocol with a negligible soundness error. The secret key in the SQIsign and PRISM is a random supersingular isogeny, and both schemes are insecure when the secret isogeny arises from the supersingular isogeny group action setting. In this paper, we propose WaterSQI and PRISMO, variants of SQIsign and PRISM respectively, suited for secret isogenies that arise from the supersingular isogeny group action setting. They use a sigma protocol whose soundness error is negligible without requiring parallel repetitions. They are hence more compact and O(λ) times more efficient compared to Generalised CSI-FiSh (the generalisation of CSI-FiSh to large parameters using generic isogeny group action evaluation algorithms such as Clapotis/KLaPoTi/PEGASIS). For example, for our proof of concept implementation with a 2000 bits prime in sagemath, PRISMO, when compared to Generalised CSI-FiSh with the same public key size, is about 3x faster for key generation, 273x faster for signing and 4900x faster for verification, while also being 29x more compact (signature size).$ Image showing part 2 of abstract.

Boris Fouotsa @borisfouotsa.bsky.social · 11mo ago

Quaternion signatures for isogeny group actions: showing how to adapt SQIsign and PRISM to the group actions setting, unleashing WaterSQI and PRISMO signatures that come with a tremendous speed-up over CSI-FiSh style signatures.

ePrint Updates@eprint.ing.bot · 11mo ago

WaterSQI and PRISMO: Quaternion Signatures for Supersingular Isogeny Group Actions (Tako Boris Fouotsa) ia.cr/2025/1737

Sofia Celi @claucece.bsky.social · last yr.

Come to the ASCrypto school, affiliated with Latincrypt2025! 🗓️ Sept 29–30 | Medellín, Colombia 👨‍🏫 Learn 𝐦𝐨𝐝𝐞𝐫𝐧 𝐩𝐫𝐨𝐯𝐢𝐧𝐠 𝐬𝐲𝐬𝐭𝐞𝐦𝐬 from top experts 💥 2 days, 3 modules: IVC, STARKs, MPC 👥 With Benedikt Bünz, Sophia Yakoubov, Alan Szepieniec Organised by the amazing Arantxa Zapico and Javier Verbel.

COSIC @cosic.bsky.social · last yr.

Registration for the Leuven Isogeny Days 6 is now open! 📅 10–12 Sept 2025 @ KU Leuven Morning: research talks Afternoon: brainstorming sessions More info: www.esat.kuleuven.be/cosic/projec... #isogeny #isocrypt #erc #postquantum

Boris Fouotsa @borisfouotsa.bsky.social · last yr.

AFRICACRYPT'25 accepted papers (africacrypt2025.sciencesconf.org/resource/page/…) & invited speakers (https://africacrypt2025.sciencesconf.org/resource/page/id/11) are online. Early registration deadline is May 30th (africacrypt2025.sciencesconf.org/resource/page/��). See you in Rabat 🇲🇦 in July! 😉

Boris Fouotsa @borisfouotsa.bsky.social · last yr.

Isogenies @ Eurocrypt 2025 in Madrid!

Luca De Feo @bsky.defeo.lu · last yr.

The SQIparty starts on Monday, but it's still time to register! We prepared an exciting program for you with a balanced mix of talks, coding sprints, skillshares and other activities! www.cig.udl.cat/SQIparty2025... See you in Lleida!

Luca De Feo@bsky.defeo.lu · last yr.

Fancy some isogeny crypto? Join us for a 3-day workshop on isogeny-based cryptography in Lleida, Catalonia, April 28-30 www.cig.udl.cat/icrypto2025_... Brought to you by ULleida's Cryptography+Graphs group, the SQIsign team and friends! Registration and program coming soon Registration is free!

Maria Corte-Real Santos @maria.isogeny.club · last yr.

Good news is that we're still accepting brainstorm topics!! If you have a brainstorm idea, send us a short description by email !

Maria Corte-Real Santos @maria.isogeny.club · last yr.

Season 6 of the Isogeny Club is officially done! You can catch up with all the talks here: isogeny.club If, like us, you haven't had enough isogenies for the term, be sure to join us at the Brainstorm Sessions affiliated with Eurocrypt: isogeny.club/eurocrypt

The Isogeny Club

isogeny.club

Nigel Smart @smartcryptology.bsky.social · last yr.

Congratulations to the new IACR fellows.... Joan Daemen, Thomas Johansson, Anna Lysyanskaya, Pascal Paillier, J.R. Rao, Alon Rosen, Elaine Shi, Bo-Yin Yang. iacr.org/fellows/ #cryptography

IACR Fellows

iacr.org

Boris Fouotsa @borisfouotsa.bsky.social · last yr.

Higher dimensions everywhere ! #isogenies

Luca De Feo @bsky.defeo.lu · last yr.

Registration to the SQIparty is open, free, and we have a first sketch of a program! www.cig.udl.cat/SQIparty2025... Register and plan your travel quickly: the rooms are reserved only until Thursday! See you in Lleida!

Luca De Feo@bsky.defeo.lu · last yr.

Boris Fouotsa @borisfouotsa.bsky.social · last yr.

It saddens to spend time reviewing a paper, then to neither be able to see the other reviews nor take part in the discussion on that paper! Program Chairs should always enable this (and choose a reviewing platform that allows them to).

Martin R. Albrecht @malb.bsky.social · last yr.

Update on crypto.iacr.org/2025/

Given recent instances of US visa holders and residents being detained or deported by US immigration authorities, we understand that some members of our community may not feel safe traveling to the US for Crypto this year. We want to assure everyone that we will provide the option to present and attend remotely.

Krijn Reijnders @krijn.isogeni.es · last yr.

> claims no new results > adds in a tiny new result anyway > ??? anyway, enjoy the read!

ePrint Updates@eprint.ing.bot · last yr.

A Note on the Advanced Use of the Tate Pairing (Krijn Reijnders) ia.cr/2025/477

Abstract. This short note explains how the Tate pairing can be used to efficiently sample torsion points with precise requirements, and other applications. These applications are most clearly explained on Montgomery curves, using the Tate pairing of degree 2, but hold more generally for any degree or abelian variety, or even generalized Tate pairings. This note is explanatory in nature; it does not contain new results, but aims to provide a clear and concise explanation of results in the literature that are somewhat hidden, yet are extremely useful in practical isogeny-based cryptography.

Andrea Basso @andreavbasso.bsky.social · last yr.

This workshop is gonna be great: cool people, interesting talks, and lots of great research on SQIsign and isogeny-based crypto. Mark it in your calendars! And if you’re going to Eurocrypt, this is going to be convenient: the workshop is just the week before, and it’s not too far from Madrid

Luca De Feo@bsky.defeo.lu · last yr.

Nigel Smart @smartcryptology.bsky.social · last yr.

Looking forward to speaking at this event. Come and enjoy an autumn day in Rome talking #cryptography.... www.decifris.it/fcir25

Financial Cryptography in Rome 2025

L'associazione De Componendis Cifris si propone di animare la comunità crittografica italiana, favorendo lo studio, la ricerca e la divulgazione della crittografia.

decifris.it

Luca De Feo @bsky.defeo.lu · last yr.

Ignacio Cascudo @icascudo.bsky.social · last yr.

Registration for Eurocrypt 2025 is open!! Register at eurocrypt.iacr.org/2025/registr... Early bird registration deadline is 4th of April. Note that registration will be temporarily closed between the 29th and the 31st of March, and we'll have to cancel previous invoices left unpaid by March 30th.

Luca De Feo @bsky.defeo.lu · last yr.

And why not pair that with an isogeny workshop in Catalonia just before? bsky.app/profile/bsky...

Luca De Feo@bsky.defeo.lu · last yr.

ePrint Updates @eprint.ing.bot · last yr.

A Note on Zero-Knowledge Simulator of the CROSS Identification Protocol (Shai Levin) ia.cr/2025/359

Abstract. We point out flaw in zero-knowledge of the CROSS identification protocol, CROSS-ID, which allows a distinguisher to distinguish real and simulated transcripts given access to the witness. Moreover, we show that the real and simulated transcripts are not statistically indistinguishable, and therefore the protocol can only satisfy weak computational (rather than strong, statistical or perfect) Honest Verifier Zero-knowledge. This issue is still present in version 2.0 updated on January 31, 2025, which resolves the security losses attained via the attacks of [BLP+25]

ePrint Updates @eprint.ing.bot · last yr.

KLPT²: Algebraic Pathfinding in Dimension Two and Applications (Wouter Castryck, Thomas Decru, Péter Kutas, Abel Laval, Christophe Petit, Yan Bo Ti) ia.cr/2025/372

$Abstract. Following Ibukiyama, Katsura and Oort, all principally polarized superspecial abelian surfaces over $\overline{\mathbb{F}}_p$ can be represented by a certain type of 2 × 2 matrix g, having entries in the quaternion algebra B_(p, ∞). We present a heuristic polynomial-time algorithm which, upon input of two such matrices g₁, g₂, finds a “connecting matrix” representing a polarized isogeny of smooth degree between the corresponding surfaces. Our algorithm should be thought of as a two-dimensional analog of the KLPT algorithm from 2014 due to Kohel, Lauter, Petit and Tignol for finding a connecting ideal of smooth norm between two given maximal orders in B_(p, ∞). The KLPT algorithm has proven to be a versatile tool in isogeny-based cryptography, and our analog has similar applications; we discuss two of them in detail. First, we show that it yields a polynomial-time solution to a two-dimensional analog of the so-called constructive Deuring correspondence: given a matrix g representing a superspecial principally polarized abelian surface, realize the latter as the Jacobian of a genus-2 curve (or, exceptionally, as the product of two elliptic curves if it concerns a product polarization). Second, we show that, modulo a plausible assumption, Charles-Goren-Lauter style hash functions from superspecial principally polarized abelian surfaces require a trusted set-up. Concretely, if the matrix g associated with the starting surface is known then collisions can be produced in polynomial time. We deem it plausible that all currently known methods for generating a starting surface indeed reveal the corresponding matrix. As an auxiliary tool, we present an explicit table for converting (2,2)-isogenies into the corresponding connecting matrix, a step for which a previous method by Chu required super-polynomial (but sub-exponential) time.$ Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · last yr.

A Complete Security Proof of SQIsign (Marius A. Aardal, Andrea Basso, Luca De Feo, Sikhar Patranabis, Benjamin Wesolowski) ia.cr/2025/379

Abstract. SQIsign is the leading digital signature from isogenies. Despite the many improvements that have appeared in the literature, all its recents variants lack a complete security proof. In this work, we provide the first full security proof of SQIsign, as submitted to the second round of NIST’s on-ramp track for digital signatures.

To do so, we introduce a new framework, which we call Fiat-Shamir with hints, that captures all those protocols where the simulator needs additional information to simulate a transcript. Using this framework, we show that SQIsign is EUF-CMA secure in the ROM, assuming the hardness of the One Endomorphism problem with hints, or the hardness of the Full Endomorphism Ring problem with hints together with a hint indistinguishability assumption; all assumptions, unlike previous ones in the literature, are non-interactive. Along the way, we prove several intermediate results that may be of independent interest.

Andrea Basso @andreavbasso.bsky.social · last yr.

As part of the round-2 NIST submission, we developed a complete proof of security of SQIsign!

ePrint Updates@eprint.ing.bot · last yr.

A Complete Security Proof of SQIsign (Marius A. Aardal, Andrea Basso, Luca De Feo, Sikhar Patranabis, Benjamin Wesolowski) ia.cr/2025/379

Jonathan Komada Eriksen @jonathan.isogeny.club · last yr.

At the right level pf abstraction, we present an effective group action: Its so efficient, that frob is sufficient; another win for the isogeny-faction! 🥳

ePrint Updates@eprint.ing.bot · last yr.

PEGASIS: Practical Effective Class Group Action using 4-Dimensional Isogenies (Pierrick Dartois, Jonathan Komada Eriksen, Tako Boris Fouotsa, Arthur Herlédan Le Merdy, Riccardo Invernizzi, Damien Robert, Ryan Rueger, Frederik Vercauteren, Benjamin Wesolowski) ia.cr/2025/401

Abstract. In this paper, we present the first practical algorithm to compute an effective group action of the class group of any imaginary quadratic order 𝒪 on a set of supersingular elliptic curves primitively oriented by 𝒪. Effective means that we can act with any element of the class group directly, and are not restricted to acting by products of ideals of small norm, as for instance in CSIDH. Such restricted effective group actions often hamper cryptographic constructions, e.g. in signature or MPC protocols.

Our algorithm is a refinement of the Clapoti approach by Page and Robert, and uses 4-dimensional isogenies. As such, it runs in polynomial time, does not require the computation of the structure of the class group, nor expensive lattice reductions, and our refinements allows it to be instantiated with the orientation given by the Frobenius endomorphism. This makes the algorithm practical even at security levels as high as CSIDH-4096. Our implementation in SageMath takes 1.5s to compute a group action at the CSIDH-512 security level, 21s at CSIDH-2048 level and around 2 minutes at the CSIDH-4096 level. This marks the first instantiation of an effective cryptographic group action at such high security levels. For comparison, the recent KLaPoTi approach requires around 200s at the CSIDH-512 level in SageMath and 2.5s in Rust.