Tessera

ePrint Updates

@eprint.ing.bot

Unofficial bot tracking the IACR Cryptology ePrint Archive (eprint.iacr.org). Maintained by @str4d.xyz. Currently only posts about new papers. Author names are linkified to Bluesky accounts (cryptography.social); contact maintainer for inclusion/removal.

7382 Posts1196 Follower 1 Folgt

ePrint Updates @eprint.ing.bot · 2d ago

Solving the Shortest Vector Problem in 2^(0.7314n + o(n)) Time via Discrete Gaussian Sampling on Superlattices (Yiming Gao, Yansong Feng, Honggang Hu) ia.cr/2026/1587

Abstract. We give a classical randomized algorithm for the exact Euclidean Shortest Vector Problem (SVP) on arbitrary full-rank lattices. It runs in 2^(0.7314n + o(n)) time and2^(n/2 + o(n)) space. More precisely, it returns a shortest vector with high probability and runs in
2^(E₀n + o(n)) time and 2^(n/2 + o(n)) space, E₀ = 0.73133754….
This improves the 2^(n + o(n)) classical bound of Aggarwal, Dadush, Regev, and Stephens-Davidowitz (ADRS, STOC 2015). It also beats the previous best known worst-case quantum bounds of Aggarwal, Chen, Kumar, and Shen (ACKS, SIAM J.Comp. 2025), namely 2^(0.9497n + o(n)) without QRAM and 2^(0.8345n + o(n)) with QRAM.

The algorithm constructs a random prime-index superlattice Γ ⊃ L and applies the above-smoothing honest discrete Gaussian sampler of ADRS to Γ. Then it simply scans the resulting samples and retains the shortest nonzero one that lies in L.

The analysis passes to the dual lattice M = Γ^(*). The random codimension-one constraint reduces the expected contribution of vectors outside pL^(*) by a factor smaller than 1/p, while the forced Gaussian mass on pL^(*) is controlled geometrically using the Kabatiansky–Levenshtein sphere-packing bound. Consequently, Γ is smooth at the sampling scale and a fixed shortest vector of L is hit with probability at least 2^(−E₀n − o(n)) per ideal sample.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Perturbation of Hankel moment singular values and supersingular endomorphism rings via CVP: a p-adic super-resolution law and a fully computed pipeline (Radmir Isyanov) ia.cr/2026/1586

Abstract. We give two rigorous results in post-quantum algebra with a p-adic strengthening and a complete reproducible pipeline. Part I proves an explicit sufficient noise bound under which the Hankel matrix of the power moments of supersingular j-invariants deterministically recovers the nodes, with the propagation constant written through the Vandermonde condition number (Weyl, Bauer-Fike); non-archimedeanly, the Teichmüller lift makes the Vandermonde matrix unimodular (cond_(p) = 1 for every L) and an exact super-resolution law gives the p-adic precision loss as 2∑_(i < j)v_(p)(x_(i) − x_(j)) + ∑_(i)v_(p)(c_(i)), a sharp analogue of Moitra’s bound. Part II reduces a ℤ-basis of End(E) to a rank-4 CVP and recovers the exact Gram matrix of the norm form in poly(log p) time via Weil-pairing discrete logs (Shor; in the smooth regime actually run, the logs are classical Pohlig-Hellman), after which fixed-dimension LLL yields a canonical basis and a λ₁-criterion reads the node type. Both parts are joined by an end-to-end theorem and fully computed on real numbers: node recovery, real Vélu chains with measured degree, deterministic KLPT construction with the ideal-to-isogeny and smoothing steps, reading the torsion action in 𝔽_(p⁴) and via Weil pairing + Pohlig-Hellman without an O(N) table, true LLL + Fincke-Pohst, and the classification of all three nodes of B_(23, ∞). The last KLPT heuristic (polynomial running time) is replaced by an explicit hypothesis PRH and a conditional theorem; PRH is shown to be exactly a Titchmarsh-type shifted-prime divisor sum with positive singular series, provable under GRH for fixed p, with uniformity in p an identified open problem. Companion code (23 modules) verifies every numerical claim.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Proving Threshold Regev PKE from Adaptive Hint-MLWE: Efficient, Non-interactive, and CCA Secure (Yisol Hwang, Shuichi Katsumata, Seonhong Min, Guilhem Niot, Yongsoo Song) ia.cr/2026/1585

Abstract. Threshold public-key encryption (tPKE) has recently attracted renewed interest, largely due to NIST’s call for Multi-Party Threshold Cryptography. While classical tPKE has approached a high state of maturity, its post-quantum counterpart has not. Indeed, thresholdizing the celebrated lattice-based Regev PKE, which forms the basis of ML-KEM, remains unsatisfactory. Interestingly, how to thresholdize Regev PKE has not fundamentally changed in over a decade — the only thing that has gradually progressed is its security analysis. To this day, it remains open whether threshold Regev can be proven secure while simultaneously satisfying a polynomial modulus, non-interactive decryption, and CCA-compatibility, each of which is essential for practical deployment.

We answer this affirmatively, providing the first proof that threshold Regev is secure under the MLWE assumption while satisfying all three requirements. In fact, we prove that it satisfies a very strong form of simulation-based security — even stronger than what was known under a super-polynomial modulus — allowing the adversary to obtain partial decryptions even of the challenge ciphertext. At the technical heart of our result is the adaptive hint-MLWE (AHMLWE) problem, an adaptive variant of hint-MLWE where the adversary obtains hints on the MLWE secret with adaptively chosen coefficients. We show that AHMLWE reduces tightly to standard MLWE, which may be of independent interest.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Beyond Affine Invariants: A Hamming-Weight Correlation Metric for Template-CPA Leakage in Key-Dependent S-boxes (Wiesław Maleszewski) ia.cr/2026/1584

$Abstract. Classical selection criteria for cryptographic S-boxes—nonlinearity NL, differential uniformity δ, boomerang uniformity β_(B), algebraic degree deg —are invariants of affine equivalence. That property is exactly what blinds them to a class of side-channel weaknesses. The correlation-power-analysis (CPA) template distinguisher is governed by the Hamming-weight functional, and Hamming weight is not affine-invariant; it does not descend to the affine-equivalence quotient on which the classical criteria live. Two S-boxes with identical (NL, δ, β_(B), deg ) can therefore leak differently under template CPA. We make this precise for the key-dependent family S^(𝒢)(x) = A ι(x) ⊕ c, with ι the multiplicative inverse in GF(2⁸) and (A, c) ∈ GL(8, 𝔽₂) × 𝔽₂⁸ drawn from a byte stream 𝒢. A structural proposition fixes the four invariants at (112, 4, 6, 7) across the entire family; they carry no information about 𝒢. We introduce the Hamming-weight template correlation ρ_(HW)(⋅, S_(AES)), identify it as the population statistic controlling the AES-template CPA distinguisher, and show that it resolves the fiber the classical invariants collapse. As a stress test we instantiate 𝒢 with three sources of contrasting regularity—a system CSPRNG, a discretised logistic map, and a sin (1/x)/xxHash hybrid—and sample 3 × 10⁵ S-boxes from a single master seed. The classical invariants are identical everywhere, as predicted. The metric is not. The logistic source widens the ρ_(HW) distribution against S_(AES) by 12–13% (σ_(ℓ) = 0.0704 vs. 0.0626/0.0623; Levene p < 10⁻¹⁸⁰). The widening vanishes against a uniform-random reference permutation (Levene p > 0.13), survives an exact Q1.31 fixed-point reimplementation at 3.1%, and does not appear for a tent-map control. Propagated through the Mangard–Oswald–Popp trace-budget model and checked against a 2.16 × 10⁵-attack Monte-Carlo CPA simulation, it yields a 29% relative excess in AES-template success rate at SNR = 10, N = 10³ (empirical ratio 1.29, analytic 1.26). By every standard effect-size measure the widening is small (Cohen’s d = 0.128 on |ρ_(HW)|, Cohen’s h = 0.130 on the attackable fraction); its significance is detectability, not magnitude. The contribution is a measurement axis, not a weak generator: a metric that flags template-CPA leakage where NL = 112, δ = 4 report perfect scores.$ Image showing part 2 of abstract.

Image showing part 2 of abstract.

Image showing part 3 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Cryptanalysis of a Candidate Witness Encryption Scheme for Aﬃne Determinant Programs (Sunghyeon Jo) ia.cr/2026/1583

Abstract. At ITCS 2020, Bartusek, Ishai, Jain, Ma, Sahai, and Zhandry proposed a framework for witness encryption based on affine determinant programs, together with a concrete instantiation using their formula-based All-Accept encoding. Yao, Chen, and Yu later broke the separate ADP-based indistinguishability-obfuscation candidate, while noting that their attack did not apply to witness encryption. We give a deterministic polynomial-time attack that recovers the encrypted bit from the public ciphertext matrices of this concrete instantiation. It covers every q ≥ 1 in the theorem’s recovery range, including q(n) = ⌈n^(ε)⌉ for all sufficiently large n. Outside a fixed finite set of primes, it applies to every SUBSET-SUM instance whose coefficient vector is nonzero modulo p and that has no Boolean solution modulo p. On an explicit efficiently generated family of integer NO instances, the encrypted bit is recovered with probability 1 − negl(n) under the field-size convention of the original paper.

ePrint Updates @eprint.ing.bot · 2d ago

Privacy-Preserving Inclusion Lists (Zhengwei Tong, Saba Eskandarian, Kartik Nayak) ia.cr/2026/1582

Abstract. Blockchains aim to provide open access and censorship resistance, but centralization of block production in blockchains like Ethereum undermines these goals. Inclusion List (IL) protocols mitigate this by requiring block proposers to include transactions selected by an IL committee to enforce the inclusion of transactions that appear to have been censored. However, protecting the confidentiality of individual committee members’ contributions is essential to prevent retaliation and ensure robust censorship resistance.

We propose a lightweight, privacy-preserving inclusion list protocol that allows committees to collectively construct transaction lists while hiding individual contributions and ensuring plausible deniability. Our approach builds on multiparty computation (MPC) techniques to achieve strong privacy without relying on heavyweight cryptography or anonymous broadcast channels.

We implement two variants of our protocol design: an optimistic version providing malicious security with abort (latency ∼ 4.0s) for speed, and a robust variant (latency ∼ 124.7s) for guaranteed output delivery in the presence of a Byzantine threshold of t < n/3 malicious parties.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Post-Quantum Internet Key Exchange via Authenticated Forward-Secure KEM (Yunlei Zhao, Biming Zhou, Zhixiang Zhao, Yifan Dong, Cheng Huang, Haodong Jiang) ia.cr/2026/1581

Abstract. In this work, we present a new framework for signature-free, post-quantum secure authenticated key exchange (AKE) that simultaneously satisfies: (1) exchanging at most two standard ciphertexts of a key encapsulation mechanism (KEM); (2) computational symmetry; (3) perfect forward secrecy (PFS); (4) strong resilience to secret-state exposure; (5) strong resistance to decryption-error attacks; (6) admitting instantiations based on the native structure of under the assumption; and (7) provable security in both the random oracle model (ROM) and the quantum-accessible random oracle model (QROM) under the post-id eCK-PFS framework. This resolves several fundamental open questions in the literature. The core technical building block is a new cryptographic primitive, called an KEM (AFS-KEM), which unifies authentication and forward secrecy within a single KEM abstraction and may be of independent interest.

ePrint Updates @eprint.ing.bot · 2d ago

Order Auctions with Private Position Preferences (Ruijie Wang, Aviv Yaish) ia.cr/2026/1580

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Slipway: Accessing Finite Subspace Trails in Poseidon (Giuseppe Vitto) ia.cr/2026/1579

Abstract. Poseidon is an algebraic permutation designed for efficient use in proof systems. Its nonlinear layer consists of power-map S-boxes. In a full round, the S-box is applied to every state coordinate; in a partial round, it is applied to only one coordinate, reducing the arithmetization cost. Each round also applies an MDS linear layer to diffuse information across the state.

To study algebraic degree, we let the input depend on variables and follow the resulting family of states through the permutation. If the coordinate entering a partial-round S-box is constant across that family, the S-box adds no degree in the family variables. Directions with this property over several consecutive partial rounds form finite subspace trails. Such trails exist for every linear layer, but their existence does not by itself explain how a constrained family can pass through the preceding full rounds and enter them without first acquiring high degree.

We address this reachability problem by constructing a constrained input family and a round-constant-dependent MDS matrix together. The prescribed matrix images carry the family through the four initial full rounds and into a chosen finite trail. After an explicit change of variable, the state at the end of the full-round prefix is linear in the new root variable, so the prefix acts as a controlled reparametrization rather than as a source of degree growth. We call this effect .

For the KoalaBear instance (t, α, R_(F), R_(P)) = (16, 3, 8, 20), we construct a two-parameter family whose first two input coordinates are zero. On this family, the four initial full rounds act as a reparametrization and deliver the variable directions into a two-dimensional trail, so those four rounds and the next fourteen partial S-boxes add no degree. For the exhibited control, the polynomials representing the first two output coordinates have exact degree 3^(R_(F) + R_(P) − 4 − 14) = 3¹⁰, rather than the expected degree 3^(R_(F) + R_(P)) = 3²⁸. We exhibit a common base-field root, yielding a complete CICO-2 solution for the full-round Poseidon instance.

The resulting matrices are MDS and satisfy the relevant matrix checks prescribed by the Poseidon designers, yet they make a finite trail reachable through the full-round prefix. We generalize the construction to CICO-k, derive the corresponding trail-dimension and matrix-image bounds, and provide a concrete MDS matrix that meets the CICO-3 matrix-image bound with equality.

Image showing part 2 of abstract.

Image showing part 3 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

OpenLLM: Modular and Scalable zkSNARKs for Verifiable LLM Inference (Yunbo Yang, Yupeng Ren, Changtong Xu, Rui Zhang, Xuanming Liu, Jin Tan, Tao Wei, Bingsheng Zhang, Kui Ren) ia.cr/2026/1578

Abstract. Large language model (LLM) is increasingly deployed as a remote service, where users rely on third-party servers to perform computation. However, such settings introduce critical integrity concerns, as an untrusted server may deviate from the prescribed computation, skip expensive operations, or return incorrect results, while users lack practical approaches to verify execution correctness. Ensuring the correctness of LLM inference under untrusted execution remains a fundamental challenge. Zero-knowledge proofs (ZKPs) provide a principled approach verifying computation correctness, but applying them to LLM inference remains challenging. Modern LLMs involve a large number of non-linear operations and require modeling real-valued computation in finite fields, introducing substantial computational and memory overhead and potential loss of numerical precision. Moreover, the large scale of LLMs makes end-to-end verification difficult to scale, limiting the practicality of existing approaches.

This paper presents OpenLLM, an efficient and modular system for verifiable LLM inference. Our key idea is to decompose large-scale LLM inference into a set of reusable atomic operators, each equipped with efficient ZKP protocols, enabling scalable verification at the operator level. Based on this abstraction, we design succinct non-interactive zero-knowledge proof constructions for representative non-linear functions, which can be composed into end-to-end inference pipelines independent of model architectures.

We further evaluate OpenLLM across operator-level performance, end-to-end inference, layer-wise scaling, larger models, and approximation accuracy. The results show that OpenLLM achieves smaller proof sizes, lower verification cost, and improved numerical fidelity while scaling from individual operators to full-model inference. Compared with state-of-the-art interactive protocols, OpenLLM eliminates communication overhead through a fully non-interactive design while maintaining competitive efficiency. Building on this operator-level efficiency, it further enables a scalable and modular framework for end-to-end verifiable LLM inference, outperforming prior end-to-end approaches.

Image showing part 2 of abstract.

Image showing part 3 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

SONIC: Concurrent Oblivious RAM & Data Structures for Low-Latency and High-Throughput (Nihal Talur, Ioannis Demertzis) ia.cr/2026/1577

$Abstract. Relying solely on encryption for privacy-preserving computations is prone to leakage-abuse/access-pattern attacks. TEEs, while cost-effective, are also vulnerable to side-channel attacks. Oblivious primitives, such as oblivious memory (ORAM) and data structures (ODS), are effective building blocks to mitigate these risks by concealing memory access patterns and side-channel information. Applications range from private contact discovery (Signal) to anonymous key transparency, encrypted email search, encrypted/oblivious databases, anonymous communication (Sparta/SP’25), private federated learning, LLM privacy (Compass/OSDI’25), and broader confidential computing efforts. Tree-based ORAMs (EnigMap (USENIX’23), GraphOS (PVLDB’23), Oblix (SP’18)) offer low latency but limited parallelism. Partition-based solutions like Snoopy (SOSP’21) shard data across subORAMs (which build oblivious hashtables on incoming requests, then linearly scan them), achieving high throughput by trading off latency, theoretically enabling linear scalability. In practice, Snoopy’s performance hinges on how quickly each subORAM can build the oblivious hashtable and complete its linear scan before exceeding latency targets, constraining server utilization and throughput. While supporting a TB-scale dataset with Snoopy is theoretically feasible, we estimate it would require 1000+ servers. In this work, we reconcile the fractured landscape between low-latency and high-throughput ORAM designs. We introduce SONIC: the first parallel/concurrent doubly-oblivious tree-based ORAM for TEEs. SONIC achieves 156K-3.3M req/s with a single server, tackling the core challenges of all tree-ORAM constructions: overcoming the sequential eviction bottleneck, enabling efficient batch evictions, and providing lock-free access/reshuffle/stash operations. SONIC achieves throughput 29-104× higher than EnigMap, and 158-560× higher than GraphOS, with lower latency. In the distributed, high-throughput setting, our SONIC-powered OMAP PMChain can replace Snoopy’s subORAM, supporting higher throughput and 64× larger datasets using the same hardware (reducing Snoopy’s server requirements).$ Image showing part 2 of abstract.

Image showing part 2 of abstract.

Image showing part 3 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

A Systematic Literature Review on Optimising CRYSTALS-Dilithium (ML-DSA) Performance for IoT Devices via Lightweight Hashing (Ceasar Njuguna Ngunu, Edward Ombui) ia.cr/2026/1576

Abstract. Background: The migration to post-quantum cryptography confronts resource-constrained Internet of Things (IoT) devices with a material performance cost. CRYSTALS-Dilithium, standardised as the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) in FIPS 204, fixes the Keccak-based SHAKE functions as its only symmetric primitives, and profiling on embedded platforms identifies hashing as the largest single contributor to the scheme’s software cost. This review synthesises the performance evidence for ML-DSA on constrained platforms, classifies the optimisation strategies pursued in the literature, and tests whether any published work substitutes a standardised lightweight extendable-output function for SHAKE within the scheme. Methods: Following Kitchenham’s guidelines and the PRISMA 2020 statement, we searched IEEE Xplore, the ACM Digital Library, Scopus, and SpringerLink for peer-reviewed studies published from January 2020 onwards, complemented by backward and forward snowballing and by targeted update searches through July 2026. A protocol was prepared in advance of the search. From 115 database records and 22 records identified through other methods, 40 primary studies met the inclusion criteria. Results: On the ARM Cortex-M4, optimised software implementations of Dilithium3 require 10,667 kilocycles on average for signing and 2,321 kilocycles for verification; on the Cortex-M7, Dilithium-2 verification averages 1,429 kilocycles (6.6ms at 216MHz), with signing spanning 1,835 to 16,440 kilocycles due to rejection sampling. Optimisation efforts fall into four categories: hardware acceleration, platform-specific software optimisation, protocol-level adaptation, and optimisation of the incumbent Keccak primitive itself. Architecture-specific Keccak optimisation reduces hashing’s share of Dilithium’s runtime on the Cortex-M4 by only 2.46 to 5.03 percentage points, indicating that the bottleneck largely survives direct attack. Replacing Keccak with Ascon inside the sibling scheme Kyber yields a 24 to 25% cycle reduction and a 2 to 8% memory reduction on the Cortex-M4. No peer-reviewed study applies this substitution to ML-DSA. Conclusions: With FIPS 204 and NIST SP 800-232 both final, the cost of ML-DSA’s primitive choice on constrained platforms is a well-posed and unanswered question on both sides. We specify a per-call-site Dilithium–Ascon evaluation, including its security constraints and non conformance status, as the priority direction for software-only optimisation of post-quantum signatures on IoT devices. Keywords: post-quantum cryptography; ML-DSA; CRYSTALS-Dilithium; Ascon; lightweight cryptography; Internet of Things; systematic literature review

Image showing part 2 of abstract.

Image showing part 3 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Solving the supersingular isogeny problem in time p^(2/5 + o(1)) using bivariate multipoint evaluation (Aleksei Udovenko) ia.cr/2026/1575

Abstract. This note presents a new unconditional attack on the supersingular isogeny problem, with time and memory complexity p^(2/5 + o(1)). It builds on the approach by Eisenträger-Hallgren-Leonardi-Morrison-Park (2020) and Fuselier-Iezzi-Kozek-Morrison-Namoijam (2025), and is related to the recent heuristic attack with complexity p^(1/3 + o(1)) by Wesolowski (ePrint 2026/1486): all of these search for a separable isogeny from a curve to its Galois conjugate to form a non-scalar endomorphism.

Our attack is based on highly theoretical multivariate multipoint evaluation algorithms from Kedlaya-Umans (2008, 2011), Bhargava-Ghosh-Guo-Kumar-Umans (2022), and Ghosh-Harsha-Herdade-Kumar-Saptharishi (2023), and therefore does not threaten isogeny cryptosystems in practice; it is of theoretical interest.

ePrint Updates @eprint.ing.bot · 2d ago

Privacy-Preserving Multi-Signatures: Achieving Transcript-Aware Privacy (Yanzibo Zhou, Fuchun Guo, Willy Susilo, Nan Li) ia.cr/2026/1574

Abstract. Multi-signatures with key aggregation provide compact signatures verifiable under a single aggregated public key, but protect signer privacy only when public keys are used in a one-time manner. To address this limitation, recent privacy-preserving constructions provide stronger privacy guarantees under public-key reuse. However, they only guarantee privacy in the signature-only setting, where adversaries observe only the final aggregated public key and signature. In practical deployments, multi-signature protocols may be executed over public channels, where externally visible signing transcripts are exposed. These transcripts may link signing messages to public keys, thereby leaking signer identities and undermining existing privacy guarantees. In this paper, we formalize this gap by introducing transcript-aware privacy, a new framework that captures signer privacy in the presence of transcript exposure. Within this framework, we identify the strongest achievable privacy notion, in which signer identities remain hidden while the size of the signer set may be revealed. Our formulation departs from prior signature-only privacy models by explicitly modeling adversarial access to signing transcripts and allowing only inherent leakage such as the signer-set size. We present a new construction based on the MuSig2-H scheme of Tessaro and Zhu (EUROCRYPT’23). Our scheme achieves UNF-3 unforgeability in the AGM+ROM under the DL assumption and preserves full privacy in the signature-only setting. In the transcript-aware setting, it achieves weak set privacy in the ROM under the DDH assumption. In addition, we provide a concrete realization of the key-aggregation proof sharing procedure over public channels, eliminating the need for secure channels and improving practical deployability.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

The Non-Intersecting Codewords Problem and its Application to MPC-in-the-Head Signatures (Pierre Briaud, Philippe Gaborit, Romaric Neveu, Gilles Zémor) ia.cr/2026/1573

Abstract. Since McEliece introduced the first code-based encryption scheme in 1978, most code-based cryptographic constructions have relied on hard problems related to decoding random linear codes (or variants thereof) or code equivalence. More recently, the use of the MPC-in-the-Head paradigm has enabled the construction of a new class of very competitive digital signature schemes relying on such assumptions, including the NIST submissions Mirath, PERK, RYDE, and SDitH, as well as a recent proposal based on the so-called Subfield Bilinear Collision problem by Huth and Joux (Crypto 2024).

In this work, we enrich the portfolio of code-based MPC-in-the-Head signature schemes by introducing a new hard problem to cryptography, referred to as the Non-Intersecting Codewords (NIC) problem. In this problem, one has to find two codewords of a given linear code such that their supports in the Hamming metric do not intersect. After discussing how to generate hard instances and studying several attacks on it, we show that the NIC problem can be used to construct a competitive MPC-in-the-Head signature scheme. Using generic constructions, we obtain smaller signature sizes than SDitH and PERK, attaining a signature size of 2₉₃₄Bytes for NIST security level I.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

SHARMONY: Composing SHA-2 and SHA-3 Hardware for Crypto-Agile PQC (Liga Anwar, Carlos Andres Lara-Nino, Jong-Yeon Park, Michael Hutter) ia.cr/2026/1572

Abstract. Inspired by the concept of harmony, this work composes SHA-2 and SHA-3 into a unified hardware architecture, bringing them together as a single, efficient cryptographic ensemble. This need is driven in particular by Post-Quantum Cryptography (PQC), where different standardized schemes rely on either SHA-2 or SHA-3/SHAKE primitives. Rather than enforcing strict round-level unification, the proposed design applies selective sharing across the most area-critical components, including a shared 25 x 64-bit register bank, shared round-constant storage, and unified padding and control logic. A unified datapath organization reinterprets the same hardware as either a SHA-2 scheduler/compression engine or a KECCAK absorb/permutation state, while maintaining full compliance with FIPS 180-4 and FIPS 202. In addition, we introduce a duet execution mode that enables parallel processing of two independent SHA-224/256 streams by exploiting the otherwise underutilized upper half of the 64-bit datapath. This capability is particularly advantageous for Merkle-tree-based constructions in hash-based PQC, where independent node hashes can be evaluated concurrently. The design is implemented and synthesized on an Artix-7 FPGA, occupying 6,591 LUTs and 2,308 FFs. Experimental results show that SHARMONY achieves a throughput of 1,656,Mbps for SHA-256, representing improvements of 89%, 72%, and 50% over the SHA-256 engines of OpenTitan, Caliptra, SPHINCSLET and SLotH , respectively. At the same time, SHARMONY reduces LUT utilization by an average of 38% and FF utilization by an average of 62% compared to combined designs constructed from separate SHA-2 and SHA-3 implementations.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

LAMP: Linear Verification of Matrix Multiplication via Proximity Testing (Kyeongtae Lee, Byeongkyu Han, Jihye Kim, Hyunok Oh) ia.cr/2026/1571

Abstract. Verifiable computation systems often need to prove large matrix multiplication statements, but a direct SNARK arithmetization of a k × k product requires 𝒪(k³) constraints. Freivalds’ randomized check reduces the algebraic computation to vector-matrix products, but proving those products inside a SNARK still costs 𝒪(k²) constraints.

We present LAMP, a matrix-multiplication checking protocol that combines Freivalds’ randomized check with proximity testing over linear error-correcting codes. The prover commits to encoded matrices and intermediate vectors before the sampled query positions are derived. The CP-SNARK circuit then checks only the sampled codeword positions and commits to the values used inside the circuit, while Merkle openings and CP-Link proofs ensure consistency between the in-circuit witnesses and the externally committed values. We prove soundness for this committed-input setting under the soundness of the SNARK backend, the binding of the commitments, the correctness of the CP-Link checks, and the distance of the code.

For a fixed number t of sampled positions, the main in-circuit SNARK relation has 𝒪(tk) constraints, with additional 𝒪(tlog n) + E_(link)(k) backend work for Merkle openings and CP-Link checks. We implement LAMP in Go and compare it with a Freivalds-based SNARK circuit. In the matrix benchmark at k = 2¹², LAMP reduces the constraint count by 30.3× and shortens proof generation time by 8.43×; verification stays at about 0.06 seconds across the measured matrix dimensions.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Anchor-DKG: Distributed Key Generation with Repeating Parties (Hanwen Feng, Qiang Tang, Sri AravindaKrishnan Thyagarajan) ia.cr/2026/1570

Abstract. A party may participate in multiple threshold cryptosystems. For example, it may serve on multiple overlapping threshold committees in a proof-of-stake blockchain or a distributed oracle network, or act as a client of multiple cryptocurrency wallet services built on threshold cryptography. With conventional distributed key generation (DKG), each threshold system independently generates its key shares, imposing significant key-management overhead on such a repeating party. In contrast, modern key-management practice favors deriving all cryptographic material deterministically from a single master key, raising a fundamental question: Can DKG be reconciled with key derivation while preserving security and compatibility with legacy threshold systems?

We present Anchor-DKG, a new DKG protocol that allows up to t^(rec) (the reconstruction threshold) parties to deterministically fix their secret key shares while retaining standard security guarantees. Anchor-DKG supports concurrent executions with overlapping participants across multiple DKG instances and remains fully compatible with legacy threshold schemes, including ECDSA, BLS, Schnorr, and ElGamal.

At the core of Anchor DKG lies a new technique: fixed-point distributed polynomial sampling (FpDpS). FpDpS allows parties to jointly sample a random (t^(rec) − 1)-degree polynomial f such that f(i) = s_(i) at designated points i, where each s_(i) can be a private input, e.g., a key derived from a master secret. The final secret key remains f(0), ensuring compatibility with existing discrete-log-based threshold systems. We provide an efficient construction of Anchor DKG under standard cryptographic assumptions, which, compared to classical constructions such as Gennaro et al. (J.Cryptol. 2007), only incurs one more point-to-point round and marginal computation. Experimental results show that, for a network size of n = 128, our protocol incurs a per-party computation cost of 1.59 s, compared to 1.36 s for GJKR.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Tensor Encodings for SIMD HSS (Jaehyung Kim) ia.cr/2026/1569

$Abstract. We study SIMD packing for the lattice-based homomorphic secret sharing scheme of Boyle-Kohl-Scholl (BKS) over dimension-N cyclotomic rings. A trace construction with alternating tensor encodings matches the $\Theta(\sqrt N)$ packing of SIMD-HSS by Kim et al. (ePrint 2026/485). Its addition-closed mode uses O(log N) authenticated automorphisms, two BKS multiplications, and two constant multiplications; an alternating fast path roughly halves these costs. A second construction uses a three-term-progression-free slot set A: homomorphic traces isolate the product coefficients at 2a for a ∈ A, and a halving automorphism returns them to a. For fixed k and conductor primes, with balanced prime-power factors, this packs N^(1 − o(1)) slots with one BKS multiplication, O(kN^(1/(2k))) authenticated automorphisms, and O(kN^(1/k)) constant multiplications. Both constructions support standard (non-entropic) secrets. Two-party executions at 162 and 495 slots confirm the algebra and exact call counts.$

ePrint Updates @eprint.ing.bot · 2d ago

Antichain Winternitz: Guaranteed Garbled-Circuit Label Revelation on Bitcoin with Permissionless Recovery (Mukesh Tiwari, Aaron Feickert) ia.cr/2026/1568

Abstract. Trust-minimized bridges on Bitcoin move SNARK verification off chain by evaluating the verifier as a garbled circuit. The bridge’s on-chain spending condition obliges the Garbler to reveal the labels for one input without enabling the Evaluator to derive labels for any other input. Existing designs commit to each input bit with a Lamport signature which is costlier on chain, or with adaptors where there is no guarantee that the spend actually reveals the labels. We present Antichain Winternitz, a parametrized hash-chain construction whose admissible codewords form a constant-sum antichain. The on-chain locking script accepts an opening witness only if it encodes a valid codeword consistent with the committed chain terminals. Every accepted opening witness yields a valid codeword while the public off-chain table, verified during setup, maps every admissible codeword to its garbled-circuit labels, so any observer can recover them. Depending on the parameter set, we can obtain up to a 52.9% saving over Lamport signatures with only added off-chain storage of 43.8 kB per message bit.

ePrint Updates @eprint.ing.bot · 2d ago

Zero Knowledge Barcode Decoding with Application to Private Online Attribute Verification (Kelsey Merrill, Anna Woo, Wenting Zheng, Sarah Scheffler) ia.cr/2026/1567

Abstract. Online attribute checking (e.g. proving age, residency) is increasingly common, yet standard implementations reveal far more personal information than necessary (e.g. all ID contents). Privacy-preserving alternatives exist but require digital inputs: anonymous-credentials or zero-knowledge (ZK) proofs of signature possession over a bitstring. However, it is challenging to gain integrity guarantees on the bitstring itself.

C2PA offers a partial solution: C2PA-enabled cameras cryptographically attest to image origins with an embedded signing key, so a smartphone could provide a signed image of an ID barcode. However, since C2PA signs the image rather than the bitstring of the decoded barcode, the prover must additionally prove correct execution of the PDF417 barcode decoding algorithm on the signed image. Two barriers block this approach: images are large, yielding large proofs and long prover runtimes, and the PDF417 barcode decoding algorithm is highly data-dependent, making compilation into a ZK-friendly constraint systems non-trivial.

We present an end-to-end ZK proof system for PDF417 barcode decoding, built on an adaptation of zkSNARK system Dorian (itself based on Spartan) with modifications: (1) adjusting Dorian’s polynomial commitment to validate C2PA signatures more efficiently while cheaply checking consistency with the main Dorian proof, and (2) incorporating additional technical gadgets for set disjointness, data-dependent processing in R1CS, and state machines for greater efficiency. Implementing the PDF417 decoding algorithm as R1CS constraints is also nontrivial, as the algorithm is highly data-dependent and requires modifications to ensure soundness.

Our system is the first to enable efficient barcode decoding in ZK. The best previous option was a zkVM, requiring prohibitively high computation and memory. We demonstrate that our system is significantly faster and uses far less memory. Furthermore, we suggest changes to the C2PA framework that would make future private verifiable image processing tasks more efficient. Though not yet ready for practical deployment, our system presents an alternative approach to private online attribute verification and demonstrates techniques of independent interest for data-dependent ZK computation.

Image showing part 2 of abstract.

Image showing part 3 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

On the Security of Rotational (Non-)linearity in Sbox (Yadi Zhong) ia.cr/2026/1566

Abstract. Recently, zero-knowledge proof protocols have gained much popularity due to the adoption in blockchain applications, e.g., zero-knowledge virtual machines. However, using the current standardized hash functions inside the generation of zero-knowledge proofs would incur much overhead in proof size, as well as prover and verifier’s runtime. In the past few years, various circuit-friendly hash functions has been proposed. Skyscraper-v2 is one example of such hash functions applying the split-and-lookup approach for better performance. In this paper, we expand the linear approximation definitions by extending it with circular shifts embedded in the approximation. Specifically, we consider the rotation of bits at both the input and output sides. We demonstrate it with Skyscraper-v2 Sbox. It allows us to better capture the recurring sequence in nonlinear Skyscraper-v2 SBox.

ePrint Updates @eprint.ing.bot · 2d ago

How to Back Up High-Value Secret Keys (Sanjam Garg, Noemi Glaeser, Abhishek Jain, Michael Lodder, Hart Montgomery) ia.cr/2026/1565

Abstract. Consider a cryptocurrency exchange that secures the bulk of its reserves under a small set of keys, each of which is only used to transfer cryptocurrency once a year; or the backup codes for an account login or a password manager, which are again rarely used but provide access to crucial systems or information. Securing such infrequently-used high-value secrets is crucial, but existing solutions, such as threshold wallets and ‘cold’ (offline) wallets, are unsatisfactory.

In this work, we envision a system that allows users to conveniently back up their rarely-used, high-value keys. This new setting necessitates a novel set of design requirements. Specifically:

- We allow user keys to be threshold secret-shared among a large number of custodians where each custodian wallet comprises of a hot (i.e., online) and a cold (i.e., offline) portion. The cold part of the wallet is not touched during the backup process (thus, it is independent of the number of system users) but must be accessed for recovery.
- We provide a mechanism to continually assure users that their keys are safely stored. This feature is critical because our system is not designed for frequent key use. We also enable proactive key refresh.
- Finally, in our approach, restoring a backed-up key is equivalent to generating a signature. Thus, signatures made by users of this system should look the same as “normal” signatures to avoid exposing holders of high-value keys to targeted attacks.

Based on these requirements, we develop new security definitions and a UC-secure protocol that implements threshold BLS signatures in our new model. Our protocol is practically efficient for the envisioned large numbers of custodians: for a 67-out-of-100 threshold configuration, creating a new backup takes 10s, while recovery takes less than 2ms.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Splitting Bilinear Groups: New Translations from Composite- to Prime-Order with Applications to Batch Arguments for NP (David Balbás, Dario Fiore, Duy Nguyen) ia.cr/2026/1564

Abstract. Bilinear groups, also known as pairing groups, are a versatile tool that enables many efficient cryptographic constructions. Among bilinear groups, those with a composite order (N = p · q for two large, secret primes p, q) offer an additional algebraic structure which is advantageous in many applications. They are however dramatically less efficient than their prime-order counterparts, so multiple translation frameworks for constructions from composite- to prime-order groups have been introduced in the literature.

Motivated by the recent construction of Batch Arguments for NP (BARGs) with linear-size CRS by Chen, Elias and Wu [Asiacrypt ’25], based on composite-order groups, we notice that these previous frameworks fail to transfer their scheme to the prime-order setting. In this work, we identify and close this gap by introducing a new translation framework based on a new abstraction called dual encodings. The crucial feature of these objects is a security property called indistinguishability that allows embedding hidden subgroups, emulating composite-order groups more faithfully and thus enabling more powerful translations. Then, we realize dual encodings using functional encryption for function-hiding inner products. Finally, we apply our framework to build the first BARG with linear-size CRS from prime-order groups, while preserving the (statistical) somewhere extractability of previous constructions. Our result represents a significant step toward practically efficient BARGs and showcases a surprising application of functional encryption which we find of independent interest.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

A Generalized Framework for Conditional Linear Cryptanalysis and Its Application to AES-Like Ciphers (Cheng Che, Tian Tian, Jing Yang, Fan Yang) ia.cr/2026/1563

Abstract. Conditional linear cryptanalysis represents an extension of linear cryptanalysis and has been applied to DES and AES. Notably, it enables the construction of a linear distinguisher for 4-round AES, which is considered unattainable through standard linear cryptanalysis. The underlying principle is that the correlation of a linear approximation can be improved when the data is restricted to a specific subspace or subset, thereby allowing more effective linear cryptanalysis. The critical challenge in conditional linear cryptanalysis lies in identifying appropriate conditions to impose on the data; however, previous methods rely on ad hoc strategies that depend heavily on expert intuition, which limits their generalization and application.

In this paper, we propose a generalized framework for conditional linear cryptanalysis. The core tool is the conditional linear approximation table (CLAT), which quantifies linear correlations within constrained data subspaces. We further define a metric termed conditional linear weight, which balances the gain in correlation against the overhead of data filtering, thereby offering a quantitative measure of resistance against conditional linear cryptanalysis. Based on the CLAT and conditional linear weight, we develop an MILP-based automatic search model for conditional linear trails and devise systematic approaches for mounting distinguishing and key recovery attacks using these trails. Applying our framework to AES, Rijndael-256, ARIA, LED, Midori-128, and SKINNY-128, we demonstrate that conventional full-space bounds do not guarantee resistance against conditional linear cryptanalysis, and we propose improved linear attacks.

Our framework provides systematic approaches and automatic tools for conditional linear cryptanalysis. It enables cryptanalysts to gain deeper insights into the statistical linear properties of cryptographic primitives and serves as a useful evaluation technique for new designs.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Power Analysis and Countermeasures on the MiMC Block Cipher (Elena Andreeva, Stefan Mangard, Rishub Nagpal, Arnab Roy, Stefano Trevisani) ia.cr/2026/1562

Abstract. Modern zero-knowledge (ZK), fully homomorphic encryption (FHE) and Multi-party Computation (MPC) protocols have motivated research interest in Arithmetization-Oriented (AO) cryptographic primitives. The use of these protocols on embedded platforms requires consideration for protection against side-channel analysis (SCA), including timing and power attacks. Compared to traditional bit-oriented block ciphers, the design of side-channel countermeasures for AO-based ciphers poses unique challenges due to their different mathematical properties and computation requirements.

In this work, we perform side-channel analysis of MiMC, a well-known AO block cipher. We first consider its constant-time implementation over the BN254 prime field for both x86 and ARM-v7 targets. Next, we demonstrate both profiled (SASCA) and unprofiled (linear regression) power analysis of our implementation on the ARM Cortex-M4 microcontroller, showing that a DPA adversary can reduce the key-guessing space to just 2³⁰ candidates using only ≈ 32000 power measurements, and the profiling adversary can perform full key recovery in as few as 100 measurements.

Hence, we consider and compare two side-channel countermeasures: a classical ISW masking approach, and the redundant number representation (RNR) adapted for large prime fields. For the RNR countermeasure, we show that ≈ 64 bits of redundancy are sufficient to reduce the information leakage enough to make DPA attacks impractical. Our claim is supported both by a standard fixed-vs-random leakage assessment with 10 million collected traces and by quantitative analysis via SASCA attacks. Finally, we compare the performance of the RNR countermeasure with first-order masking. While masking incurs in a $$ overhead on a Cortex-M4 MCU and in an $$ overhead on an x86-64 CPU, the RNR approach only introduces a ≈ 50% overhead on both targets.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

DeepBrake: Efficient Row-Wise Reed-Solomon Commitments for Arbitrary Points (Zhongliang Zhang, Xinxuan Zhang, Yuanju Wei, Lang Qin, Yi Deng) ia.cr/2026/1561

Abstract. Brakedown (CRYPTO 2023) is a transparent polynomial commitment scheme with fast proving. Its reliance on codes with small minimum distance forces the protocol to sample more columns to achieve soundness, resulting in larger proof sizes. Replacing the underlying code with Reed-Solomon codes yields better distance properties and should reduce the number of required queries. However, the standard row-wise RS protocol cannot exploit proximity results beyond the unique-decoding radius, such as the Johnson bound (JACM 2023). The bottleneck is structural: the protocol performs two independent checks—proximity testing and evaluation binding. Increasing the proximity radius reduces queries for the first check but increases queries for the second, leaving the overall proof size unchanged.

Diamond and Posen (CIC 2024) consolidate these checks when the evaluation point is chosen randomly by the verifier. For predetermined or application-specified points, existing approaches introduce a sumcheck reduction that adds logarithmic rounds and prover overhead.

We present DeepBrake, a Reed-Solomon polynomial commitment that consolidates the two checks for arbitrary evaluation points without sumcheck. By fixing row evaluations before the verifier samples the random fold, the protocol uses a single proximity test to verify both properties simultaneously. This enables DeepBrake to exploit stronger proximity bounds and reduce the number of queries.

At n = 2²⁰ and rate 1/2 over Ft255, DeepBrake’s opening phase is 3.5× faster than the Diamond-Posen baseline with sumcheck, with 16.5% lower total prover time and 2.7% larger proof size.

We further introduce BrakeWHIR, which replaces the explicit proof elements with succinct polynomial commitment openings using WHIR (EUROCRYPT 2025). BrakeWHIR achieves 2.6× faster verification and 1.9× smaller proofs than DeepBrake.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Dimension Reduction for SVP in Hawk: A Trace-Zero Approach (Guilhem Mureau, Alice Pellet-Mary) ia.cr/2026/1560

$Abstract. Let E = ℚ(ζ_(m)) be a power-of-two cyclotomic field, with maximal totally real subfield K = ℚ(ζ_(m) + ζ_(m)⁻¹). In previous work, Chevignard et al. (Eurocrypt’25) gave a reduction from module-LIP for rank-two module lattices over 𝒪_(E) to the norm-reduced Principal Ideal Problem (nrdPIP) in a quaternion algebra. We derive two consequences of this reduction. First, we obtain a polynomial time reduction from rank-2 module-LIP over 𝒪_(E) to rank-3 module-LIP over 𝒪_(K). Note that rank-2 modules over 𝒪_(E) are naturally seen as rank-4 modules over 𝒪_(K), so this is indeed an improvement. Our second result is specific to the module 𝒪_(E)², underlying the Hawk signature scheme. In this setting, we also obtain a reduction to a rank-3 module-LIP instance over 𝒪_(K), but we can additionally show that these modules have a simple geometric shape: they are isomorphic to $\mathbb Z^{m/2+1} \perp \sqrt{2}\, \mathbb Z^{m/4-1}$. We then adapt Ducas’ result (ePrint’23) to this setting. Putting everything together we obtain an algorithm breaking ’s key recovery by making polynomially many exact-SVP calls in lattices of dimension at most 3m/8 + 1. This improves upon the previous analysis from Ducas (ePrint’23) which required exact-SVP calls in lattices of dimension at most m/2 + 1.$ Image showing part 2 of abstract.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Revisiting Shamir Secret Sharing for Threshold Fully Homomorphic Encryption (Jiseung Kim, Seunghu Kim, Hyung Tae Lee) ia.cr/2026/1559

Abstract. Recent advances in lattice-based threshold cryptography, including threshold fully homomorphic encryption (ThFHE) and threshold public key encryption (ThPKE), commonly employ Shamir secret sharing over rings. While conceptually simple, these schemes suffer from rapidly growing denominator-clearing factors required for secret reconstruction as the number of parties N increases, which in turn necessitates larger ciphertext moduli and complex reconstruction procedures.

In this work, we revisit the notion of subtractive sets underlying ring-based Shamir secret sharing and present a refined framework for constructing integer-reconstructible sharing over cyclotomic rings. To that end, we introduce a new geometric analysis of Lagrange coefficients and show that the resulting reconstruction factors can be made significantly smaller under specific settings. In particular, our framework enables smaller ciphertext sizes in (t, N)-threshold settings, and yields improved correctness and efficiency when applied to any ring-based threshold construction employing Shamir secret sharing over cyclotomic rings. Specifically, in lattice-based one-round (t, N)-ThFHE schemes, our approach reduces the bit-size of ciphertext moduli from O(N) to O(tlog (N/t²)) while ensuring efficient denominator handling. For lattice-based ThPKE, our method yields a new bound on reconstruction factors that improves upon the recent state-of-the-art result of Pilvi. Moreover, we implement ThFHE schemes over cyclotomic rings based on our framework and demonstrate their practical efficiency. Our experimental results show that each algorithm completes within 0.2 seconds for N = 64 and remains scalable for larger configurations with N ≥ 256.

Image showing part 2 of abstract.

ePrint Updates @eprint.ing.bot · 2d ago

Verifiable Outsourced BTE with Silent Setup: Achieving Constant-Rate Batched Delegation (Kwangsu Lee) ia.cr/2026/1558

Abstract. Batched threshold encryption (BTE) is a novel public-key paradigm in which, once a batch of B ciphertexts is designated, a decrypter evaluates them using decryption key shares generated by decryption committee nodes via threshold reconstruction. To mitigate Miner Extractable Value (MEV) attacks in fully decentralized environments like blockchains, it is essential to guarantee mempool privacy while supporting a silent setup that allows decentralized key generation among decryption nodes. Furthermore, to efficiently process large batches of ciphertexts, an outsourcing mechanism that delegates heavy decryption computations to a cloud server is indispensable.

In this paper, we observe that naively adding decryption outsourcing to a threshold batched identity-based encryption with silent setup (TBIBE-SS) scheme of Gong et al.~(EUROCRYPT 2026) causes the outsourcing communication overhead to scale undesirably with the number of decryption nodes. To overcome this limitation, we introduce a partial re-randomization technique–replacing conventional full re-randomization–and incorporate a handle-based oracle query mechanism into the security model. Based on these techniques, we propose a communication-efficient outsourced TBIBE-SS (O-TBIBE-SS) scheme and formally prove its security. We then combine our O-TBIBE-SS scheme with additional cryptographic primitives to construct a verifiable outsourced BTE-SS (VOBTE-SS) scheme, which supports both delegated decryption and verifiability of outsourced computation, proving its security under an augmented threat model. Our VOBTE-SS scheme represents the first construction to achieve efficient batched decryption outsourcing in terms of both communication and computation overhead within decentralized environments.

Image showing part 2 of abstract.