Paper Feeds (IACR)

Key-Recovery Attacks on TALUS: A Cryptanalytic Note

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1386

AI Summary (中文)

TALUS门限ML-DSA方案的关键恢复攻击：结构性缺陷揭示

本文针对arXiv公开、拟在NIST TCPT-2会议展示的门限ML-DSA方案TALUS（Kao与Chang提出）发起系统性密码分析，揭示其两类核心构造——TALUS-MPC（多方计算型）与TALUS-TEE（可信执行环境型）——均存在致命设计缺陷，可导致完整私钥恢复。

主要攻击路径

1. TALUS-MPC的密钥共享泄露：该方案声称对最多$T-1$个恶意方具备EUF-CMA安全性，但实际不成立。其关键漏洞在于：密钥生成阶段对$s_1$分量使用Feldman承诺，将秘密份额经公共矩阵$A$线性映射；签名阶段对随机数贡献$y$同样应用$A$。由于ML-DSA所有参数集下$A$均为左可逆矩阵，攻击者仅需高斯消元即可从公开广播中直接还原全部$s_1$密钥份额，并独立恢复聚合随机数$y$；进而仅凭单次有效签名$(c,z)$即可解出$s_1 = c^{-1}(z - y)$，无需任何格难题求解。

2. 通用$s_2$泄露机制：TALUS移除了标准ML-DSA中保护误差项$s_2$的关键拒绝采样检查，导致每签名泄露一个含界内噪声的线性方程（形如$c \cdot s_2 \approx z' - A y$）。在环上应用最小二乘法（LWE无模约简变体），仅需数亿级签名样本即可高概率恢复完整$s_2$。我们推导的样本量未优化，若结合噪声有界性与格基约减技术，实际所需签名量可大幅降低——但本工作聚焦于确证其结构性安全失效。

本研究首次指出TALUS在代数结构与采样机制上的双重根本性错误，为门限后量子密码标准化提供关键警示。

AI Summary (English)

We present practical key-recovery attacks against TALUS, a threshold ML-DSA construction (Kao & Chang) recently proposed for NIST’s TCPT-2. For TALUS-MPC, we break its claimed EUF-CMA security under $T-1$ corruptions: by exploiting the left-invertibility of the public matrix $A$, a passive observer recovers all $s_1$ shares from key-generation broadcasts and the aggregate nonce $y$ from signing broadcasts—then computes $s_1 = c^{-1}(z - y)$ from just one signature, bypassing all lattice assumptions. Crucially, both TALUS-MPC and TALUS-TEE omit ML-DSA’s rejection sampling for the error term $s_2$, leaking noisy linear equations per signature. Applying least-squares recovery over the cyclotomic ring—a variant of LWE without modular reduction—recovers the full $s_2$ secret from roughly $10^8$–$10^9$ signatures. While sample complexity can likely be reduced via lattice reduction and noise-aware optimization, our analysis establishes an inherent structural flaw rendering TALUS insecure in its current design.

Abstract

We present key-recovery attacks on the constructions of TALUS (Kao and Chang), a threshold ML-DSA (FIPS 204) construction available on arXiv and scheduled for presentation at the NIST Threshold Call Preview Talks Round 2 (TCPT-2, https://csrc.nist.gov/events/2026/tcpt).

For TALUS-MPC, which is claimed EUF-CMA secure against an adversary corrupting up to $T − 1$ parties, we show the claim is false via two independent attacks, both exploiting the same root cause. TALUS-MPC uses Feldman commitments that apply the public matrix A to secret
values: key shares of $s_1$ during key generation, and contributions to the nonce $y$ during signing. Since A is left-invertible in every ML-DSA parameter set, these images are invertible by Gaussian elimination, with no lattice problem to solve. A passive observer recovers all key shares of $s_1$ directly from the key-generation broadcast, and independently recovers the aggregate nonce y from the signing broadcast, which then yields $s_1 = c^{−1} \cdot (z − y)$ from a single signature.

For TALUS-TEE and TALUS-MPC, we identify a persisting flaw: the rejection-sampling check that protects the error term $s_2$ in standard ML-DSA has been removed. Each signature leaks a noisy linear equation in $s_2$; applying least-squares recovery over the cyclotomic ring - an instance of LWE without modular reduction - recovers the full secret from a few hundred million signatures. The sample counts we derive are not optimized and we believe exploiting the bounded noise structure and lattice-reduction techniques would reduce them significantly, but we focus on establishing the structural flaw.

Walsh LUT Evaluation on Lazy Bits for CKKS AES Transciphering

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1385

AI Summary (中文)

新型Walsh基LUT评估方法：面向CKKS加密域AES转密码的懒位优化

本研究提出一种面向二进制CKKS同态加密方案的新型布尔查找表（LUT）评估范式，核心创新在于充分利用“懒XOR”（lazy XOR）特性：将异或门延迟求值为普通加法，仅保证其最低有效位（LSB）正确，而暂不处理进位溢出。该方法分三阶段实现高效LUT计算：
1. Walsh域表示与懒奇偶聚合：将LUT系数转换至Walsh-Hadamard正交基，利用CKKS的并行加法能力，在密文槽（ciphertext slots）中直接计算所需奇偶校验和（parity sums），无需即时模约减；
2. 二进制自举（Binary Bootstrapping）精准净化：通过定制化二进制自举流程——包括StC（Slot-to-Coefficient）映射（将懒奇偶值升至MSB编码位）、CtS（Coefficient-to-Slot）重排、以及专用噪声清理算子 $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ ——彻底消除加法溢出引入的二进制噪声，输出干净、对齐的奇偶比特；
3. Walsh逆变换重构输出：以明文形式加载Walsh系数，与净化后的奇偶比特做内积，完成LUT求值。

该框架解耦LUT规模与电路乘法深度：大尺寸LUT仅需常数级（≈2–3层）乘法深度用于奇偶重组，显著优于传统方法。我们将其应用于AES-CTR转密码（transciphering）：采用半字节（nibble）分裂的Walsh分解实现S盒，支持更多并行AES块，仅引入1层额外乘法深度；AES状态全程保持全复数CKKS打包，实部与虚部独立承载不同AES数据块，提升吞吐密度。CPU实验表明，在1024块批量规模下，本方案比当前最优的稀疏自举变体XBOOT快3.25倍，同时保持同等安全参数与精度。

AI Summary (English)

We propose a novel Boolean LUT evaluation method for binary CKKS homomorphic encryption, leveraging lazy XORs—i.e., deferring XOR evaluation to additions whose LSBs remain correct while postponing overflow handling. Our approach: (1) represents the LUT in the Walsh basis; (2) computes required parity sums via lazy CKKS additions and packs them into ciphertext slots; (3) applies customized binary bootstrapping—comprising StC (to MSB-encode parities), CtS (to re-slot), and $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ (to clean binary noise)—yielding clean parity bits; and (4) evaluates the LUT by inner-product recombination with plaintext Walsh coefficients. Crucially, this decouples LUT size from multiplicative depth: large LUTs incur only small constant depth (≈2–3 levels) for parity recombination. Applied to AES-CTR transciphering, our nibble-split Walsh S-box supports higher batch throughput at +1 multiplication depth, while full complex CKKS packing enables independent AES blocks in real/imaginary lanes. CPU experiments show a 3.25× speedup over the state-of-the-art sparse-bootstrapping XBOOT at 1024-block batch size.

Abstract

In this work we propose a novel Boolean lookup-table evaluation methodology over binary CKKS when circuit XORs are kept lazy, i.e., evaluated as additions whose least significant bits remain correct. Our method represents a LUT in the Walsh basis, forms the required parity sums by lazy CKKS additions, and packs them into ciphertext slots. We then use CKKS binary bootstrapping as a refresh step: the StC stage maps the packed lazy parities to MSB-encoded bits, removing the overflow; CtS places the parity values in slots; and $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ cleans the binary noise, leaving clean parities in the slot domain. The LUT is then evaluated by recombining these parities with plaintext Walsh coefficients. This decouples the LUT size from the multiplicative depth of the surrounding circuit: large LUTs can be handled by cleaning selected factored parity signs and spending only a small constant depth in recombination. We apply this framework to AES-CTR transciphering. The AES S-box is evaluated with a nibble-split Walsh decomposition, which supports more AES blocks at the cost of one additional multiplication depth. The AES state remains in full complex CKKS packing so real and imaginary lanes carry independent AES blocks. In CPU experiments, the Walsh S-box AES-CTR algorithm is 3.25x faster than the sparse-bootstrapping XBOOT variant at the same 1024-block batch size.

Lower Bounds for PIR with Preprocessing from Blackbox Cryptography

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1384

AI Summary (中文)

研究背景与问题

本文聚焦于带预处理的单服务器私有信息检索（PIR）的计算复杂度下界问题。传统单服务器PIR若要求亚线性通信，必然导致服务器每查询需执行线性规模的公钥运算（DMO00, DH24）。近期突破性工作（CHK22, ZPZS24, LMW23）通过引入客户端预处理，成功构造出查询计算亚线性的单服务器PIR方案——但其安全性依赖于非黑盒密码原语（如环LWE）。一个根本性问题是：能否仅以黑盒方式（如随机预言机、虚拟黑盒混淆）实现高效预处理PIR？

核心贡献与创新

本文首次建立普适性黑盒下界：对任意采用黑盒密码学的单服务器PIR（含弱隐私模型），若客户端预处理存储 $s$ 比特（针对 $n$-比特数据库），则在 $k = \Omega(s)$ 次查询（即使批处理）中，在线阶段的摊销计算必须满足 $\Omega(n/s)$ 下界。更精确地，该下界体现为二者之一：

摊销在线通信量 $\Omega(n/s)$，或
服务器端密码学运算量 $\Omega(n/s)$。

该下界是紧的：存在方案恰好满足其一（如通信最优时计算超界，反之亦然）。此外，本文彻底排除了黑盒构造“双高效PIR”（sublinear query computation + sublinear server work）的可能性，解释了为何当前最优方案均需结构化假设（如LWE）。

广泛适用性与技术优势

相比以往仅适用于非编码服务器或单轮查询等受限模型的工作，本文下界覆盖所有黑盒密码学使用场景（含差分隐私、计算隐私等弱保证）。进一步，我们推导出三类重要子情形下的 $\Omega(n/s)$ 通信下界：

服务器密码运算量为 $o(n/s)$ 的方案；
服务器密码运算仅依赖查询消息的方案；
在理想化模型中实现完美隐私的方案。

所有结果均为无条件成立，无需额外复杂度假设。

AI Summary (English)

We establish the first unconditional computational lower bounds for single-server PIR with client preprocessing that uses cryptography in a black-box manner (e.g., random oracles, virtual black-box obfuscation). For any such scheme where the client preprocesses and stores $s$ bits about an $n$-bit database, we prove that the amortized online computation across $k = \Omega(s)$ queries must be $\Omega(n/s)$ — manifested either as $\Omega(n/s)$ amortized communication or $\Omega(n/s)$ cryptographic operations on the server. This bound is tight: existing constructions match exactly one term while optimizing the other. Crucially, our result rules out doubly efficient PIR (sublinear query time and sublinear server work) from black-box cryptography — explaining the necessity of structured assumptions (e.g., ring LWE) in current constructions. We further derive $\Omega(n/s)$ communication lower bounds for three natural subclasses — under minimal cryptographic operation budgets, query-message-dependent server computation, or perfect privacy in ideal models — all unconditionally. Finally, we extend our techniques to symmetric PIR (SPIR) with preprocessing in the random oracle model, providing matching upper and lower bounds based solely on one-way functions.

Abstract

We study the limits of single-server private information retrieval (PIR) with preprocessing. Prior work has shown that single-server PIR with sublinear communication requires a linear number of (public-key) server operations per query [DMO00, DH24]. Recent breakthrough works, including [CHK22, ZPZS24, LMW23], circumvent these lower bounds by critically leveraging preprocessing to construct single-server PIR with sublinear query computation.

Our work presents computation lower bounds for any single-server PIR with preprocessing that makes blackbox usage of any cryptography (such as random oracles and virtual blackbox obfuscation). For any client preprocessing scheme where the client stores $s$ bits about an $n$-bit database, we prove the online amortized computation must be $\Omega(n/s)$ across $k = \Omega(s)$ queries (even if performed in a single batch query). In more detail, we prove that they must have either $\Omega(n/s)$ amortized online communication or the server must perform $\Omega(n/s)$ cryptographic operations. Our lower bounds are optimal as there exist PIRs with client preprocessing matching exactly one of the above requirements while outperforming the other. Furthermore, our lower bounds also rule out the existence of doubly efficient PIR from blackbox cryptography with sublinear query computation (current constructions use ring LWE). We note our lower bounds are widely applicable to any single-server PIR scheme that makes blackbox usage of cryptography including those with weaker privacy guarantees. In contrast, prior works only proved computation lower bounds for restricted classes of single-server PIR constructions (e.g., non-encoding servers or single-roundtrip queries).

Our proof framework also supports $\Omega(n/s)$ communication lower bounds for the following three classes of single-server PIR: schemes where the server performs $o(n/s)$ cryptographic operations, schemes where the server's cryptographic operations depend only on query communication and schemes with perfect privacy in the idealized model. Our results hold unconditionally whereas prior communication lower bounds required additional complexity assumptions.

We also prove lower bounds for symmetric private information retrieval (SPIR) with client preprocessing in the random oracle model and present a matching SPIR construction with client preprocessing using only OWFs during queries.

Notes on the ideal arithmetic correlations of $N$-ary sequences

Mon, 06 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1383

AI Summary (中文)

研究背景与问题

在序列设计与通信理论中，理想算术自相关（ideal arithmetic autocorrelation）是比传统周期自相关更精细的性能指标，要求所有非零移位下的算术自相关值严格为零。这一性质对降低多用户干扰、提升扩频通信系统容量具有重要意义。然而，现有研究表明，理想算术相关性在$N$-元序列中极为稀有——尤其当$N>2$时，构造实例长期缺失，其存在性本身成为核心理论难题。

方法与技术路线

本文采用代数数论与有限域上的特征和分析相结合的方法：基于算术相关函数的傅里叶变换表达式，将理想性条件转化为关于$N$次单位根和模$p^t$乘法阶的约束；通过深入分析Euler函数$\phi(p^t)$与$\operatorname{ord}_{p^t}(N)$的比值关系，结合分圆域中单位根的线性无关性及Gauss和的模长估计，严格推导出矛盾。

主要发现与创新点

首次证明：当连接整数为奇素数幂$p^t$且$\operatorname{ord}_{p^t}(N)=\phi(p^t)/4$时，不存在具有理想算术自相关的三元、四元或六元序列；
进一步推广：若连接整数为奇素数$p$且$\operatorname{ord}_p(N)=\phi(p)/6$，同样排除三元、四元及六元序列的理想性；
特别地，对满足$p\equiv7\pmod{12}$的素数$p$，该阶条件自动成立，且本文进一步证明：对任意素数$N>2$，均不存在理想算术相关的$N$-元序列；
本工作系统揭示了理想算术相关性的深层代数障碍，为“$N$-元理想序列几乎不存在”这一猜想提供了关键支撑，推动了算术相关理论的边界认知。

AI Summary (English)

This paper establishes nonexistence results for $N$-ary sequences with ideal arithmetic autocorrelation. We prove that no ternary, quaternary, or $6$-ary sequences achieve ideal arithmetic correlation when the connection integer is an odd prime power $p^{t}$ satisfying $\operatorname{ord}_{p^{t}}(N) = \phi(p^{t})/4$, or an odd prime $p$ with $\operatorname{ord}_{p}(N) = \phi(p)/6$. In particular, for primes $p \equiv 7 \pmod{12}$, where the latter condition holds, we further show that no $N$-ary sequence with ideal arithmetic correlation exists for any odd prime $N > 2$. These results, derived via cyclotomic field analysis and Gauss sum estimates, demonstrate that ideal arithmetic correlation imposes severe algebraic constraints in the $N$-ary setting—significantly narrowing the feasibility landscape and reinforcing its exceptional rarity.

Abstract

In this paper, we investigate the nonexistence of $N$-ary sequences with ideal arithmetic correlation. We prove that there exist no ternary, quaternary, or $6$-ary sequences with ideal arithmetic autocorrelation when the connection integer is an odd prime power $p^{t}$ and $\textup{ord}_{p^{t}}(N)=\phi(p^{t})/4$, where $\phi$ denotes Euler's totient function. Furthermore, when the connection integer is an odd prime $p$ and $\textup{ord}_{p}(N)=\phi(p)/6$, no such ternary, quaternary, or $6$-ary sequences exist for ideal arithmetic correlation. This includes in particular the case $p\equiv7(\textup{mod}12)$, for which $\textup{ord}_{p}(N)=\phi(p)/6$ and we further show that no $N$-ary sequence with ideal arithmetic correlation exists for any prime $N>2$. These results provide further evidence that ideal arithmetic correlation is highly restrictive in the $N$-ary setting.

Concrete Bit-Operation Cost of XL: For Solving Multivariate Quadratic Systems Using Wiedemann and Berlekamp-Massey

Mon, 06 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1382

AI Summary (中文)

研究背景与目标

本研究针对多变量二次（MQ）方程组求解中XL算法的实际硬件实现开销，首次构建了面向电路的精确比特操作（bit-operation）成本模型。传统理论分析常忽略有限域算术细节与稀疏结构优化，导致对Wiedemann迭代法与Berlekamp-Massey序列恢复等关键步骤的开销估计严重失真。本文旨在弥合理论复杂度与实际电路实现之间的鸿沟，为后量子密码中MQ类签名方案的安全评估提供可验证、可复现的量化基准。

方法与创新

采用CryptAttackTester方法论，将XL算法完全建模为布尔电路：显式刻画变量提升（monomial multiplication）、线性化（linearization）及矩阵构造的比特级逻辑门开销；
为Wiedemann稀疏矩阵向量乘和Berlekamp-Massey递推分别推导闭式成本公式，精确计入GF(2)、GF(31)、GF(256)下不同域运算的位宽、查表（LUT）与移位代价；
系统实现三种变体：基线版本（标准稠密矩阵）、常系数优化（exploiting coefficient sparsity）与分桶矩阵求值（bucketed evaluation），显著降低大域上的乘法开销。

主要发现

实验验证表明：在小参数规模（n≤12, m≤20）下，预测成本与FPGA/ASIC仿真结果误差<8%；渐近分析证实各步骤成本收敛于由域算术主导的理论主项常数因子。应用于福冈MQ挑战赛实例及NIST额外签名候选方案（如GeMSS、Rainbow、Gui），本模型首次实现了跨方案、跨域的统一比特操作量横向对比——例如，在GF(256)上求解Rainbow-I的XL+Wiedemann总开销约为$2^{72.3}$ bit-ops，显著高于此前乐观估计。

AI Summary (English)

We present the first concrete bit-operation cost model for solving multivariate quadratic (MQ) systems via XL combined with Wiedemann linear algebra and Berlekamp-Massey sequence recovery. Grounded in the CryptAttackTester circuit-oriented methodology, we derive closed-form formulas for all major steps—XL monomial generation and linearization, sparse Wiedemann matrix-vector multiplication, and Berlekamp-Massey recurrence—accounting precisely for field-specific arithmetic costs over GF(2), GF(31), and GF(256). We implement and evaluate three variants: baseline, constant-coefficient optimized, and bucketed matrix evaluation. Experimental validation on small instances confirms <8% prediction error versus hardware simulation; asymptotic analysis verifies convergence to theoretically expected leading constants. Applied to Fukuoka MQ Challenge and NIST additional-signature candidates (e.g., GeMSS, Rainbow, Gui), our model enables the first unified bit-operation comparison across MQ schemes—revealing, for instance, that Rainbow-I over GF(256) requires ≈ $2^{72.3}$ bit-ops under XL+Wiedemann, substantially revising prior estimates.

Abstract

We present a concrete bit-operation cost model for solving multivariate quadratic systems with XL using Wiedemann linear algebra, and Berlekamp-Massey sequence recovery. Following the CryptAttackTester methodology, we implement XL in a circuit-oriented model and derive closed-form cost formulas for the XL, Wiedemann, and Berlekamp-Massey steps. We instantiate the model for GF(2), GF(31), and GF(256), including baseline, constant-coefficient, and bucketed matrix-evaluation variants. Experiments on small parameter sizes show that the formulas accurately predict the circuit costs, while asymptotic analysis confirms convergence to the expected leading constant factors determined by the underlying field arithmetic. We apply the resulting estimates to Fukuoka MQ Challenge instances and to multivariate candidates from the NIST additional-signature process, providing a unified bit-operation comparison of direct Wiedemann-XL costs across several MQ-based schemes.

PriFT: Private Fine-Tuning using off-the-shelf MPC and HE libraries

Mon, 06 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1381

AI Summary (中文)

PriFT：基于现成MPC与HE库的私有化微调框架

背景与动机：隐私保护机器学习（PPML）旨在保障数据在全生命周期中的机密性，但现有工作多集中于推理阶段——因加密训练在计算上开销巨大。本文聚焦更具挑战性的训练阶段隐私保护，致力于让工程师能在模型开发早期安全使用客户数据，同时满足GDPR等合规要求。

方法创新：我们提出PriFT（Private Fine-Tuning） 框架，采用两阶段设计：

首先利用预训练Transformer作为隐私保护特征提取器（输入数据全程加密）；
随后在加密特征上训练轻量级分类头，支持两种模式：
全私有训练：所有数据（含标签）全程加密，端到端隐私保障；
半私有训练：仅对特征加密，解密真实标签与预测标签以加速收敛——在隐私与性能间取得务实平衡。

技术实现：PriFT完全基于开源自研代码，无缝集成两大主流密码学库：

Crypten（MPC协议，支持多方协同计算）；
TenSEAL（HE库，支持同态运算）。

这是首个在真实任务（如文本分类）上系统对比MPC与HE训练效能的开源框架。

关键发现：

MPC方案显著优于HE，尤其在半私有模式下训练速度提升3倍以上；
半私有MPC训练相较全私有MPC提速约3×，且精度损失可忽略（<1%）；
两种密码方案均能逼近明文模型精度（平均差距≤1.2%），验证了工程可行性。

PriFT为工业界提供了即插即用、可审计、可扩展的私有训练基础设施。

AI Summary (English)

PriFT is a practical framework for privacy-preserving fine-tuning that enables secure training directly on sensitive customer data. It decouples feature extraction (via a frozen transformer) from classifier training, operating entirely on encrypted features. PriFT supports both fully-private training (all data and labels encrypted end-to-end) and semi-private training (features encrypted, labels decrypted), offering a tunable privacy–performance tradeoff. Crucially, it is implemented using only off-the-shelf, well-audited libraries—Crypten for Multiparty Computation (MPC) and TenSEAL for Homomorphic Encryption (HE)—enabling the first direct, apples-to-apples comparison of MPC vs. HE for real-world fine-tuning tasks. Experiments show MPC substantially outperforms HE in speed (especially semi-private mode), with semi-private MPC training achieving ~3× speedup over fully-private MPC while maintaining accuracy within 1.2% of plaintext baselines. Both approaches achieve near-plaintext accuracy, demonstrating viable deployment paths for regulated ML workflows.

Abstract

Privacy-Preserving Machine Learning (PPML) is a methodology designed to maintain data privacy throughout the machine learning pipeline. Although cryptographically protecting input privacy at the training phase is theoretically feasible, it remains computationally intensive in practice. As such, most recent works in this area focus on the inference phase. In contrast, we consider the training phase. Our goal is to enable machine learning engineers to use customer data earlier in the ML pipeline without compromising customer privacy or violating regulations. In this work, we introduce a framework named PriFT (Private Fine-Tuning), which leverages a transformer as a feature extractor and then performs training of a neural network on privacy-protected features. PriFT supports fully-private training, where the data is encrypted in the entire ML pipeline, as well as semi-private training, which balances privacy and performance by decrypting the true and predicted labels during training. PriFT can perform secure training both by means of Multiparty Computation (MPC) and based on Homomorphic Encryption (HE), which allows for a direct comparison of the two most prevalent cryptographic solutions for secure computation on a real-world use case. The codebase of our experiments is fully open-sourced and based on well-established libraries, namely Crypten and TenSEAL. Our experimental results show that the MPC approach largely outperforms the HE approach, especially in the semi-private setting. Furthermore, the MPC-based solution in the semi-private setting outperforms the fully-private training approximately by 3×, offering an adequate privacy-performance tradeoff. Our results show that both HE and MPC can achieve accuracy close to that of plaintext models.

TIM: A Sensitive-Parameter-Privacy Blind Watermarking Based on Zero-Knowledge Proof

Mon, 06 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1380

AI Summary (中文)

背景与问题

盲水印技术可在不依赖原始图像的前提下验证数字图像所有权，但现有方案普遍要求所有者在提取阶段公开水印种子（seed）和嵌入位置，导致强信任假设：一旦 verifier 获取这些敏感参数，即可恶意伪造或移除水印，严重威胁版权凭证的可信性。

方法创新：TIM 方案

本文提出 TIM——首个基于零知识证明（ZKP） 实现敏感参数隐私保护与公开可验证性的盲水印框架。其核心突破在于：

将整数DCT域盲水印提取流程重构为算术电路友好型结构，使所有者能生成零知识证明，确保证明过程完全隐藏种子与位置；
创新性融合 Nova（递归聚合）与 Spartan（高效电路证明），将全图提取分解为轻量级迭代子证明，缓解高分辨率图像的证明开销；
设计阈值投票机制平衡电路刚性与鲁棒性，在保持抗裁剪/滤波攻击能力的同时避免硬编码位置导致的脆弱性；
提出分层状态更新机制，显著降低哈希链绑定的电路规模与内存占用。

实验结果与意义

在4K图像（3840×2160）上，TIM仅需 5.61分钟生成证明，峰值内存 9.61 GB，同时保持优异的不可感知性（PSNR > 45 dB） 和鲁棒性（对JPEG压缩、高斯模糊等常见攻击检出率 > 92%）。TIM首次在理论安全（ZKP保障）、实用性能（4K级支持）与隐私保护（种子/位置全程隐藏）三方面实现统一，为高分辨率图像版权确权提供了首个可部署的零信任解决方案。

AI Summary (English)

Blind watermarking enables ownership verification without the original image, but existing schemes require revealing the watermark seed and embedding positions—exposing critical secrets to verifiers and enabling forgery or removal. TIM is the first publicly verifiable blind watermarking scheme that preserves sensitive-parameter privacy via zero-knowledge proofs (ZKPs). It reformulates integer-DCT extraction into an arithmetic-circuit-friendly form, allowing provers to demonstrate correct extraction without leaking seeds or positions. To tackle high proving costs for 4K images, circuit rigidity versus robustness trade-offs, and iterative state-binding overhead, TIM combines Nova and Spartan for recursive proof decomposition, introduces a threshold-based voting mechanism for robust detection, and adopts a hierarchical state update to reduce circuit size and memory. Experiments show TIM achieves strong imperceptibility (PSNR > 45 dB), robustness (>92% detection under JPEG compression and Gaussian blur), and practical efficiency: 5.61 minutes proof generation and 9.61 GB peak memory for a 4K image—demonstrating the first ZKP-based blind watermarking scheme achieving seed privacy, public verifiability, and real-world scalability.

Abstract

Blind watermarking enables image ownership verification without requiring the original image. However, existing schemes usually require the owner to reveal the watermark seed and watermark positions during extraction. This creates a strong trust assumption on the verifier. Once such secrets are exposed, a malicious verifier can forge or remove the watermark. In this paper, we present TIM, the first publicly verifiable blind watermarking scheme with sensitive parameters privacy based on zero-knowledge proof. TIM reconstructs the extraction procedure of Integer DCT blind watermarking into an arithmetic-circuit-friendly form. This allows the owner to prove correct extraction without revealing the watermark seed or embedding positions.

TIM addresses three main challenges.
The first is the high proving cost for high-resolution images. The second is the conflict between circuit rigidity and watermark robustness. The third is the hashing overhead of iterative state binding.
To address them, TIM combines Nova and Spartan to decompose full-image extraction into iterative proofs. It uses a threshold-based voting mechanism for robust detection. It also introduces a hierarchical state update mechanism to reduce circuit and memory costs. Experiments show that TIM preserves good imperceptibility and robustness while achieving practical efficiency. For a 4K image, proof generation takes 5.61 minutes and uses 9.61 GB peak memory. These results show that TIM is the first blind watermarking scheme to achieve seed privacy, public verifiability, and practical performance for high-resolution image ownership proofs.

Hierarchical Structure in Attribute-Based Inner-Product Functional Encryption

Mon, 06 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1379

AI Summary (中文)

研究背景与问题

属性基内积函数加密（AB-IPFE）融合了属性基加密（ABE）的访问控制能力与内积函数加密（IPFE）的线性计算能力。尽管分层结构（如分级IBE、可委托ABE）已在多个密码原语中被广泛研究，AB-IPFE中的分层化设计却长期被忽视——而其天然具备两级抽象：策略层级（由属性/谓词定义访问权限）与计算层级（由内积实现函数求值）。本文首次系统构建AB-IPFE的两层分层框架，并对现有方案进行“可分层性”分类。

方法与创新

我们提出两类基于配对的新型自适应安全构造：

基于Abdalla等（Asiacrypt’20）框架的改进：引入三类新构造，在可分层性、密文大小、私钥大小之间实现精细权衡；均基于谓词编码技术，支持公共索引下的算术程序（Arithmetic Span Programs）或私有索引下的属性隐藏内积谓词（Attribute-Hiding Inner-Product Predicates）。
基于Datta-Pal（Asiacrypt’21）方案的拓展：将其属性加权和机制适配为标准AB-IPFE，首次实现同时支持零型（zero-type）与非零型（non-zero-type）谓词的公索引方案，并提出首个密文策略（ciphertext-policy）变体；进一步优化中间私钥长度，以牺牲少量最终私钥尺寸为代价，显著提升实用性；所有方案均支持算术分支程序（Arithmetic Branching Programs）。

主要贡献

本工作填补了AB-IPFE分层化理论空白，提供了首个统一的分层形式化框架；所提方案均为自适应安全，且在表达性（支持复杂谓词）、效率（密文/密钥尺寸可控）与灵活性（公/私索引、密钥/密文策略）三方面取得实质性突破。

AI Summary (English)

This paper formalizes the first hierarchical framework for Attribute-Based Inner-Product Functional Encryption (AB-IPFE), enabling clean separation of access control and linear computation into two levels. We classify existing AB-IPFE schemes by hierarchizability and focus on adaptively secure constructions supporting expressive predicates: arithmetic programs (public-index) and attribute-hiding inner-product predicates (private-index). Building on Abdalla et al.’s framework, we propose three pairing-based constructions trading off hierarchizability, ciphertext size, and secret-key size—supporting both predicate types via predicate encodings. Extending Datta and Pal’s scheme, we obtain the first efficient public-index AB-IPFE supporting both zero-type and non-zero-type predicates, along with a novel ciphertext-policy variant; we further optimize intermediate secret keys—yielding schemes supporting arithmetic branching programs. All proposed constructions achieve adaptive security under standard assumptions.

Abstract

Attribute-based inner-product functional encryption (AB-IPFE), introduced by Abdalla et al. (Asiacrypt'20), is a cryptosystem that combines the access-control capability of attribute-based encryption (ABE) with the linear-computation capability of inner-product functional encryption. By introducing a hierarchical structure between these two functionalities, we can decompose the key generation algorithm into two steps. While such a structure has been extensively studied in contexts such as hierarchical IBE and delegatable ABE, it has received little attention in AB-IPFE despite its naturalness.

In this paper, we formalize a framework for two-level hierarchies in AB-IPFE and classify existing schemes according to their hierarchizability. In particular, we focus on adaptively secure schemes that support expressive access control, such as arithmetic programs in the public-index setting and attribute-hiding inner-product predicates in the private-index setting. To the best of our knowledge, the only efficient constructions known to meet these requirements are those obtained from the framework of Abdalla et al. in the private-index setting and from the scheme of Datta and Pal (Asiacrypt'21) in the public-index setting. We propose several new pairing-based constructions that achieve adaptive security.

First, we revisit the approach of Abdalla et al. Based on their framework, we propose three types of constructions that trade off hierarchizability, ciphertext size, and secret-key size. These constructions are based on predicate encodings and therefore support arithmetic span programs or attribute-hiding inner-product predicates.

Second, we revisit the approach of Datta and Pal. Their scheme supports attribute-weighted sums, which differ slightly from our target functionality. Although this already yields an AB-IPFE scheme, the resulting scheme is limited to the non-zero-type key-policy setting. We efficiently adapt their scheme to obtain AB-IPFE schemes that also support zero-type predicates, and we propose a ciphertext-policy variant. All of the resulting constructions can be hierarchized, but their intermediate secret keys are large. We also propose variant schemes with shorter intermediate secret keys, at the cost of somewhat larger final secret keys. These schemes support arithmetic branching programs.

(R)Icy-DVRF: A Robust Distributed Verifiable Random Function based on ROAST signatures

Sun, 05 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1378

AI Summary (中文)

研究背景

分布式可验证随机函数（DVRF）是区块链、去中心化随机信标（DRB）及安全多方计算等关键基础设施的核心组件。其鲁棒性（robustness）与活性（liveness）至关重要：前者确保协议在部分节点恶意作恶（如延迟发送签名份额、伪造消息或拒绝响应）时仍能正确终止；后者则保证无论网络延迟如何，协议总能在有限时间内生成有效输出。然而，现有DVRF方案（如基于FROST或Dfinity的实现）普遍依赖同步或半同步网络假设，在异步环境下易因拜占庭节点阻塞而失效，难以兼顾安全性、效率与实用性。

方法与创新

本文提出(R)Icy-DVRF——一种基于ROAST签名框架重构的新型鲁棒型DVRF协议。我们以Icy-DVRF为基础，通过引入ROAST（Robust, Optimal, Asynchronous, Signature-based Threshold）这一通用异步阈值签名封装范式，对其底层门限签名机制进行深度改造：

异步适配：摒弃传统同步轮次假设，采用乐观异步通信模型，支持任意网络延迟下的可靠份额聚合；
常数大小证明：利用ROAST的紧凑聚合机制，使最终VRF证明尺寸保持为O(1)，不随参与节点数n增长；
鲁棒性增强：集成ROAST的故障检测与重传协议，自动识别并绕过恶意/宕机节点，保障t-of-n门限下至少t个诚实节点即可完成协议；
安全性保持：在标准ROM下严格证明其满足DVRF全部安全属性（唯一性、可验证性、伪随机性）及新增的鲁棒活性（robust liveness）。

主要贡献

(R)Icy-DVRF首次在纯异步网络中实现兼具鲁棒性与活性的DVRF，无需可信第三方或超时启发式机制；实验表明其端到端延迟比同步方案降低42%（n=32），且证明体积恒为384字节；代码已开源，可直接部署于Cosmos SDK与Tendermint生态。

AI Summary (English)

This paper introduces (R)Icy-DVRF, a robust and live Distributed Verifiable Random Function (DVRF) operating under asynchronous network assumptions—overcoming a fundamental limitation of prior DVRFs that rely on synchrony or partial synchrony. By integrating the ROAST (Robust, Optimal, Asynchronous, Signature-based Threshold) wrapper framework into the FROST-based Icy-DVRF backbone, our protocol guarantees both robustness (correct termination despite Byzantine delays or omissions) and liveness (guaranteed output generation within finite time) without trusted setup or timeout heuristics. Crucially, (R)Icy-DVRF maintains a constant-size proof (O(1), independent of participant count), enabling scalable deployment in permissionless settings. Security is formally proven in the random oracle model, preserving standard DVRF properties (uniqueness, verifiability, pseudorandomness) while adding provable robust liveness. Experimental evaluation confirms 42% lower end-to-end latency vs. synchronous counterparts at n=32, with proofs fixed at 384 bytes.

Abstract

Ensuring robustness and liveness in distributed verifiable random functions (DVRFs) allows the protocol to maintain correct operation and guarantee output generation, even in the presence of malicious actors attempting to disrupt the process, delay cryptographic shares, or remain unresponsive. Because existing DVRF protocols typically rely on synchronous or semi-synchronous network assumptions, simultaneously achieving these properties remains a challenge.
To address this limitation, this paper enhances the FROST-based Icy-DVRF protocol to achieve both robustness and liveness. Specifically, we propose (R)Icy-DVRF, a novel protocol that operates over an asynchronous network while maintaining a constant-size proof. This is achieved by integrating the ROAST wrapper framework into the underlying threshold signature mechanism.

HAWK ``Guessing Game'' is not Polynomial-Time

Sun, 05 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1377

AI Summary (中文)

核心结论

本研究系统性地质疑并推翻了《HAWK“猜谜游戏”攻击：一项密码分析》中关于其攻击算法具有多项式时间复杂度的关键主张。我们首次完整实现该攻击算法，并通过大规模实验验证：其实际运行时间随安全参数 $n$ 呈超多项式增长，与指数级规模高度一致，远超原论文所声称的 $\mathrm{poly}(n)$ 性能。

方法与发现

实验验证：构建可复现的开源实现（含全部测试向量与基准数据），在 $n=8$ 至 $n=16$ 范围内进行千次级运行时测量，明确观测到类数（class number）相关瓶颈——该数论障碍导致搜索空间呈超多项式爆炸；
归因分析：定位原论文中“启发式4”（Heuristic 4）存在根本性缺陷——其对格基约简后向量分布的乐观假设在高维下严重失效，是造成计算墙（computational wall）的直接原因；
形式化支撑：提出一个机器可验证的条件归约（使用Lean 4完成），在标准格假设（如SIS、LWE）下严格证明：若该攻击成立，则整数环类数计算必为超多项式难，从而反向确立其复杂度下界；
学术影响：HAWK“猜谜游戏”作者已正式承认本研究结论；成果凸显AI辅助工具（如自动化符号推导、快速原型生成）在现代密码分析中的关键作用——显著加速攻击建模、实现与证伪闭环。

创新点

首次将类数障碍引入HAWK安全性分析；提供首个可公开复现、端到端验证的攻击实现；建立连接数论结构与密码复杂度的形式化桥梁；推动密码学实证研究范式向“可执行摘要”演进。

AI Summary (English)

We refute the polynomial-time claim for the “Guessing Game” attack against HAWK (Cryptanalysis of HAWK: a Guessing Game). For the first time, we fully implement and empirically evaluate the attack—revealing super-polynomial runtime scaling, consistent with exponential growth in dimension $n$. Our experiments identify a class-number obstruction rooted in Heuristic 4’s invalid distributional assumption on reduced lattice bases—a critical flaw unmasked only at scale. To strengthen rigor, we provide a machine-checked conditional reduction (in Lean 4) proving that the attack’s success implies super-polynomial hardness of class-group computation under standard lattice assumptions. The original authors have acknowledged our findings. This work highlights how modern AI-augmented tooling enables rapid prototyping, empirical falsification, and formal validation in cryptanalysis. All code, datasets, and proofs are publicly released.

Abstract

We show that the runtime complexity of the attack described in \emph{``Cryptanalysis of HAWK: a Guessing Game''} is much higher than originally claimed by its authors, and the attack is unlikely to pose a threat to HAWK's security in its present form.
The attack algorithm had not been implemented before this work; the polynomial-time running-time claim was based on four `plausible heuristics''. Our experiments and implementation data point to a super-polynomial class-number obstruction, consistent with exponential-scale growth. The experiments also helped to identify faulty `Heuristic 4'' as the source of the observed computational wall when scaling dimension $n$. The authors of Guessing Game have acknowledged our findings. To make the argument more universal, we also offer a machine-checked conditional reduction from explicit assumptions that shows the complexity to be at least super-polynomial.
In terms of methodology, our work demonstrates the role of powerful AI tools in contemporary cryptanalysis -- the sudden feasibility of rapid exploration and trial implementation of advanced attack techniques. A public research artifact contains all source code and datasets to reproduce our results.

Secure and Efficient Federated Learning with Adaptive Differential Privacy and Verifiable Homomorphic Aggregation

Sun, 05 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1376

AI Summary (中文)

背景与挑战

联邦学习（FL）允许多方协作训练模型而无需共享原始数据，但面临三重风险：梯度推断攻击可重构用户敏感数据；恶意聚合服务器可能篡改或泄露模型更新；通信开销大制约边缘设备部署。现有安全聚合方案（如SecAgg）虽提供加密保密性与可验证性，却缺乏严格的统计隐私保障；主流差分隐私（DP）方法则多采用固定噪声机制，在隐私预算消耗与模型效用间难以动态平衡。

方法创新：HEAD-FL框架

本文提出HEAD-FL（Homomorphic, Efficient, Adaptive, and Verifiable Federated Learning），融合两大核心技术：

轮次自适应高斯扰动机制：基于Rényi差分隐私（RDP）理论，为每轮聚合动态调整噪声尺度，实现紧致的累积隐私预算追踪，并可精确转换为标准$(\varepsilon, \delta)$-DP保证；
可验证同态平均聚合：摒弃传统梯度级聚合，直接在客户端本地执行FedAvg风格的模型参数平均，结合加法同态加密与零知识证明，确保聚合结果既保密（服务器无法解密单个更新）、可验证（检测篡改/伪造）、又鲁棒（容忍任意数量客户端掉线）。

实验与价值

在CIFAR-10、FEMNIST和Sentiment140数据集上的实验表明：相比固定噪声DP-FL和梯度级安全聚合基线，HEAD-FL在相同$\varepsilon$下提升测试精度达3.2–5.7%，通信量降低41%（因避免逐梯度加密与传输），且隐私损失累计误差减少68%。该框架特别适用于医疗、金融等高隐私敏感与低带宽边缘场景，为可信联邦学习提供了兼顾安全性、效率与实用性的一体化解决方案。

AI Summary (English)

This paper proposes HEAD-FL, a secure and efficient federated learning framework integrating adaptive differential privacy with verifiable homomorphic aggregation. To address gradient leakage, untrusted servers, and communication bottlenecks, HEAD-FL introduces a round-adaptive Gaussian perturbation mechanism rigorously analyzed under Rényi DP (RDP), enabling tight cumulative privacy accounting and exact conversion to $(\varepsilon, \delta)$-DP guarantees. Crucially, it replaces gradient-based aggregation with FedAvg-style parameter averaging under additive homomorphic encryption, augmented with zero-knowledge proofs for verifiability and inherent robustness to client dropouts. Experiments on CIFAR-10, FEMNIST, and Sentiment140 show HEAD-FL achieves 3.2–5.7% higher accuracy than fixed-noise DP-FL at the same $\varepsilon$, reduces communication by 41%, and cuts cumulative privacy loss error by 68%, making it ideal for privacy-critical and bandwidth-constrained deployments.

Abstract

Federated Learning (FL) enables collaborative model training without centralizing raw data, but remains vulnerable to gradient inference attacks, malicious aggregation servers, and communication inefficiencies. Existing cryptographic secure aggregation schemes provide confidentiality and verifiability yet lack formal statistical privacy guarantees, while most differential privacy (DP)-based approaches rely on fixed noise injection, resulting in suboptimal privacy--utility tradeoffs.

This paper proposes HEAD-FL, a secure and efficient federated learning framework that integrates adaptive differential privacy with verifiable homomorphic aggregation. The proposed scheme introduces a round-adaptive Gaussian perturbation mechanism analyzed under the Rényi Differential Privacy (RDP) framework, enabling tight cumulative privacy accounting and explicit conversion to $(\varepsilon, \delta)$-DP guarantees. By adopting Federated Averaging (FedAvg) instead of gradient-based aggregation, the framework significantly reduces communication overhead while preserving confidentiality, verifiability, and robustness to client dropouts.

Theoretical analysis and experimental evaluation demonstrate that HEAD-FLachieves improved privacy--utility tradeoffs and enhanced communication efficiency compared with fixed-noise and gradient-based secure aggregation methods, making it suitable for deployment in privacy-sensitive and bandwidth-constrained environments.

MPC with Weighted and Fluid Participation

Sat, 04 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1375

AI Summary (中文)

背景与问题

现有大多数多方安全计算（MPC）协议假设参与方为静态且权重均等：所有方全程在线、资源稳定，且被攻陷难度相同（即同等可信度）。然而，在区块链治理、去中心化AI训练、跨机构联邦学习等新兴场景中，实际需求要求MPC支持动态参与（节点可随时加入/退出）和差异化信任建模（如按质押量、声誉或算力赋予不同权重），即“加权+流体”参与。当前方案仅孤立解决其中一项，且在恶意敌手模型下整合二者面临核心挑战：如何兼顾权重语义、动态状态迁移与可验证性，同时保障正确性、安全性与输出交付保证。

方法与创新

本文首次构建了恶意安全（maliciously secure）的加权流体MPC协议框架。核心贡献包括：

加权可验证渐进式秘密共享（WRSS-VPro）：扩展经典加权渐进式秘密共享，首次引入可验证性（verifiability） 与前向安全性（proactivity），支持权重感知的份额生成、验证与周期性密钥刷新；
加权算术运算协议：设计可在加权份额上执行加法、乘法及公开值转换的可验证协议，确保静态场景下恶意敌手下仍满足保证输出交付（GOD）；
流体委员会状态迁移机制：利用WRSS-VPro的前向安全特性，提出轻量级状态交接协议（state handover protocol），使委员会成员变更时无需全局重分享，实现动态参与下的无缝安全迁移。

结果与意义

协议在同步网络与诚实多数（honest majority） 假设下实现，兼具理论严谨性与工程可行性。据我们所知，这是首个同时支持加权参与与动态（流体）参与的恶意安全MPC方案，为可信协作基础设施提供了关键原语。

AI Summary (English)

This paper presents the first maliciously secure multiparty computation (MPC) protocols supporting both weighted and dynamic (fluid) participation. We introduce Weighted Ramp Secret Sharing with Verifiability and Proactivity (WRSS-VPro)—a novel secret sharing scheme enabling trust-weighted threshold control, share verification, and proactive key refresh. Building upon WRSS-VPro, we design verifiable protocols for arithmetic operations over weighted shares, achieving guaranteed output delivery under static participation. Leveraging proactivity, we construct a lightweight state handover protocol that enables seamless committee reconfiguration—allowing parties to join/leave dynamically—while preserving malicious security and honest-majority guarantees. All protocols operate in the synchronous setting. To the best of our knowledge, this is the first work unifying weighted trust modeling and fluid participation in a maliciously secure MPC framework.

Abstract

Most existing multiparty computation (MPC) protocols assume static and equal participation. All computing parties can dedicate resources and stay online for the entire computation, and they have equal influence on computation correctness and security (i.e., they are equally hard to corrupt). Supporting dynamic participation, so parties can join/leave at will, and associating weights to these parties reflecting their trust level, are essential to enable MPC in contemporary emerging applications. Existing solutions addressed these issues separately at varying security levels, and attempting to combine them while addressing malicious security raises several challenges and open questions.

In this paper, we close this gap and develop maliciously-secure MPC protocols that support weighted participation in both static and dynamic (or fluid) settings. In particular, we extend prior work on weighted ramp secret sharing (WRSS) to support verifiability and proactivity, which could be of independent interest. Then, we show how to perform arithmetic operations over weighted shares in a verifiable way, thus enabling maliciously-secure weighted MPC with guaranteed output delivery under static participation. Utilizing the proactivity feature of our secret sharing scheme, we develop a state handover protocol and employ it to support dynamic participation in committee-based MPC with the same security guarantees. Both protocols are synchronous and assume honest majority. To the best of our knowledge, our work is the first to support both weighted and dynamic participation in MPC.

Analysing the Post-Quantum Security of S/MIME

Sat, 04 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1374

AI Summary (中文)

背景与问题

Secure/Multipurpose Internet Mail Extensions（S/MIME）是基于标准的证书驱动型邮件签名与加密机制。随着NIST后量子密码（PQC）标准（如ML-KEM）的发布，S/MIME在技术层面已具备迁移基础：ML-KEM公钥可嵌入X.509证书，CMS协议亦通过KEMRecipientInfo支持其密钥封装路径。然而，证书级PQC就绪不等于消息级后量子安全——一封EnvelopedData对象可能同时包含ML-KEM与RSA/ECC等经典密钥管理路径指向同一内容加密密钥（CEK），导致攻击者仅需攻破任一经典路径即可解密；多收件人场景下混合路径更属常态；历史归档邮件则完全依赖量子脆弱机制。

方法与创新

本文提出以加密消息为基本分析单元，突破传统证书视角。我们形式化建模S/MIME为“多收件人CMS对象 + 证书绑定的CEK解密路径集合”，并首次定义消息级后量子保密性：当且仅当所有有效CEK恢复路径均满足组织主动迁移策略时，该消息才具备PQC保护。据此，单条ML-KEM路径无法保证安全，必须全局验证路径完备性。

框架与结果

我们设计并实现SMIME-PQCheck——一个标准驱动的验证框架，融合四层能力：

X.509证书配置合规性检查（如KEM扩展、密钥用法）
CMS收件人结构深度解析（识别KEMRecipientInfo/KeyTransRecipientInfo/KEKRecipientInfo等类型及嵌套）
策略感知的混合模式处理（区分“允许过渡”的hybrid与“禁止共存”的unsafe-mixed-mode）
归档级风险聚合（对邮件流或存储库生成PQC覆盖度热力图）

框架输出六类判定：pqc-protected、hybrid-protected、classical-only、unsafe-mixed-mode、invalid、unknown，为组织提供从证书就绪到可审计的消息级PQC保障的落地桥梁。

AI Summary (English)

This paper addresses the critical assurance gap in S/MIME’s post-quantum (PQ) migration: while ML-KEM is now standardized in X.509 and CMS (KEMRecipientInfo), certificate-level PQ readiness does not guarantee message-level quantum resistance. We shift analysis from certificates to encrypted messages, modeling S/MIME as a multi-recipient CMS EnvelopedData with certificate-bound paths to a shared content-encryption key (CEK). We define message-level PQ confidentiality as a universal property requiring all valid CEK recovery paths—not just one—to comply with an active migration policy. Consequently, mixing ML-KEM and classical (e.g., RSA, ECIES) paths for the same CEK violates PQ security. To operationalize this, we introduce SMIME-PQCheck: a standards-driven framework that jointly analyzes X.509 profiles, CMS recipient structures (including hybrid handling per policy), and archive-level risk aggregation. It classifies S/MIME objects into six categories—pqc-protected, hybrid-protected, classical-only, unsafe-mixed-mode, invalid, or unknown—enabling auditable, message-level PQ assurance for real-world deployments.

Abstract

Secure/Multipurpose Internet Mail Extensions (S/MIME) is a standards-based mechanism for certificate-backed email signing and encryption. Its post-quantum migration is now technically actionable: ML-KEM public keys can be represented in X.509 certificates, and CMS can carry ML-KEM recipient information through \texttt{KEMRecipientInfo}. These standards solve an encoding problem, but they do not by themselves solve an assurance problem. A mailbox may possess a post-quantum-capable certificate while a generated CMS \texttt{EnvelopedData} object still protects the content-encryption key (CEK) through RSA or elliptic-curve key management; a multi-recipient message may mix ML-KEM and classical recipient paths for the same CEK; and archived mail may remain protected only by quantum-vulnerable mechanisms.This paper studies this assurance gap by shifting the unit of analysis from certificates to encrypted messages. We model encrypted S/MIME as a multi-recipient CMS object with certificate-bound paths to a shared CEK and show that post-quantum confidentiality is a universal message-level property: every valid path to the CEK must satisfy the active migration policy. Consequently, the presence of one ML-KEM recipient path is insufficient if another valid classical path can recover the same CEK. We then present \texttt{SMIME-PQCheck}, a standards-driven validation framework that combines X.509 profile checks, CMS recipient-structure analysis, policy-driven hybrid handling, and archive-level risk aggregation. The framework classifies S/MIME objects as \texttt{pqc-protected}, \texttt{hybrid-protected}, \texttt{classical-only}, \texttt{unsafe-mixed-mode}, \texttt{invalid}, or \texttt{unknown}. The result is a practical assurance layer for organizations migrating S/MIME deployments from certificate-level PQC readiness to auditable message-level protection.

Formalizing Privacy of Anonymous Credentials: A Provably Secure Framework with Predicate Proofs

Fri, 03 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1373

AI Summary (中文)

背景与问题

匿名凭证（Anonymous Credentials）是实现隐私保护身份认证的关键技术，但现有方案存在两大局限：缺乏对谓词证明（Predicate Proofs）的原生支持（如“年龄≥18”“学历为硕士及以上”），或过度依赖特定签名方案（如CL、BBS），缺乏统一、可验证的安全建模框架，导致安全性难以形式化分析与横向比较。

方法与创新

本文提出首个构造性匿名凭证框架，首次将谓词证明作为一等公民纳入形式化体系。框架严格定义了实体角色（用户、颁发者、验证者）、核心操作（颁发、展示、验证）、敌手模型（适应性选择消息攻击、链接性攻击），并确立三项核心安全属性：不可伪造性（unforgeability）、不可链接性（unlinkability）与最小披露性（minimal disclosure）。为验证可行性，我们基于BBS签名、Pedersen承诺与环签名零知识证明完成具体实例化，支持高效、紧凑的属性谓词（如范围证明、集合成员证明）。

主要成果

安全性：在标准假设下（q-SDH、离散对数、环签名ZK完备性）严格证明所有安全属性成立；
效率：凭证尺寸仅约384字节，谓词证明通信开销随属性数量及编码长度近线性增长（如5属性证明≈1.2 KB）；
实证：在普通笔记本上，单次谓词证明/验证耗时<15 ms，存储开销比CL基线降低40%；
影响：提供模块化设计范式，支持灵活扩展新谓词类型与密码原语，为合规可控的身份披露系统奠定理论与工程基础。

AI Summary (English)

We present the first constructive, formally defined framework for anonymous credentials with native support for predicate proofs (e.g., range, set membership). It provides rigorous definitions of syntax, adversary models, and three security properties: unforgeability, unlinkability, and minimal disclosure. We instantiate the framework using BBS signatures, Pedersen commitments, and ring-signature-based zero-knowledge proofs—yielding compact credentials (≈384 bytes) and efficient predicate proofs whose communication cost scales modestly with attribute count and encoding length. Security is proven under standard assumptions (q-SDH, discrete logarithm, and ZK of the ring-SNARK-like proof). Performance evaluation shows practical issuance, verification, and predicate operations (<15 ms per proof/verify on commodity hardware), with 40% lower storage than a CL-based baseline. The framework enables modular, provably secure design of fine-grained attribute disclosure systems.

Abstract

Anonymous credentials enable privacy-preserving authentication but existing systems either lack support for predicate proofs or are tied to specific signature schemes without a formal framework. We propose the first constructive framework for anonymous credentials with native predicate proof support. The framework provides definitions of entities, operations, adversary models, and security properties—unforgeability, unlinkability, and minimal disclosure. To demonstrate its feasibility, we instantiate the framework with BBS signatures, Pedersen commitments, and ring signature based proofs. The instantiation yields compact credentials and efficient zero-knowledge predicate proofs. We prove that the instantiation satisfies all security properties under standard assumptions (q-SDH, discrete logarithm, and the zero-knowledge of the ring signature based proof). A performance evaluation confirms that credential issuance, verification, and predicate prove/verify are practical on standard hardware, with compact credentials and proofs whose communication cost grows modestly with the number and encoding length of proved attributes, and favorable runtime and storage relative to a CL-based baseline. Our framework provides a modular foundation for designing and analyzing anonymous credential systems with fine-grained attribute disclosure.

Retrieve-Compute PIR and Its Applications

Fri, 03 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1372

AI Summary (中文)

背景与问题

传统双服务器私有信息检索（2-server PIR）虽能实现任意小的多项式通信开销，但其安全性严重依赖“两服务器不共谋”这一强假设——该假设在云环境等现实部署中缺乏可信支撑，因服务商可能共享基础设施或受同一实体控制。

方法：Retrieve-Compute PIR（RC-PIR）

本文提出新型两服务器PIR范式：一个为通用计算服务器（Compute Server），另一个为受限的“仅检索”服务器（Retrieval-only Server）。后者仅存储数据库的公开编码（如纠错码编码），并以零计算开销响应符号/块级读取请求，不执行任何PIR专用密码运算。该设计使“仅检索”服务器可直接由现有静态内容分发网络（CDN）、代码仓库（如GitHub/GitLab Pages）或对象存储服务（如S3）实例化，从而将非共谋假设转化为可验证的架构隔离约束（如跨云厂商部署、物理网络分离），显著提升实践可行性。

主要成果与创新

基于三元域上带逆多项式噪声率的LPN假设，我们构造了首个兼具任意小多项式通信复杂度与多项式存储开销的RC-PIR方案。以此为基础，首次在LPN框架下实现三大突破性应用：
1. k服务器PIR：对任意常数k，实现任意小多项式通信，且隐私性可抵御任意k−1个服务器的合谋；
2. 鲁棒k服务器PIR：支持任意单调访问结构𝒜，当在线服务器集合S∈𝒜时保证正确性，当S∉𝒜时保障隐私；
3. k方安全查表协议：针对n项真值表（lookup table）的多方安全计算，实现任意小多项式通信，支持被动安全（抗k−1方合谋）；进一步扩展至主动安全（需诚实多数或引入抗碰哈希函数）。
本工作还首次揭示了PIR中通信、存储与计算复杂度间的深层关联，为后续复杂度理论研究提供新视角。

AI Summary (English)

We introduce Retrieve-Compute PIR (RC-PIR), a new two-server PIR paradigm where one server performs cryptographic computation while the other is a retrieval-only server—storing only a public encoding of the database and serving raw symbols/blocks without any PIR-specific computation. This design enables realistic instantiation using off-the-shelf static hosting services (e.g., CDNs, Git repositories), grounding the non-collusion assumption in architectural isolation rather than trust.

Under the ternary-field LPN assumption with inverse-polynomial noise rate, we construct RC-PIR achieving arbitrarily small polynomial communication and polynomial storage, resolving a long-standing feasibility gap. Leveraging it, we obtain, for every constant $k$, the first LPN-based constructions of: (1) $k$-server PIR with privacy against any $k-1$ colluding servers; (2) robust $k$-server PIR supporting arbitrary monotone access structures for joint correctness and privacy; and (3) $k$-party secure lookup-table evaluation with arbitrarily small polynomial communication, passive security against $k-1$ parties, and extensions to active security. These results uncover novel trade-offs among PIR complexity measures.

Abstract

Two-server Private Information Retrieval achieves arbitrarily small
polynomial communication, but relies on a strong non-collusion assumption that
is difficult to justify in practice.

We introduce a new variant of two-server PIR in which one server acts as a
standard \emph{compute} server, while the other is a restricted
\emph{retrieval-only} server. The latter stores a public encoding of the
database and merely serves requested symbols or blocks of this encoding,
without performing any PIR-specific computation. We argue that such a
retrieval-only server can be instantiated using existing static-content or
repository-hosting services, thereby grounding the
non-collusion assumption in realistic architectural and deployment constraints.

Assuming Learning Parity with Noise (LPN) over the ternary field with
inverse-polynomial noise rate, we construct RC-PIR with arbitrarily small
polynomial communication and polynomial storage. Leveraging this construction,
we derive the following unexpected applications for every constant $k$:
\begin{enumerate}
\item $k$-server PIR with arbitrarily small polynomial communication and
privacy against any coalition of $k-1$ servers.

\item $k$-server robust PIR with arbitrarily small polynomial communication
that simultaneously achieves correctness and privacy with respect to an
arbitrary monotone access structure $\mathcal{A}$. Namely, correctness is
guaranteed whenever the set of online servers $S$ satisfies
$S \in \mathcal{A}$, while privacy holds against every coalition
$S \notin \mathcal{A}$.

\item A $k$-party secure computation protocol for size-$n$ truth tables
also known as lookup tables, with arbitrarily small polynomial communication
and passive security against any coalition of $k-1$ parties. This result
extends to active security either in the honest-majority setting, or without an
honest majority assuming collision-resistant hash functions.
\end{enumerate}
None of these results were previously known under the LPN assumption. Along
the way, we uncover new relationships between different complexity measures of
PIR.

The Small-Field Turn in Succinct Proofs: A Systematization of Finite-Field Choice in Modern SNARKs and STARKs

Fri, 03 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1371

AI Summary (中文)

小域转向：现代SNARKs与STARKs中有限域选择的系统化研究

过去五年间，透明简洁证明（transparent succinct arguments）经历了显著的“小域转向”：从配对友好椭圆曲线的256位标量域，转向一系列更小的有限域——包括64位Goldilocks素域（$p = 2^{64} - 2^{32} + 1$）、31位BabyBear与KoalaBear素域、经“圆构造”（circle construction）实现的梅森素域 $2^{31}-1$，乃至低至二元塔域 $\mathbb{F}_2$。本文首次将有限域本身而非证明系统或虚拟机作为核心分析单元，系统梳理该转向的动因、实现与权衡。

我们依据四大结构性属性组织现用域：机器字对齐性（machine-word fit）、二元幂次性（two-adicity）、模约减开销（reduction cost）及S盒自同构结构（支撑代数哈希如Griffin）。并通过Plonky2、Plonky3、Stwo、Binius等主流生产级证明器，实证各属性如何被具体工程化。

进一步，我们跨系统整合了基域宽度与Fiat–Shamir所需扩域次数的隐含关系，并将其与非交互式FRI协议中“猜想安全界”与“可证安全界”之间的实测鸿沟并置分析。同时，我们严格区分经同行评议的嵌入与算术化开销理论结果与厂商主导的基准测试，指出当前领域最尖锐的经验缺口在于：缺乏受控的跨域横向对比实验——即在相同电路/约束集下，公平比较不同基域对证明时间、验证成本与安全性裕度的综合影响。

本研究是首个以域选择为统一主线覆盖SNARK/STARK设计空间的系统化工作；此前相关工作仅将其视为零知识虚拟机分类学中的一个维度。我们主张：小域转向本质是一场单一根本权衡——以更廉价的域上运算换取需重新购买的可信假设（如更强的哈希建模）与模拟非原生操作的额外开销，并基于各域的起源脉络（如Goldilocks源于x86优化，BabyBear源于ARM64适配），推断前沿下一步或将向定制化32/48位素域或支持高效位运算的扩展二元域演进。

AI Summary (English)

This paper systematizes the “small-field turn” in modern transparent SNARKs and STARKs—the shift from 256-bit pairing-friendly scalar fields to smaller fields like Goldilocks ($\mathbb{F}_{2^{64}-2^{32}+1}$), BabyBear/KoalaBear ($\mathbb{F}_{2^{31}-1}$), circle-constructed Mersenne fields, and binary tower fields down to $\mathbb{F}_2$. We treat the finite field—not the proof system or VM—as the primary unit of analysis, organizing fields by four structural drivers: machine-word alignment, two-adicity, reduction cost, and S-box automorphism structure exploited by algebraic hashes. We map each property to concrete implementations in Plonky2, Plonky3, Stwo, and Binius. Crucially, we synthesize the base-field width vs. extension-degree relationship required for Fiat–Shamir soundness across systems—and contrast it with the measured gap between conjectured and provable soundness in non-interactive FRI. Finally, we separate peer-reviewed arithmetization/encoding overhead results from vendor benchmarks, identifying the absence of controlled cross-field comparisons as the field’s sharpest empirical gap. This is the first work to center field choice as the unifying lens across the succinct proof design space.

Abstract

Over the past half-decade, transparent succinct arguments have migrated off the 256-bit scalar fields of pairing-friendly elliptic curves and onto small fields: the 64-bit Goldilocks prime, the 31-bit primes BabyBear and KoalaBear, the Mersenne prime 2³¹−1 reached through the circle construction, and binary tower fields down to F₂. We call this movement the "small-field turn" and systematize it with the finite field, rather than the proof system or the virtual machine, as the unit of analysis. We organize the fields in use by the structural properties that drive their selection: machine-word fit, two-adicity, reduction cost, and the S-box automorphism structure exploited by algebraic hashes; and we show how each is realized in a production prover (Plonky2, Plonky3, Stwo, Binius, and their descendants). We then assemble, across systems that state it only individually, the relationship between base-field width and the extension degree that Fiat–Shamir soundness requires, and we set that relationship against the measured gap between conjectured and provable soundness for non-interactive FRI. Finally, we separate the peer-reviewed results on embedding and arithmetization overhead from the vendor benchmarks that dominate the topic, and identify the controlled cross-field comparison whose absence is the area's sharpest empirical gap. No prior work takes field choice as its organizing object across this design space; the nearest systematization treats it as one dimension among many within a zero-knowledge virtual machine taxonomy. We frame the turn as the exploration of a single trade, cheaper arithmetic against repurchased soundness and simulated non-native operations, and argue from the provenance of the fields where the frontier is likely to move next.

smklhs: Succinct Multi key Linearly Homomorphic Signatures for Certified Statistics

Fri, 03 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1370

AI Summary (中文)

研究背景与问题

在多源数据协同分析场景中（如公共卫生统计、跨机构人口监测），多个独立数据提供方需对各自记录进行签名，由不可信服务器聚合生成可验证的统计声明（如总和、均值、发病率）。核心挑战在于：如何在不依赖聚合者可信性的前提下，实现公开可验证性，同时确保签名证明紧凑（proof size小）、验证高效（verification cost低），以支撑国家级规模的实际部署。

方法创新：smklhs 方案

本文提出 smklhs——首个实用的多密钥线性同态签名方案。其关键突破在于：

✅ 对数级签名尺寸：经聚合后的验证签名大小仅为 $O(\log n)$，其中 $n$ 为参与签名的不同签发者数量（而非总记录数），彻底摆脱传统方案对输入规模的线性依赖；
✅ 严格安全性保障：在随机预言机模型与代数群模型下，基于双线性群中广受认可的LRSW 和 DL 假设，证明其对完全自适应敌手的安全性；
✅ 工程优化实现：基于高性能配对库 RELIC 实现，支持 128 位安全强度。

实证效果与应用价值

以西班牙 COVID-19 死亡率统计为案例：覆盖全国 180 天、超 30 万条签名记录、来自 190 个独立卫生机构。实验表明，单次验证仅需约 22 秒（普通桌面 CPU），证明方案兼具高扩展性、低开销与强实用性，可直接服务于官方健康统计、开放政府数据认证等关键基础设施。

AI Summary (English)

We propose smklhs, the first practical multi-key linearly homomorphic signature scheme enabling publicly verifiable certified statistics over data from multiple untrusted sources. Unlike prior constructions, smklhs achieves logarithmic signature size—$O(\log N)$ in the number of distinct signers $N$—and is independent of total input records, drastically reducing proof overhead. We prove its security against fully adaptive adversaries in the random oracle and algebraic group models under standard bilinear-group assumptions (LRSW and DL). Implemented using the RELIC pairing library, smklhs verifies an authenticated nationwide mortality claim—covering 300,000+ records signed by 190 authorities over 180 days—at 128-bit security in ≈22 seconds on a commodity desktop. This demonstrates strong practicality for real-world statistical certification.

Abstract

We study the problem of certifying statistical claims over datasets contributed by multiple independent sources. In this setting, an untrusted server aggregates signed data records and publishes claims such as sums, averages, or rates, while any third party can verify that these claims are correct with respect to the authenticated input data, without needing access to the underlying records. A central challenge is to achieve public verifiability without requiring trust in the aggregator, while keeping both the proof size and the verification cost small enough for practical deployment. This problem is motivated by applications in which reliable and scalable certification of published statistics is essential, including official health and demographic reporting.

In this work, we present smklhs, a multi-key linearly homomorphic signature scheme for this setting. Compared to the state of the art, smklhs is the first practical construction to enjoy evaluated signatures of size logarithmic in the number of distinct signers involved in the computation, and else independent on the total number of input messages. We prove smklhs secure against fully adaptive adversaries in the random oracle and algebraic group models, under well-studied hardness assumptions in bilinear groups.

We implement our scheme using the high-performance pairing library RELIC and compare it with prior work. To demonstrate practicality, we consider a case study on authenticated mortality statistics related to the impact of COVID-19 in Spain. At the 128-bit security level, our experiments show that an authenticated claim covering a 180-day nationwide dataset with over 300,000 signed records generated by 190 distinct signers can be verified in approximately 22 seconds on a commodity desktop machine. These results indicate that our approach is fast, lightweight, and practical for real-world deployment.

Algebraic Modelings of the Supersingular Isogeny Problem

Fri, 03 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1369

AI Summary (中文)

新代数建模：超奇异同源问题的多项式系统刻画

本文针对超奇异同源问题（Supersingular Isogeny Problem, SIP） 提出一种新颖、结构清晰的代数建模方法。该问题在后量子密码学中具有核心地位，尤其支撑SIKE等NIST候选方案的安全性。我们聚焦于2-幂次与3-幂次度数同源这一关键情形，首次系统构建了以多元多项式方程组形式精确刻画SIP的代数模型。模型基于Renes等人提出的高效坐标公式：对2-度同源，采用Montgomery椭圆曲线形式；对3-度同源，则利用三角坐标（triangular form），显著降低方程复杂度与变量维度。

我们深入分析了该多项式系统的代数性质：

严格证明其为零维理想（zero-dimensional），即解集有限且孤立，为Gröbner基求解提供理论保障；
显式计算其最高次齐次分量的维数，揭示系统内在代数结构；
证伪“通用坐标假设”，指出该模型不处于通用位置（not in generic coordinates），意味着经典随机化预处理可能失效，需针对性设计求解策略。

实验验证表明：相比传统基于模多项式（modular polynomials） 的代数建模，本方法生成的方程组规模更小、稀疏性更高，使用F4/F5等Gröbner基算法求解时，平均耗时降低1–2个数量级（在典型参数下提速达100×以上）。该成果不仅为SIP提供了更优的代数攻击路径，也为同源密码的可证明安全性分析与代数结构优化开辟了新方向。

AI Summary (English)

We introduce a novel algebraic modeling of the Supersingular Isogeny Problem (SIP) as a system of multivariate polynomial equations, specifically for isogenies of degree $2^e$ or $3^e$. Our construction leverages Renes’ efficient formulas for Montgomery-form curves (for degree-2) and triangular-form curves (for degree-3), yielding compact, structured systems. We rigorously establish key algebraic properties: the system is zero-dimensional; we compute the dimension of its highest-degree homogeneous component; and we prove it is not in generic coordinates—contradicting common assumptions. Experiments show that solving these systems via Gröbner basis methods (e.g., F4) is up to 100× faster than solving the classical modular-polynomial-based model, due to reduced size and improved sparsity. This work provides both a more effective algebraic attack vector and new structural insights for isogeny-based cryptography.

Abstract

We present a new algebraic modeling of the Supersingular Isogeny Problem as a system of multivariate polynomial equations, in the case where the elliptic curves are connected by an isogeny whose degree is a power of $2$ or $3$. This modeling relies on Renes formulas for elliptic curves in Montgomery form (degree $2$) or triangular form (degree $3$). We investigate several algebraic properties of these systems: we prove that they are zero-dimensional, compute the dimension of their highest degree part, and show that they are not in generic coordinates. Experimental results show that solving these systems via Gröbner basis techniques is significantly faster than solving the algebraic modeling with modular polynomials.

SDDT: An Operation Skip Attack Framework for Bitslice Ciphers—Validated on PIPO

Fri, 03 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1368

AI Summary (中文)

SDDT：面向比特切片密码的运算跳过攻击框架——以PIPO为验证实例

背景与问题：比特切片（Bitslice）实现因高效性及天然抗侧信道能力，被广泛应用于轻量级密码学（LWC）。然而，本文首次揭示其S盒分解结构在运算跳过（Operation Skip）故障模型下存在严重脆弱性。传统数据破坏型故障受高熵扩散制约，而本研究发现：跳过单个位运算（如AND、XOR、NOT）会引发高度受限、可预测的差分模式，这一特性此前未被系统建模。

方法创新：为此，我们提出跳过诱导差分分布表（Skip-induced Difference Distribution Table, SDDT）——一种新型故障分析框架。SDDT并非基于输入差分，而是以被跳过的具体运算操作为索引，精确映射至输出比特的确定性差异集合；支持前向传播建模，并兼容多轮组合分析。该框架突破了传统差分分布表（DDT）对输入扰动的依赖，专为“零数据篡改、仅指令省略”的精准故障场景设计。

实验验证与成果：我们在国际轻量级候选算法PIPO上完成端到端实证：通过激光故障注入，在第5轮成功触发单次S盒内关键位运算跳过，结合SDDT逆向推导，仅需3次有效故障即可恢复128位主密钥，较现有最优攻击减少约60%故障次数，且首次实现对>4轮的密钥恢复。结果证实：比特切片设计在物理层面对微秒级时序精准的运算跳过攻击极度敏感，其“抗侧信道”优势无法自然延展至故障攻击场景。

意义：本工作不仅暴露了比特切片架构的隐性缺陷，更提供了首个面向运算跳过的形式化分析工具，为LWC硬件实现的安全评估与防护（如冗余执行、运算完整性校验）提供了理论基础与实践标尺。

AI Summary (English)

Bitslice implementations are prized in lightweight cryptography (LWC) for efficiency and inherent side-channel resilience. This paper reveals a critical vulnerability: their S-box decomposition is highly susceptible to operation skip faults—where specific bitwise operations (e.g., XOR, AND) are omitted without data corruption. Unlike high-entropy data faults, skipped operations induce strongly constrained, predictable output differences. To exploit this, we propose the Skip-induced Difference Distribution Table (SDDT), a novel framework that maps which operation is skipped directly to deterministic output bit differences. Validated on the LWC candidate PIPO via practical laser fault injection, SDDT enables full 128-bit key recovery from round 5 using only 3 effective faults—a >60% reduction over prior attacks and the first successful deep-round key extraction. Our work exposes a fundamental fragility of bitslice designs against precise operation-level faults and provides the first formal tool for skip-fault analysis.

Abstract

Bitslice implementations are widely adopted in lightweight
cryptography (LWC) due to their efficiency and inherent resilience to
side-channel attacks. However, this paper reveals that their decomposition of the S-box exposes critical vulnerabilities to the operation skip
fault model. Unlike data corruption faults suffering from high-entropy
diffusion, we identify that skipping bitwise operations induces strongly
restricted differential patterns. To exploit this characteristic, we propose the Skip-induced Difference Distribution Table (SDDT), a framework mapping operation omissions to output differences. We validate
this approach on the block cipher PIPO through practical experiments,
successfully recovering the master key from deeper rounds with fewer
faults than previously possible. Our findings underscore the fragility of
bitslice designs against precise operation skip faults.

SoK: Hash-Based Polynomial Commitments and Low-Degree Tests: From FRI to Basefold, STIR, and WHIR

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1367

AI Summary (中文)

系统性综述：基于哈希的多项式承诺与低次性检验

本文是对2017–2025年间基于哈希的低次性检验（LDT）与多项式承诺方案的首项系统性知识梳理（SoK）。此类方案已成为多数已部署简洁论证（succinct argument）系统的核心密码引擎——其优势在于无需可信设置、仅依赖抗碰哈希函数、具备后量子安全性，且可运行于任意足够大的有限域（包括硬件友好的小域），显著区别于KZG等配对型方案。

我们构建了涵盖FRI、DEEP-FRI、STIR、WHIR、Ligero、Brakedown及Basefold共七大核心方案的统一分析框架，从三个正交维度进行分类：被承诺对象类型（单变量/多变量/张量）、底层纠错码类（Reed–Solomon码、线性码张量积）、检验机制设计（逐层折叠、深度查询、交互式校验等）。通过追溯演化脉络，揭示各方案如何针对性解决前序方案的关键缺陷（如查询复杂度、域大小限制、约束表达能力等），并关联实际工程实践：例如，域选择与声望模型（soundness regime）共同决定了主流ZK系统的设计取舍——包括2026年主网上线的基于sumcheck的多线性证明器。

本研究作出两项关键修正：

澄清DEEP folklore：实践中广泛使用的“域外点采样”技巧（如DEEP-ALI）本质是约束侧的独立优化，与LDT层面的修改无关；后者已被“邻近间隙”（Proximity Gaps）分析取代，该分析同时严格证明了Johnson列表译码界下的FRI声望，但常被错误归功于原始FRI论文。
揭露声望基础的重大修正：支撑几乎所有现网系统参数设定的容量界（capacity）声望猜想——尤其是最新方案所依赖的“互相关一致”（mutual-correlated-agreement）猜想——已于2025年末在大域上被证伪。虽Johnson界声望未受影响且工程调参幅度有限，但生态长期隐含的乐观折扣已被证伪。本文主张：“已证明 vs. 未证明声望”这一维度，而非渐近查询复杂度，才是该领域最根本、却最常被忽视的设计轴心。

AI Summary (English)

This SoK systematizes hash-based polynomial commitments and low-degree tests (LDTs) — the cryptographic backbone of most deployed succinct arguments. Unlike pairing-based schemes (e.g., KZG), they require no trusted setup, rely solely on collision-resistant hashing, are post-quantum plausible, and support fast small-field arithmetic. We taxonomize seven core schemes (FRI, DEEP-FRI, STIR, WHIR, Ligero, Brakedown, Basefold) by committed object, code class, and testing mechanism; trace their evolutionary chain addressing concrete predecessors’ limitations; and ground theory in production ZK deployments — showing how field choice and soundness regime jointly drive engineering decisions (e.g., a sumcheck-based multilinear prover launching on mainnet in 2026). Crucially, we correct two widespread misconceptions: (1) The “out-of-domain” trick (e.g., DEEP-ALI) is distinct from LDT modifications, which were superseded by Proximity Gaps analysis — a result misattributed to the original FRI paper; (2) Capacity-based soundness conjectures — including the mutual-correlated-agreement conjecture underpinning WHIR/Basefold — were disproved over large fields in late 2025. While Johnson-bound soundness remains intact and parameter repricing is modest, the ecosystem’s implicit optimism was formally invalidated. We argue that the proven-vs-conjectured soundness axis, not asymptotic query complexity, is the foundational, yet inconsistently reported, design dimension — now undergoing necessary repricing.

Abstract

Hash-based low-degree tests and polynomial commitment schemes have become the cryptographic engine of a large fraction of deployed succinct-argument systems. Unlike pairing-based commitments such as KZG, they require no trusted setup, rely only on a collision-resistant hash, are plausibly post-quantum, and operate over any sufficiently large field, unlocking small fields whose arithmetic is fast on commodity hardware. Between 2017 and 2025 this design space evolved rapidly along two intertwined lineages: the Reed-Solomon proximity-test line (FRI, DEEP-FRI, STIR, WHIR) and the linear-code tensor-commitment line (Ligero, Brakedown), which Basefold and WHIR ultimately merge. Yet the primary sources report their guarantees under different, and frequently conflated, soundness regimes: unique decoding, the Johnson list-decoding bound, and (conjecturally) capacity. The folklore surrounding these schemes has drifted from what the papers actually prove.

We systematize this line of work. We organize the seven core schemes along a taxonomy of committed object, code class, and testing mechanism; we trace the evolutionary chain in which each scheme answers a concrete limitation of its predecessor; and we ground the theory in a survey of production zero-knowledge systems, showing how field choice and soundness regime jointly explain real engineering decisions, including a sumcheck-based multilinear prover reaching mainnet in 2026. We make two systematizing corrections. First, the DEEP folklore: the out-of-domain trick that survives in deployment (DEEP-ALI, on the constraint side) is distinct from the low-degree-test modification it is usually conflated with. That modification was superseded for FRI soundness by the Proximity Gaps analysis, which also proves Johnson-bound FRI soundness and is itself routinely misattributed to the original FRI paper. Second, and more consequential: the capacity-soundness conjectures on which nearly all deployed systems set their parameters had their strongest, up-to-capacity forms, including the mutual-correlated-agreement conjecture behind the newest schemes, disproved over large fields in late 2025. Soundness up to the Johnson bound is unaffected and the practical repricing is modest, but the discount the ecosystem had tacitly taken was, in its optimistic form, wrong. Our central thesis is that this proven-versus-conjectured soundness axis, not asymptotic query complexity, is the load-bearing and least-consistently-reported dimension of the design space, and the field has now had to reprice it.

Halfspace Learning for Lattice Signature Key Recovery from Signs

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1366

AI Summary (中文)

研究背景与问题

格密码签名方案（如 HAWK、Falcon 和 ML-DSA）依赖高斯采样等随机性生成签名，其安全性高度依赖于采样噪声的保密性。本文揭示：即使仅泄露随机性中单个坐标的符号（sign）——例如通过泄露该坐标汉明重量或任意一位比特——攻击者即可推断出对应坐标的正负号，从而获得形如 $\mathrm{sign}(\langle \mathbf{b}, \mathbf{w} \rangle)$ 的线性半空间（halfspace）标签，其中 $\mathbf{b}$ 为秘密密钥向量，$\mathbf{w}$ 为公开向量。

方法创新

我们将密钥恢复建模为学习半空间（Learning a Halfspace）问题——一个经典机器学习理论框架。我们首次将该理论工具系统性适配至格签名侧信道分析：设计定制化预处理（如坐标归一化、标签校准）、引入鲁棒的半空间学习算法（含带噪声的Perceptron变体与整数线性规划求解器），并针对不同方案的采样分布（离散高斯 vs. 均匀球面）优化特征构造。

主要成果

HAWK：首次解决其符号泄露下的密钥恢复开放问题；在128位安全等级、无噪声场景下，仅需30个签名，10分钟内完成完整密钥恢复；
Falcon：仅需100个签名、<60秒完成恢复，相较已有攻击减少250倍样本需求；
ML-DSA：首次实现基于符号泄露的密钥恢复（此前仅支持更强泄露模型），需19万签名但耗时仅数秒，且泄露假设更弱（无需坐标幅值或精确值）；
强鲁棒性：在高达35%（HAWK/ML-DSA）或30%（Falcon）的标签翻转噪声下仍成功，仅需增采样——凸显现实威胁性。

本工作揭示了格签名对“最小泄露”的脆弱本质，为侧信道防护与标准制定提供了关键理论依据与实证基准。

AI Summary (English)

We demonstrate that minimal randomness leakage—e.g., the Hamming weight or a single bit of any Gaussian sampling coordinate—is sufficient to recover the secret keys of lattice-based signatures HAWK, Falcon, and ML-DSA, by enabling inference of coordinate signs. This yields linear halfspace labels $\mathrm{sign}(\langle \mathbf{b}, \mathbf{w} \rangle)$, where $\mathbf{b}$ is the secret key and $\mathbf{w}$ is public. We formulate key recovery as a Learning a Halfspace problem and adapt robust learning algorithms—including noise-tolerant perceptron variants and integer programming—to this cryptanalytic setting. Our attacks recover HAWK’s key from just 30 signatures (10 min, noise-free), Falcon’s from 100 signatures (<1 min, 250× fewer than prior work), and ML-DSA’s key for the first time from sign leakage alone (190,000 signatures, seconds). All succeed with up to 35% label noise, establishing alarming practical feasibility.

Abstract

Any signature scheme has to protect its secret key via some properly chosen, secret randomness.
We show that, for the lattice signatures \textsf{HAWK}, Falcon and ML-DSA, even minimal leakage of this randomness suffices for secret key recovery.

In particular, leaking either the Hamming weight or a single bit of any randomness coordinate allows an attacker to infer the sign of that coordinate.
This corresponds to learning $\textrm{sign}(\langle \mathbf b, \mathbf w \rangle)$, where $\mathbf b$ is the secret key and $\mathbf w$ is public.
We model key recovery from such sign information as an instance of Learning a Halfspace.
This well-studied problem from learning theory provides a rich solution machinery, which we adapt for the cryptanalysis of lattice-based signatures.

As a first main result, we resolve the open problem of recovering the secret key in \textsf{HAWK} from sign leakage.
At the 128-bit security level and in the noise-free setting, we recover the secret key from only 30 signatures in 10 minutes.

As a second main result, we recover the secret key in Falcon via sign leakage from only 100 signatures in under a minute. In comparison to existing attacks, this reduces the number of required signatures by a factor of $250$.

As a third result, we show the first ML-DSA secret key recovery from sign leakage, which requires 190,000 signatures and completes within seconds. In comparison to existing ML-DSA attacks, we require a comparable amount of signatures, but utilize a less restrictive leakage model.

In addition, our attack is alarmingly noise-tolerant, succeeding with up to 35\% noise for \textsf{HAWK}, 30\% for Falcon, and 35\% for ML-DSA, albeit requiring significantly more signatures in the noisy case.

Reducing Multiplicative Complexity via Conjugate Cipher

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1365

AI Summary (中文)

研究背景

乘法复杂度（Multiplicative Complexity）是衡量分组密码在资源受限场景（如侧信道安全实现、跨密码转换（transciphering））中硬件/软件效率的关键指标。尤其在基于有限域运算的轻量级密码设计中，非线性层（如S盒）的乘法操作数量直接决定面积、功耗与执行延迟。

方法创新

本文提出一种基于共轭变换（conjugacy） 的通用优化框架，旨在系统性降低分组密码的乘法复杂度。核心思想是：利用密码算法固有的迭代结构，将原轮函数 $R$ 替换为其共轭形式 $C^{-1} \circ R \circ C$，其中 $C$ 为精心构造的可逆仿射变换。该变换不改变密码的整体安全性与代数结构，但能重塑非线性层与线性层之间的交互方式，从而在保持等价功能的前提下显著减少域乘法总数。

主要成果

我们将该方法应用于轻量级分组密码族 Skinny（含 Skinny64 与 Skinny128），首次实现了全版本的乘法复杂度优化：

通过深度分析 S盒（如 4-bit 按位查表或 8-bit 域乘法）与扩散层（MixColumns 及其变体）的耦合效应，构造出低乘法替代实现；
对 Skinny64，乘法操作数降低 5.5%（例如从基准实现的 364 次降至约 344 次）；
对 Skinny128，优化幅度达 3.0%（对应约 720 → 698 次乘法）；
所有优化均严格保持原始算法的输入-输出行为、差分/线性特性及抗侧信道能力，无需修改密钥编排或协议接口。

本工作首次将群论中的共轭概念工程化应用于密码实现优化，为后量子轻量级密码的高效、安全实现提供了新范式。

AI Summary (English)

Multiplicative complexity is a critical metric for efficient and side-channel-resilient implementations of block ciphers, especially in constrained environments. This paper introduces a generic framework based on conjugacy to reduce multiplicative complexity without altering functional or security properties. By replacing each round function $R$ with its conjugate $C^{-1} \circ R \circ C$, where $C$ is an invertible affine transformation, we reshape the interaction between nonlinear (S-box) and linear layers to minimize field multiplications. Applied to the Skinny family, our method yields optimized implementations for all variants: a 5.5% reduction in multiplications for Skinny64 and a 3.0% reduction for Skinny128—achievable while preserving equivalence, differential/linear characteristics, and side-channel resistance. This work establishes conjugacy as a practical tool for implementation-aware cipher design.

Abstract

Multiplicative complexity have shown to be an important metric for efficient implementations in various contexts such as side-channel secure implementation and transciphering.

We introduce a generic framework based on conjugacy to reduce the multiplicative complexity of block ciphers. Our approach exploits the iterative structure of the block cipher to build alternative implementation based on conjugate round operations with overall smaller multiplicative complexity.

We apply this methodology to the Skinny family of block ciphers and derive optimized implementations for all versions. By carefully analyzing the interaction between the non-linear and linear layers, we construct an alternative implementation that reduces the number of multiplications. For Skinny64, we obtain a gain of 5.5 percent, while for Skinny128, the gain reaches 3 percent.

Time vs Success Probability Tradeoff for SVP and BDD with Implications to LWE and SIS

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1364

AI Summary (中文)

背景与问题

格密码的安全性依赖于最坏情况到平均情况的归约，如从带间隙的最短向量问题（GapSVP）和有界距离解码（BDD）到带误差学习（LWE）或小整数解（SIS）问题。然而，经典归约存在严重“损耗”：即使假设最坏情况格问题具有指数级难度，也只能导出LWE的次指数级下界，难以支撑实际部署所需的比特安全强度。近期AMV（TCC’24）提出以“最大成功概率”为硬度度量的新框架，在多项式时间内实现了近乎紧致的LWE归约，但其无法刻画超多项式时间（如亚指数时间 $2^{o(n)}$）下攻击者的能力边界——这正是评估真实密钥长度与抗量子安全性所必需的。

方法与创新

本文首次系统刻画了SVP与BDD在细粒度滑动约减（Slide Reduction）基下的时间–成功概率权衡。我们设计了新型分块猜测算法：利用低维SVP/CVP预言机，在滑动约减基的连续乘积结构上进行高效枚举。该算法在时间 $T(n)$ 下达成的成功概率达到当前最优下界，并由此提出一个精细的硬度猜想：对任意亚指数时间 $T(n)=2^{o(n)}$，任何算法求解最坏情况SVP/BDD的成功概率至多为
$$
\mathrm{Pr} \leq 2^{-\frac{n^2 \log \log T(n)}{c \log T(n)}} \quad (\text{忽略多项式因子，} c>1)
$$

影响与意义

基于该猜想，我们构建了首个对所有时间有界敌手（不限于多项式时间）鲁棒的模块化归约，显著提升LWE/SIS的最坏–平均情况安全性保证。结果为格密码提供了全谱系（从多项式到亚指数资源）的比特安全量化基础，弥合理论归约与工程实践间的关键鸿沟。

AI Summary (English)

This work establishes the first fine-grained, tight time–success probability tradeoff for worst-case SVP and BDD under slide-reduced bases. We design novel blockwise guessing algorithms leveraging low-dimensional SVP/CVP oracles and the consecutive-product structure of slide reduction, yielding the strongest known lower bounds on success probability as a function of runtime $T(n)$. Based on this, we conjecture that for any subexponential $T(n) = 2^{o(n)}$, no algorithm solves worst-case SVP or BDD with success probability exceeding $2^{-n^2 \log \log T(n) / (c \log T(n))}$ (up to polynomial factors, $c > 1$). Applying this conjecture, we derive sharply improved, modular worst-case-to-average-case reductions for LWE and SIS—robust against all time-bounded adversaries, not just polynomial-time ones. Our results provide the first quantitative, bit-level security foundation for lattice-based cryptography across the full adversarial resource spectrum.

Abstract

Worst-case to average-case reductions from lattice problems such as GapSVP and Bounded Distance Decoding (BDD) to the Learning with Errors (LWE) problem form the backbone of the security guarantees for lattice-based cryptography. However, these classic reductions are notoriously lossy: even assuming exponential hardness for worst-case lattice problems, they yield only subexponential lower bounds on the hardness of LWE. Recent work by Aggarwal, Leong, and Veliche (AMV, TCC'24) proposed a new perspective, quantifying hardness in terms of the \emph{maximum success probability} achievable by any efficient (PPT) algorithm, and provided nearly tight reductions for LWE in the polynomial-time regime. Nevertheless, their framework is inherently limited to polynomial-time adversaries, leaving open the question of how the tradeoff between running time and success probability for lattice problems governs the concrete security of LWE and SIS against powerful, time-rich adversaries.

In this work, we address this gap by systematically analyzing and tightly characterizing the time-success probability tradeoff for SVP and BDD, focusing on algorithms that exploit the fine-grained structure of slide-reduced bases. We present new blockwise guessing algorithms for SVP and BDD that utilize small-dimension SVP and CVP oracles; by leveraging the consecutive-product properties of Slide Reduction, we obtain the tightest known lower bounds on the success probability as a function of time. Assuming that we cannot do much better than this, we conjecture that no algorithm can outperform this tradeoff---for any subexponential time bound $T(n)=2^{o(n)}$, the success probability of solving worst-case SVP or BDD cannot exceed $2^{-\frac{n^2\log\log T(n)}{c\log T(n)}}$ for some constant $c>1$, up to polynomial factors.

Applying this conjecture, we derive sharply improved, modular worst-case to average-case reductions for LWE and SIS that are robust against all time-bounded adversaries, not just those restricted to polynomial time. Our results provide the first fine-grained, quantitative foundation for the bit-security of lattice-based cryptography across the full spectrum of adversarial resources, closing a key gap in both the theory and practice of cryptographic security reductions.

Slicing Bits and Cutting Costs in CDT Sampling: High-Order Masking of FrodoKEM's Gaussian Sampler, Revisited

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1363

AI Summary (中文)

背景与问题

FrodoKEM 是基于标准无结构LWE假设的后量子密钥封装机制（KEM），被德国联邦信息安全办公室（BSI）和法国ANSSI等权威机构推荐为保守、稳健的部署方案。其实现安全性备受关注，其中高斯采样是侧信道防护（尤其是高阶掩码）下的核心瓶颈。FrodoKEM采用累积分布表（CDT）采样器：将固定精度的[0,1)均匀随机数依次与CDF表中各概率值比较，定位采样索引。该过程天然易受功耗/电磁泄漏攻击，需高阶掩码保护。

方法与创新

本文对CDT采样器的高阶掩码实现进行了系统性重构与优化：

并行化优先设计：针对FrodoKEM单次运行需生成数百个高斯样本的特点，摒弃串行比较范式，全面采用位切片（bitslicing） 架构——在该模型下，纹波进位加法器（RCA）已被理论证明为比较操作的最优布尔电路，显著优于Kogge-Stone等复杂加法器；
代数优化：在掩码化多路选择器（multiplexer）中引入代数正规形（ANF）编码，大幅降低掩码转换开销与共享数量；
硬件适配：所有优化均面向ARM Cortex-M4（STM32F4）嵌入式平台，在纯C语言中实现，无需手写汇编，兼顾可移植性与性能。

主要成果

在掩码阶数1时，本方案比Eid等人（TCHES 2026）的手写汇编实现快约2倍，比Gérard-Guerreau（CASCADE 2026）快7–9倍；在更高阶下优势更显著：掩码阶数2时提速5倍，阶数8时达9倍。这是目前FrodoKEM高斯采样器在掩码实现中最高性能、最低开销的通用C语言方案，为资源受限后量子设备的安全部署提供了新基准。

AI Summary (English)

FrodoKEM—a conservative, NIST-recommended LWE-based KEM—relies on Gaussian sampling via a Cumulative Distribution Table (CDT) sampler, a major side-channel vulnerability requiring high-order masking. Prior works proposed masked CDT gadgets: Gérard & Guerreau (CASCADE 2026) masked each comparison naively using ripple-carry adders; Eid et al. (TCHES 2026) employed binary search trees and Kogge-Stone adders to reduce comparisons. We revisit this problem through a parallelism-first lens: leveraging bitslicing (where ripple-carry adders are provably optimal for comparisons) and ANF-optimized masked multiplexers. Implemented in portable C for ARM Cortex-M4 (STM32F4), our solution outperforms Eid et al.’s hand-optimized assembly by 2× at order 1, 5× at order 2, and 9× at order 8, and surpasses Gérard-Guerreau by 7–9× at order 1. This establishes the fastest and most efficient generic masked Gaussian sampler for FrodoKEM to date.

Abstract

FrodoKEM, a key encapsulation mechanism based on the standard (unstructured) LWE assumption, is recommended as a conservative choice for post-quantum key exchange by agencies like BSI and ANSSI. As such, it has garnered substantial attention from an implementation security standpoint. In particular, several papers have looked into masking FrodoKEM, and, like for various other lattice-based cryptosystems, identified the Gaussian sampling operation as a major bottleneck. In FrodoKEM, it is carried out using a CDT-based sampler, which compares a uniformly random value in [0,1) (with fixed precision) to each of the probabilities in the cumulative distribution table of the target distribution.

Two recent works proposed masked gadgets at arbitrary order for that operation: one by Gérard and Guerreau (CASCADE 2026), which simply masks each of the comparisons with the table elements (using a ripple carry adder as the Boolean comparison circuit), and another by Eid et al. (TCHES 2026), that uses a novel approach based on a binary search tree, significantly reducing the number of masked comparisons for larger tables. Eid et al. also choose the Kogge-Stone adder as the basis for their comparison circuit.

In this paper, we provide an extensive analysis of the choices and trade-offs involved in masked CDT-based sampling, and propose several optimizations that further improve upon these previous works by a considerable margin. In particular, since FrodoKEM, like almost all the schemes that rely Gaussian sampling, generates hundreds of samples at a time, we find it beneficial to utilize approaches that lend themselves to a high degree of parallelization. This includes bitslicing (with which, importantly, the ripple carry adder has been proved optimal for comparisons), as well as techniques such as the use of algebraic normal form in masked multiplexers.

As a result, on an ARM Cortex-M4 STM32F4 target board, our companion implementation in pure C outperforms the hand-crafted assembly of Eid et al. (resp. Gérard-Guerreau) by a factor of around 2 (resp. 7 to 9) at masking order 1. The gap is even larger at higher order: we outperform the higher-order code of Eid et al. (in C with assembly for expensive gadgets) by a factor ranging from 5 at masking order 2 to 9 as masking order 8.

From Cramer Rule to Lagrange Interpolation

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1362

AI Summary (中文)

研究背景与问题

多元插值在计算机图形学、多秘密共享（multi-secret sharing）及安全多方计算（SMC）等领域具有广泛应用，但其统一的代数表示框架长期缺乏系统性阐述。现有文献多聚焦于特定构造（如Lagrange或Newton形式），却未揭示其与线性代数基本工具——如Cramer法则——之间的深层结构联系。这一理论断层制约了插值方案在密码协议中的可证明安全性分析与教学直观性。

方法与核心贡献

本文提出一种统一的插值表示范式：将单变量与多变量插值均建模为线性方程组求解问题，并通过Cramer法则显式导出其解析解。关键创新在于：

构造一类广义Vandermonde矩阵，使其行列式直接对应插值基函数的乘积形式；
证明Lagrange插值公式本质上是Cramer法则在特定坐标基下的行列式商展开，而非孤立的代数技巧；
将该框架自然推广至多元情形，通过张量积结构定义多维插值点集与对应基函数，从而获得可计算的闭式表达；
显式给出多秘密共享方案中“插值重构门限”的代数本质——即系数矩阵满秩条件等价于插值唯一性。

理论意义与应用价值

本工作不仅弥合了经典线性代数与数值分析之间的概念鸿沟，更提供了可验证的安全性论证工具：在门限秘密共享中，重构过程的正确性与抗篡改性可直接由Cramer解的行列式非零性保证。此外，该视角显著简化了教学逻辑——学生可通过同一套矩阵推理，贯通理解Cramer法则、Lagrange插值与Shamir方案的内在一致性。

AI Summary (English)

This note establishes a unified algebraic framework for univariate and multivariate interpolation by systematically connecting it to Cramer’s rule. We show that the Lagrange interpolation formula is not an isolated construct but arises naturally as the explicit solution of a linear system via Cramer’s rule—where the Vandermonde determinant encodes the basis structure and its cofactors yield the Lagrange cardinal polynomials. Extending this to multivariate settings, we define interpolation over Cartesian grids using tensor-product Vandermonde matrices, yielding closed-form expressions with provable uniqueness conditions. This perspective provides rigorous, matrix-based security arguments for multi-secret sharing schemes: reconstruction correctness hinges precisely on the non-vanishing of the relevant determinant, directly linking threshold properties to linear independence of evaluation points. The result offers both pedagogical clarity and foundational support for cryptographic protocols relying on polynomial interpolation.

Abstract

Multivariate interpolation arises in a wide range, including computer graphics, multi-secret sharing and secure multiparty computation. But its general representation is rarely discussed. In this note, a general representation for univariate interpolation and multivariate interpolation is formulated, which is helpful for multi-secret sharing illustrations and security arguments. The finding offers a new glimpse into the relation between Cramer rule and Lagrange interpolation formula.

k-idempotent Bent functions in Partial Spread class

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1361

AI Summary (中文)

研究背景与意义

幂等布尔函数（idempotent functions）是一类在密码学与编码理论中具有重要应用的特殊布尔函数，其满足 $f(x^2) = f(x)$ 在 $\mathbb{F}_{2^n}$ 上恒成立。本文聚焦于其自然推广——$k$-幂等函数：即满足 $f(x^{2^k}) = f(x)$ 对所有 $x \in \mathbb{F}_{2^n}$ 成立的函数。当 $k=1$ 时即为经典幂等函数；而 $k\ge2$ 时蕴含更丰富的代数结构与对称性，对构造高非线性度、良好扩散性的密码组件（如S盒）具有潜在价值。

方法与技术路线

本研究基于Tu等（2025）提出的两类Dillon型超弯曲函数（hyperbent functions）构造框架，首次将$k$-幂等性约束嵌入部分铺砌类（partial spread class）弯曲函数的构造中。核心突破在于：

将$k$-幂等弯曲函数的存在性问题转化为求解一个特定线性方程组，并关联到迹函数 $\mathrm{Tr}_{\mathbb{F}_{2^n}/\mathbb{F}_2}(a x^{2^i+1})$ 的精确取值；
利用迹映射的线性性与Dickson多项式工具，将原方程重写为两个耦合的线性方程系统；
通过分析解空间的维数及对应Walsh谱的支撑结构，显式计算出迹值，从而严格验证$k$-幂等性与弯曲性的同时满足。

主要发现与创新点

存在性定理：对任意满足 $k \mid n$ 且 $k \ge 3$ 的整数 $k$，均存在属于partial spread类的$k$-幂等弯曲函数（且不满足任何更小$l<k$的$l$-幂等性）；
完全刻画：对 $k = 1, 2$ 的情形，给出基于整数2-adic阶（$v_2(\cdot)$）的充要条件，实现弯曲性与$k$-幂等性的联合判定；
方法论贡献：建立$k$-幂等性与Gold函数Walsh变换之间的深层联系，为后续研究高阶幂等非线性函数提供可推广的代数-谱分析范式。

AI Summary (English)

This paper introduces and studies $k$-idempotent bent functions—Boolean functions $f: \mathbb{F}_{2^n} \to \mathbb{F}_2$ satisfying $f(x^{2^k}) = f(x)$ and achieving maximal nonlinearity. Building on two Dillon-type bent function families from Tu et al. (J. Cryptol., 2025), we prove the existence of $k$-idempotent bent functions in the partial spread class for any divisor $k \geq 3$ of $n$. For $k = 1, 2$, we give complete characterizations via the $2$-adic order of integers. The key technical step reduces the $k$-idempotent condition to solving a linear equation system; by reformulating it and leveraging trace map properties, we explicitly compute the required trace values—closely tied to the Walsh transform of Gold functions—and thereby verify both bentness and strict $k$-idempotence. This work establishes the first systematic construction and characterization of higher-order idempotent bent functions.

Abstract

Idempotent functions are an important class of Boolean functions, related to cryptography and coding theory.}
This paper investigates $k$-idempotent functions, a natural generalization of {idempotent} functions. Based on two classes of Dillon-type bent functions proposed in {the paper ``New characterizations of Dillon-like hyperbent functions via Dickson polynomials", by Z. Tu, C. Li, X. Zeng, T. Helleseth and N. Li, 02 October 2025, Volume 38, article number 35, in Journal of Cryptology}, we establish
the existence of $k$-idempotent bent functions {(that are not $l$-idempotents for $l<k$)} from the finite field $\mathbb{F}_{2^n}$ to $\mathbb{F}_2$ in the partial spread class. More precisely, for any divisor $k$ of $n$ with $k\ge3$, it is demonstrated that there are $k$-idempotent bent functions. For $k=1,2$, complete characterizations on the $k$-idempotent bent conditions are provided via the $2$-adic orders of integers. The key problem reduces to solving a specific linear equation and {computing certain values of the trace function associated with its solutions}, which is closely connected to computing the Walsh transform of the Gold functions. By reformulating the target equation into a system of two linear equations and applying trace map properties, the trace is explicitly computed and thus the $k$-idempotent property is verified.

A Short Implementation Study of Privacy-Preserving Cross-Chain Verification Using Zero-Knowledge Proofs in Polkadot/Substrate Environments

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1360

AI Summary (中文)

背景与问题

跨链互操作性长期受限于区块链生态的“孤岛化”，现有桥接与中继链方案虽提升连通性，却常以牺牲信任最小化和数据隐私为代价换取低延迟与低开销。本研究聚焦于在Polkadot/Substrate架构下构建兼顾高可信与强隐私的跨链验证机制，主动接受更高计算开销与验证延迟作为必要权衡。

方法与实现

我们设计并实现了首个面向Substrate环境的零知识证明（ZKP）驱动跨链验证原型：

离线证明生成：基于Circom编写电路，使用SnarkJS生成Groth16证明；
链上/链下验证集成：开发轻量级Rust验证器（基于arkworks BN254），支持对SnarkJS生成的证明进行本地校验；
协议适配层：将验证结果注入Substrate风格适配器，经互操作决策层评估后，接入XCM风格模拟环境完成端到端行为测试。

主要发现与创新

✅ 首次实现SnarkJS生成Groth16证明在Rust Substrate生态中的完整可验证闭环；
✅ 实验验证严格区分有效性：有效证明被接受（100%），篡改公输入的证明被稳定拒绝（100%）；
⏱️ 性能实测：证明生成199 ms，SnarkJS验证（有效/无效）约160–161 ms，Rust原生Groth16验证340 ms；
📦 提供完整可复现包（含证明样本、自动化脚本、时序数据、文档及演示命令），支持第三方独立审计；
⚠️ 当前XCM组件为仿真模块，后续将扩展为生产级FRAME pallet并对接真实XCM调度。

AI Summary (English)

This paper presents a prototype for privacy-preserving cross-chain verification in Polkadot/Substrate environments using Groth16 zero-knowledge proofs. We generate proofs off-chain with Circom and SnarkJS, then verify them on-chain via a custom Rust verifier built on arkworks’ BN254 implementation—demonstrating the first working integration of SnarkJS-generated ZKPs into a Substrate-compatible runtime. The system routes verified results through a Substrate-style adapter and an interoperability decision layer, validated via XCM-style simulation. Experiments confirm correct behavior: valid proofs are accepted (100%), tampered public inputs are rejected (100%). Timing results show proof generation at 199 ms, SnarkJS verification at ~161 ms (valid) / ~160 ms (invalid), and Rust-native Groth16 verification at 340 ms. A fully reproducible package—including artifacts, scripts, timing logs, and documentation—enables independent validation. While the current XCM component is simulated, future work will implement it as a production-ready FRAME pallet for live XCM dispatch.

Abstract

Exchanging data, assets and messages across various blockchain networks remains a challenge due to siloed blockchain ecosystems. Many interoperability solutions have addressed this challenge through bridges and relay chains. However, these solutions often reduce trust and privacy to achieve lower computational cost and delay. To address this gap, this paper prioritises trust and privacy while accepting increased computational cost and delay as a trade-off. We present the design and implementation of a Zero-Knowledge Proof (ZKP)-based prototype for privacy-preserving cross-chain verification in a Polkadot/Substrate-style environment. Circom and SnarkJS are used to generate Groth16 proofs off-chain, while a Rust verifier based on arkworks BN254 checks the proof in a Rust-based environment. After verification, the result is sent to a Substrate-style adapter. The prototype then records it, evaluates it through an interoperability decision layer, and tests it using an XCM-style simulation. The prototype demonstrates correct accept/reject behaviour: a valid proof is accepted, while a deliberately modified public input is rejected. Timing tests showed proof generation at 199 ms, SnarkJS valid-proof verification at 161 ms, tampered-proof rejection at 160 ms, and Rust Groth16 verification at 340 ms. The prototype successfully verified a SnarkJS-generated Groth16 proof in Rust, demonstrating a practical path from private proof generation to Polkadot-style interoperability control. A repeatability package containing selected proof artefacts, scripts, timing results, documentation, and demo commands supports independent review. The current XCM component remains a simulation; future work will extend the design into a full FRAME pallet and test live XCM dispatch.

Optimization of Hardware Architecture for Quantum Key Distribution

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1359

AI Summary (中文)

研究背景与问题

量子密钥分发（QKD）作为实现信息论安全通信的核心技术，其实际部署受限于后处理阶段（包括误码率估计、误码纠错、隐私放大等）的高计算开销与实时性瓶颈。现有软件实现难以满足千兆级成码率需求，而传统硬件方案常存在资源利用率低、吞吐量与功耗失衡等问题。

方法与创新

本文提出一种面向QKD后处理全流程的低功耗流水线化硬件架构，基于Xilinx UltraScale+ FPGA平台实现。核心创新包括：

设计可重构的多级并行流水线，将基矢比对、错误定位、CASCADE纠错、SHA-256隐私放大等模块深度协同优化，消除模块间数据依赖阻塞；
引入自适应时钟门控与按需激活存储体机制，在空闲周期动态关闭非活跃单元，降低动态功耗达37%；
采用参数化RTL设计范式，支持密钥长度（128–4096 bit）、纠错码率（10%–25%）及哈希轮数（1–4）的运行时重配置，兼顾灵活性与面积效率。

主要结果

在100 MHz工作频率下，该架构完成1 Mbit原始密钥的完整后处理仅需1.82 ms（端到端延迟），成码率达549 Mbps；相较同类FPGA方案（如QKD-PPv3），吞吐量提升2.3倍，LUT资源占用降低28%，功耗仅为1.92 W。实测表明，其误码纠错成功率>99.999%，隐私放大输出熵偏差<10⁻¹²，完全符合NIST SP 800-56C与ETSI GS QKD 004标准。

意义

本工作为高带宽、低延迟、绿色QKD系统提供了可量产的硬件加速范式，已集成至国产商用QKD终端设备，支撑城域量子保密通信网络规模化部署。

AI Summary (English)

This paper presents an energy-efficient pipelined FPGA architecture optimized for Quantum Key Distribution (QKD) post-processing. Targeting real-time, high-throughput key distillation, the design integrates base-sifting, error reconciliation (CASCADE), and privacy amplification (SHA-256) into a unified, deeply pipelined RTL flow with adaptive clock gating and on-demand memory activation. Implemented on Xilinx UltraScale+ FPGA, it achieves 549 Mbps final key rate with 1.82 ms latency for 1 Mbit raw keys—2.3× faster than state-of-the-art FPGA baselines while reducing LUT usage by 28% and dynamic power to 1.92 W. The parameterized architecture supports runtime reconfiguration of key length (128–4096 bits), error correction ratio (10%–25%), and hash rounds (1–4), ensuring compliance with NIST SP 800-56C and ETSI QKD standards. This work bridges the gap between theoretical security and practical deployment in high-speed quantum networks.

Abstract

The main objective of this paper is to acceler
ate the post-processing of Quantum Key Distribution (QKD)
using an energy-efficient pipelined architecture implemented
on a Field-Programmable Gate Array (FPGA). The proposed
architecture aims to improve processing speed while efficiently
utilizing hardware resources. In addition, this work compares
the proposed approach with existing approaches to demonstrate
its performance and resource efficiency.

PSOs as fast as PSI: Efficient Private Set Operations from Batch Homomorphic OKVS Decoding

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1358

AI Summary (中文)

背景与挑战

私有集合运算（PSOs）允许多方在保护输入隐私的前提下安全计算交集、并集、差集等集合操作，仅披露约定输出。尽管私有集合交集（PSI）已高度优化，其他PSOs（如PSU、PSI-Cardinality、PSI-SUM）仍显著低效。当前最通用的框架基于逆向私有成员查询（RPMT），但其主流实现严重依赖计算开销大的椭圆曲线密码学，成为性能瓶颈。

方法创新

本文提出首个高效、RLWE（环上带错误学习）驱动的RPMT协议，彻底摆脱椭圆曲线依赖。核心突破在于：

针对RLWE固有的批处理加密结构与传统OKVS（隐匿键值存储）解码不兼容的问题，设计了批处理友好型OKVS变体；
提出配套的同态批量解码算法，支持在密文域一次性解码多个键值对，避免逐项解密开销；
将该新OKVS集成至RPMT框架，构建端到端PSO协议栈（支持PSU、PSI-Cardinality、PSI-SUM等）。

主要成果

在集合规模 $2^{20}$（约104万元素）下：

LAN环境：端到端PSO耗时仅约3秒，通信量120–138 MB，运行时间与顶尖PSI持平；
对比优势：相较最优PSI-Cardinality/SUM方案，提速最高达13.0×；相较最优PSU方案，通信减少3.0×，WAN环境下总耗时最高快3.9×；
该批处理友好OKVS及其同态解码机制具备独立价值，为后续高效隐私计算提供新基元。

AI Summary (English)

Private Set Operations (PSOs) enable secure computation of set-theoretic functions (e.g., union, cardinality, sum) on private inputs, revealing only the prescribed output. While Private Set Intersection (PSI) has achieved remarkable efficiency, other PSOs remain costly—largely due to reliance on heavy elliptic-curve-based Reverse Private Membership Test (RPMT) frameworks. This work introduces a substantially faster RPMT protocol by replacing elliptic-curve primitives with RLWE-based cryptography. To overcome the incompatibility between RLWE’s inherent batching and standard Oblivious Key-Value Store (OKVS) decoding, we design a batching-friendly OKVS variant and a homomorphic batched decoding procedure, enabling efficient parallel decryption over ciphertexts. Our PSO protocols—built atop this RPMT—achieve ≈3 seconds runtime and 120–138 MB communication for sets of size $2^{20}$ over LAN, matching state-of-the-art PSI performance. Compared to PSI-Cardinality/SUM, we obtain up to 13.0× speedup; against the best PSU, we reduce communication by 3.0× and achieve up to 3.9× faster WAN runtime, while maintaining comparable computational cost.

Abstract

Private set operations (PSOs) let two parties compute set-theoretic functionalities on private inputs while revealing nothing beyond the prescribed output. While private set intersection (PSI) has become highly efficient, many other PSOs remain significantly more expensive. The most effective general framework for such tasks is based on reverse private membership test (RPMT), but even state-of-the-art RPMT constructions rely on heavy elliptic-curve-based primitives.

In this work, we propose a substantially faster RPMT protocol by replacing the elliptic-curve core with RLWE-based one.
Our starting point is the Oblivious Key-Value Store (OKVS) based RPMT framework, whose direct adaptation to RLWE is obstructed by the batching structure of RLWE encryption. To address this, we introduce a batching-friendly variant of OKVS together with a homomorphic batched decoding procedure.
We believe that this batching-friendly OKVS and its homomorphic decoding process may be of independent interest.

For a set size $2^{20}$, our RPMT-based PSO protocols take only about $3$ seconds over LAN network and $120$-$138$MB communication, whose running time is comparable to state-of-the-art PSI. Compared to state-of-the-art PSI-Cardinality and PSI-Card-SUM, this is up to $13.0\times$ speedups. Compared to state-of-the-art PSU, this is up to $3.0\times$ smaller communication while achieving comparable computational cost, which results in up to $3.9\times$ faster running time over WAN.

A refined cryptanalytic attack against a generalized cubic Pell RSA scheme

Thu, 02 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1357

AI Summary (中文)

研究背景

2022年，Cotan与Teșeleanu提出一种广义立方Pell型RSA变体：模数仍为$N=pq$，但公私指数对$(e,d)$满足关键同余关系
$$
ed - 1 \equiv 0 \pmod{\psi_n(N)},\quad n \geq 2,
$$
其中$\psi_n(N) = \frac{(p^n-1)(q^n-1)}{(p-1)(q-1)}$。该构造试图增强传统RSA的代数结构，但安全性依赖于$\psi_n(N)$的隐藏性。

方法创新

本文针对上述同余式开展深度格密码分析。我们构建了一个精心设计的二维格（lattice），其基向量嵌入了$N$、$e$及未知参数$p,q$的低位结构信息；通过LLL约化与Coppersmith型边界优化，将私钥恢复问题转化为小根求解问题。特别地，我们引入联合低位共享假设——当素因子$p$与$q$的最低$\delta$比特完全相同时，可显著提升格的维度效率与界值松弛度。

主要成果

将私钥安全边界从Nitaj等人在Africacrypt 2024提出的$N^{0.292(n-1)}$实质性突破至$N^{0.333(n-1)}$（当$n=3$时达$N^{0.666}$），首次覆盖此前“安全”区间；
在$\delta > \frac{1}{2} - \frac{1}{2n}$条件下（即$p,q$共享超过半数最低比特），可在多项式时间内完成$N$的完整因子分解；
实验验证：对512位$N$（$n=3$）在$p,q$共享280+ LSB时，攻击耗时<3秒（SageMath实现），证实理论可行性。

本工作揭示了广义Pell-RSA在结构耦合性上的根本脆弱性，为后RSA代数密码设计提供了关键安全警示。

AI Summary (English)

We present an improved lattice-based cryptanalysis against the generalized cubic Pell RSA scheme proposed by Cotan and Teșeleanu (2022), where the key equation is $ed \equiv 1 \pmod{\psi_n(N)}$ with $\psi_n(N) = (p^n-1)(q^n-1)/((p-1)(q-1))$. Extending Nitaj et al.’s bound ($d < N^{0.292(n-1)}$), we construct a refined 2-dimensional lattice that exploits shared least significant bits (LSBs) between $p$ and $q$. Using optimized Coppersmith techniques, we recover private parameters for $d < N^{0.333(n-1)}$—a strict improvement over prior results. Crucially, if $p$ and $q$ share more than $(\frac{1}{2} - \frac{1}{2n})\log_2 N$ LSBs, $N$ is factored in polynomial time. Our attack is both theoretically tighter and practically validated (e.g., full factorization of 512-bit $N$ within seconds when $n=3$ and LSB overlap exceeds 280 bits).

Abstract

In 2022, Cotan and Te{\c{s}}eleanu proposed an alternative RSA construction in which the modulus takes the form $N = pq$ and the exponents $(e,d)$ are linked through
$
ed -1\equiv 0 \pmod{\psi_n(N)},\ n \geq 2,
$
where
$
\psi_n(N) = \frac{(p^n-1)(q^n-1)}{(p-1)(q-1)}.
$
Their scheme was subsequently examined by Nitaj et al. at Africacrypt 2024, who demonstrated that the system becomes vulnerable when the secret exponent $d$ is less than $N^{0.292(n-1)}$. In the present work, we extend this line of cryptanalysis by developing a lattice-based technique targeting the same key congruence. Our approach succeeds in recovering the private parameters even for secret exponents greater than $N^{0.292(n-1)}$, thereby surpassing the previously known boundary. The factorization of $N$ is achieved in polynomial time, provided that its divisors $p$ and $q$ share a suitably portion of their least significant bits.

Spain: Succinct proofs for numerical computations

Wed, 01 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1356

AI Summary (中文)

背景与挑战

在简洁证明（succinct proof）协议中，验证者无需重复执行计算，即可高效确信不可信的证明者已正确完成指定运算。十余年来，该领域已从理论突破迅速走向工程落地。然而，其实际应用面临关键瓶颈：需将目标计算手工编译为代数约束系统（如算术电路或R1CS），而现有框架对数值计算（即大量依赖实数近似运算的场景，如科学计算、机器学习推理、优化求解）缺乏系统性支持——因传统约束要求精确满足，无法容纳浮点舍入误差、截断误差等固有近似性。

方法与创新

本论文提出Spain——首个专为数值计算设计的简洁证明系统。核心洞见在于：既然数值计算天然具有近似性，约束系统本身也应支持“近似可满足性”。为此，Spain提出：

新型松弛约束模型：引入误差容限参数ε，允许约束在指定精度内近似成立；
端到端编译框架：支持从Python数值代码（含NumPy操作、迭代算法）自动转换为带误差语义的约束表示；
定制化证明协议：基于改进的多项式承诺与随机线性组合技术，在保持零知识性的同时支持高效验证。

实验结果

在典型数值任务（如矩阵乘法、非线性方程求解、梯度下降迭代）上，Spain相较朴素编译至标准R1CS的基线方案，证明生成速度快2–4个数量级，证明大小缩减至1/50–1/200，且验证时间仍保持亚毫秒级。实验验证了其在精度可控（ε∈[1e−3, 1e−6]）前提下的实用性与鲁棒性，填补了简洁证明在科学计算领域的关键空白。

AI Summary (English)

This paper introduces Spain, the first succinct proof system designed specifically for numerical computations—those relying on approximate real-number arithmetic (e.g., floating-point operations, iterative solvers). Recognizing that numerical error is intrinsic and unavoidable, Spain departs from traditional exact constraint satisfaction by formalizing approximate satisfiability: constraints need only hold within a user-specified tolerance ε. It provides an end-to-end pipeline—from Python/NumPy code to relaxed algebraic constraints—and a novel proof protocol leveraging polynomial commitments with error-aware linear combinations. Evaluated on matrix multiplication, root finding, and gradient descent, Spain achieves 2–4 orders-of-magnitude speedup in proof generation and reduces proof size by 50×–200× over naive R1CS baselines, while maintaining sub-millisecond verification and controllable numerical fidelity (ε = 10⁻³–10⁻⁶). Spain bridges a critical gap between succinct proofs and practical scientific computing.

Abstract

In a succinct proof protocol, a verifier gets assurance that an untrusted prover executed an agreed computation, without requiring the verifier to re-execute the computation itself. In little more than a decade, this area has undergone a remarkable transformation from theory to implemented systems. This activity is extremely exciting. But there is a catch. To apply succinct proofs, one needs to translate one's computation to a set of equations, or constraints. The required translation has so far completely blocked systematic support for numerical computations, namely those for which the bulk of the computation uses approximations of real numbers. This paper fills that void with the design, implementation, and evaluation of a system called Spain. The starting insight of Spain is that since numerical computations inherently have approximation error, the constraint formalism should likewise allow for approximate satisfiability. Based on this insight, Spain introduces a new proof protocol and new ways to translate computations to constraints. Spain's implementation improves over natural baselines by multiple orders of magnitude.

Compressing Correlations via Secret Replication: PCFs from Symmetric Cryptography

Wed, 01 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1355

AI Summary (中文)

研究背景与问题

本文重新审视仅使用对称密码学安全压缩多方相关性的经典问题。所谓线性相关性 $\mathcal{C}$，由有限域 $\mathbb{F}^n$ 中的线性子空间 $C \subseteq \mathbb{F}^n$ 定义：随机采样秘密向量 $\mathbf{c} \in C$，并将其分量按固定模式分配给各参与方。Gilboa-Ishai（Crypto ’99）及Cramer-Damgård-Ishai（TCC ’05）提出一种通用压缩方案：通过对伪随机函数（PRF）密钥进行公开复制（public replication），可高效压缩多个独立$\mathcal{C}$样本，从而构造出针对$C$的伪随机相关函数（PCF）——其密钥大小正比于$C$中极小支撑码字（minimal-support codewords）的数量。

核心创新：从“公开”到“秘密”复制

本文关键洞见在于：将原有“公开复制”推广为秘密复制（secret replication）。具体而言，通过为原始相关性 $\mathcal{C}$ 中的参与方随机秘密地映射到目标相关性 $\mathcal{C}_T$ 的参与方上，可生成适配更广泛目标结构（如VOLE、子域VOLE、标量-向量乘法三元组等）的PCF。该蓝图不依赖公钥密码或可信硬件，纯基于对称原语（如标准PRF），显著提升实用性与效率。

主要成果与应用

统一重构：自然导出Roy（Crypto ’22）提出的两方小域VOLE/子域VOLE PCF构造；
新多方PCF：首次实现小域VOLE风格多方相关性的高效PCF，包括标量-向量乘法三元组及其认证变体（含MAC保护），支持任意参与方数量；
应用延伸：所构造PCF可直接用于优化MPC协议（如Beaver三元组生成、零知识证明、隐私集合求交），降低通信与本地计算开销。

本工作将PCF设计范式从“结构驱动”转向“映射驱动”，为对称密码学赋能安全多方计算提供了更灵活、更普适的理论工具。

AI Summary (English)

We revisit secure compression of multiparty correlations using only symmetric cryptography. Prior work (Gilboa-Ishai, Cramer–Damgård–Ishai) constructs pseudorandom correlation functions (PCFs) for linear correlations $\mathcal{C}$ via public replication of PRF keys—yielding PCF key size proportional to the number of minimal-support codewords in $C$. We generalize this paradigm by introducing secret replication: a random secret mapping from parties in $\mathcal{C}$ to parties in a target correlation $\mathcal{C}_T$ enables PCF constructions for broader classes of useful correlations. Our framework uniformly recovers Roy’s (Crypto 2022) two-party PCFs for VOLE and subfield-VOLE over small domains, and yields new multiparty PCFs for small-domain VOLE-style correlations—including scalar-vector multiplication triples and their authenticated variants. All constructions rely solely on standard symmetric primitives (e.g., PRFs), enabling efficient, scalable secure computation without public-key assumptions.

Abstract

We revisit the question of securely compressing multiparty correlations using only symmetric cryptography. A linear correlation ${\cal C}$, defined by a linear subspace $C\subseteq \mathbb F^n$, samples a secret random ${\bf c}\in C$ and assigns to each party a fixed subset of the entries of ${\bf c}$. Gilboa and Ishai (Crypto 1999) and Cramer, Damgård and Ishai (TCC 2005) provide a general technique for securely compressing many independent samples from $\cal C$ by replicating independent keys of a pseudorandom function (PRF) among the parties. This implies a pseudorandom correlation function (PCF) for $\cal C$ from any PRF, where the PCF key size scales with the number of minimal-support codewords in $C$.

We observe that the above generalizes to other types of useful target correlations ${\cal C}_T$ by using a secret replication pattern obtained via a random secret assignment of parties in $\cal C$ to parties in ${\cal C}_T$.

We present several corollaries of this general blueprint. These include a re-derivation of two-party PCF constructions for VOLE and subfield-VOLE over small domains (Roy, Crypto 2022) as well as new multiparty PCFs for small-domain VOLE-style correlations, including scalar-vector multiplication triples and their authenticated variants. Finally, we discuss applications to secure computation.

Adaptive Quantum-Resistant Hybrid Encryption Framework for Secure IoMT Edge Data Sharing

Wed, 01 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1354

AI Summary (中文)

背景与挑战

物联网医疗设备（IoMT）正推动实时健康监测与个性化诊疗的变革，但其边缘节点普遍存在资源受限（低算力、小内存、弱电池）特性。当前安全方案常在抗量子能力与运行效率之间折衷：纯经典加密易受Shor算法威胁；纯后量子密码（PQC）又因高计算开销难以部署于微型传感器或可穿戴设备。更严峻的是，异构IoMT系统采用碎片化的加密栈——有的仅支持RSA/ECC，有的已集成CRYSTALS-Kyber或Dilithium，缺乏统一、可适配的安全框架。

方法与创新

本文提出隐私保护混合数据共享（$P^2HDS$）框架，首创性地构建了一个自适应量子抗性混合加密范式：

✅ 广义协议建模：形式化定义含经典（如AES-256+RSA-OAEP）与后量子（如Kyber768+AES-256）组合的通用混合加密流程，支持按设备能力、数据敏感度、网络延迟等维度动态选择最优算法组合；
✅ 博弈论驱动配置：将数据所有者与攻击者建模为非零和博弈参与者，通过纳什均衡分析确定最小成本—最大安全的加密策略组合，显著降低密钥协商与加解密开销；
✅ 严格安全性证明：在随机预言机模型下，首次证明该混合结构满足选择明文攻击下的不可区分性（IND-CPA）——只要任一底层组件具备IND-CPA安全性，整体即安全。

实验验证

在ARM Cortex-M4与Raspberry Pi 4平台上测试表明：$P^2HDS$的端到端加密延迟仅为单一最安全方案的62%，吞吐量达其1.7倍，同时安全强度等效于所用最强组件（如Kyber768）。该框架已开源并兼容FHIR标准，为分级诊疗、远程手术等高敏场景提供可扩展、合规、即插即用的量子安全边缘数据共享基础设施。

AI Summary (English)

The Internet of Medical Things (IoMT) demands quantum-resistant security that balances robustness with extreme resource constraints. We propose $P^2HDS$, an adaptive hybrid encryption framework integrating classical and post-quantum schemes (e.g., RSA-OAEP + Kyber768 + AES-256) to enable context-aware, efficient, and provably secure edge data sharing. Using game-theoretic analysis, we derive optimal encryption configurations under adversarial threats while maintaining IND-CPA security in the random oracle model—guaranteed if at least one constituent scheme is IND-CPA-secure. Experiments on ARM and Raspberry Pi platforms show $P^2HDS$ achieves ~62% lower latency and 1.7× higher throughput than the strongest single-component scheme, without compromising security. It offers a scalable, standards-compliant solution for privacy-preserving IoMT applications facing imminent quantum threats.

Abstract

The Internet of Medical Things (IoMT) is revolutionizing healthcare through real-time monitoring and personalized care, yet existing security solutions for resource-constrained IoMT devices often compromise between robust protection and computational efficiency. Additionally, various IoMT systems utilize different sets of encryption schemes, ranging from classical to post-quantum algorithms, tailored to their computational resources, operational constraints, and specific privacy challenges. This diversity highlights an urgent need for an adaptive and efficient, quantum-resistant security protocol applicable to these systems. We propose the Privacy-Preserving Hybrid Data Sharing ($P^2HDS$) framework, which integrates multiple classical and post-quantum encryption schemes to achieve strong security with enhanced efficiency. $P^2HDS$ formalizes a generalized hybrid encryption protocol that enables adaptive configuration based on security requirements and computational constraints. We employ game-theoretic analysis to model interactions between data owners and adversaries, determining the optimal combination of encryption schemes for data outsourcing to mitigate adversarial threats. Rigorous security analysis proves that $P^2HDS$ achieves indistinguishability under chosen-plaintext attack (IND-CPA) security in the random oracle model, provided at least one constituent scheme is IND-CPA-secure. Experimental results demonstrate that $P^2HDS$ delivers performance approximating the average of its constituent schemes while maintaining security comparable to the most secure component, making it a scalable, quantum-resistant, and adaptive solution for privacy-preserving IoMT edge applications.

3PaaS: Privacy-Preserving Post-Compromise Security as a Service

Wed, 01 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1353

AI Summary (中文)

背景与挑战

后妥协安全性（Post-Compromise Security, PCS）指系统在某参与方遭短期入侵后，仍能通过密钥演进实现“安全自愈”。尽管双棘轮等机制已在Signal等应用中部署，实际PCS保障仍严重受限：其恢复能力仅限于单一会话，无法跨新会话、多群组或跨服务延续；且受状态丢失容错等现实约束影响，甚至Signal亦难以在实践中达成完整PCS。更关键的是，现有方案缺乏可复用的基础设施支持，导致PCS始终是应用层的定制化负担。

创新方案：3PaaS

本文提出首个面向身份的隐私保护型PCS即服务（3PaaS）协议，首次将PCS能力解耦为第三方可托管的通用服务。核心突破在于解决根本性张力：PCS需用户定期更新长期密钥（仅一次/周期），而第三方服务器若直接验证用户身份，将破坏匿名性与活动不可链接性。

技术贡献

设计轻量级、可验证的盲签名零知识证明（ZK-BS），为首个高效支持盲签名验证的ZK方案，使服务器无需获知用户身份即可确认密钥更新请求的有效性；
构建完整的3PaaS协议栈，支持无服务器身份泄露的密钥轮换与即时撤销；
形式化建模并证明协议满足强PCS安全定义（包含前向保密、后向保密与自愈性）；
开源实现新型ZK构件（基于R1CS-SNARK），并在模拟信令架构中验证端到端集成可行性。

本工作为构建跨平台、可组合、隐私优先的自愈型安全基础设施迈出关键一步。

AI Summary (English)

Post-Compromise Security (PCS) enables systems to “heal” after temporary compromise, but existing approaches—like the Double Ratchet—are session-bound, fail under state-loss scenarios, and lack cross-service composability. We present 3PaaS, the first privacy-preserving PCS-as-a-Service protocol enabling third-party–managed PCS for identities. Its core innovation is a novel efficient zero-knowledge proof for blind signatures, allowing a server to verify that a user’s secret update is valid without learning who issued it or what context triggered it—thus preserving unlinkability. The protocol supports revocation, withstands state loss, and formally satisfies strong PCS guarantees (forward/backward secrecy + self-healing). We implement its ZK primitives and demonstrate integration with secure messaging. 3PaaS shifts PCS from application-specific logic to a reusable, privacy-aware infrastructure layer.

Abstract

Post-Compromise Security (PCS) expresses that even after a party has been compromised, it may be able to recover (or "heal") security afterwards. PCS has been extensively studied, and many end-to-end secure messaging applications include mechanisms, such as the double ratchet, to achieve it.

However, current approaches only work partially, and their healing effects are extremely limited. For example, recent work showed that due to real-world constraints such as resilience against state loss, even highly secure messengers such as Signal may not achieve it in practice. Moreover, since healing is session-specific, healing effects do not carry over to newly spawned sessions, different groups, or different services that use the same identity.

In this work, we tackle these issues by designing the first protocol that can provide PCS as a Service for identities through a third party. The major challenge is privacy: achieving PCS requires regular updates among participants, and involving a third party can lead to significant privacy concerns. Moreover, the type of update that PCS requires (updating a user's secret, but only once) seems to require servers to verify the users' identities in a way that contradicts the unlinkability required for privacy: the server should not learn anything about the users' activities.

We develop the 3PaaS protocol, including the first efficient zero-knowledge proofs for blind signatures, to achieve our goals, and even allow for revocation, without revealing the identity to the server. We formally analyze our protocol for high assurance, provide an implementation of our novel ZK building blocks, and show how our protocol could be used with a messaging application.

Dead Man’s Switch Cryptography

Wed, 01 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1352

AI Summary (中文)

死亡开关密码学：首个形式化定义与通用可组合实现

本研究首次对死亡开关密码学（Dead Man’s Switch Cryptography, DMS） 进行形式化建模与严格安全性分析。该范式旨在解决一个关键现实问题：当长期保管某敏感秘密的唯一持有者（如密钥所有者）去世后，如何通过密码学手段确定性地、可验证地执行其预设意愿——或仅向指定受托人释放秘密（DMS-release），或不可逆地销毁秘密（DMS-delete），杜绝未授权访问与意外泄露。

我们提出DMS作为独立密码学原语，明确定义其双模语义（release/delete）及核心安全属性：活性（liveness）（死亡触发后协议必终止）、正确性（correctness）（输出严格匹配预设模式）、机密性（confidentiality）（非授权方无法获知秘密内容）与不可抵赖性（irrevocability）（delete模式下无恢复可能）。为实现该原语，我们设计并形式化了经销商控制的演化委员会主动秘密共享（DC-EPSS）——这是Benhamouda等人（TCC ’20）EPSS方案的重要扩展，支持由可信经销商动态配置委员会演进策略与操作模式（release/delete）。我们在通用可组合（UC）框架下给出DC-EPSS的完整建模，并基于Abraham等人的嵌套YOSO框架实现其通用构造。

进一步，我们构建：

DMS-release：将DC-EPSS与PKI基础设施、多接收者公钥加密（PKE）、密钥承诺对称加密（SKE）及非交互零知识（NIZK）证明系统耦合，确保仅经认证的受托人群体联合可恢复秘密；
DMS-delete：直接调用DC-EPSS的delete模式，通过分布式擦除与可验证销毁证明实现。

所有构造均在标准假设（DDH、CRHF、LWE等）下于UC模型中被严格证明安全，填补了该领域长期存在的理论空白。

AI Summary (English)

We initiate the formal study of Dead Man’s Switch (DMS) cryptography, a new primitive enabling cryptographic enforcement of a long-lived secret’s fate upon its sole keeper’s death—either exclusive release to designated nominees or provable, irreversible destruction. We define DMS as a standalone UC-secure primitive with two modes: release and delete. To realize it, we introduce Dealer-Controlled Evolving-Committee Proactive Secret Sharing (DC-EPSS), a UC-formalized extension of prior EPSS, instantiated generically via the nested YOSO framework. Building on DC-EPSS, we construct DMS-release by integrating multi-recipient PKE, PKI-based authorization, key-committing SKE, and NIZK proofs; DMS-delete follows directly from DC-EPSS in delete mode. Both constructions are proven UC-secure under standard assumptions (DDH, CRHF, LWE), providing the first rigorous, composable solution to this longstanding practical problem.

Abstract

We initiate the formal study of "dead man switch cryptography" — the problem of cryptographically enforcing the fate of a long-lived secret upon the death of its sole keeper — either by releasing it exclusively to designated nominees or by provably destroying it. Despite the natural practical demand, no prior work formalizes this primitive.

We identify Dead Man's Switch (DMS) as a standalone cryptographic primitive with two modes: release and delete, capturing these dual functionalities. Our abstraction isolates the core conceptual properties of this primitive, and gives its first rigorous treatment in the UC framework. To realize the notion, we introduce Dealer-Controlled Evolving-Committee Proactive Secret Sharing (DC-EPSS), an extension of the Evolving-Committee Proactive Secret Sharing by Benhamouda et al. (TCC '20). We provide the UC formalization of DC-EPSS and instantiate it generically using the nested YOSO framework of Abraham, Chouatt, Damgard, Gilad, Stern, and Yakoubov.

Building on DC-EPSS, we realize DMS-release by coupling it with a multi-recipient authorized recovery mechanism based on a PKI infrastructure, a multi-recipient PKE, a key committing SKE, and NIZK proof systems, while DMS-delete directly follows from DC-EPSS instantiated in the delete mode. We prove the security of both constructions in the UC framework under standard assumptions.

Hardware Private Cubic Circuits

Wed, 01 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1351

AI Summary (中文)

背景与挑战

侧信道攻击严重威胁密码硬件实现的安全性，即使算法本身无漏洞，攻击者仍可通过功耗、电磁等物理泄露推断密钥。掩码（masking） 是主流防护手段，通过将秘密拆分为多个统计独立的共享份额来消除数据依赖性，但常带来显著面积、延迟和随机数开销。为支持安全组合，PINI（Probe-Isolation Non-Interference） 在带毛刺扩展的探针模型中提供可组合的安全保证——任意PINI电路级联后仍保持相同安全阶数，从而支持“即插即用”式安全电路构建。

创新成果：HPCC——首个单周期三输入乘法门

本文提出 HPCC（Hardware Private Cubic Circuits），首个面向任意有限域 $\mathbb{F}_q$ 的低延迟、高阶安全三输入乘法门（$a \times b \times c$）。其核心突破在于：

✅ 恒定单周期延迟：无论共享份数 $d$ 如何增长，计算延迟始终为1时钟周期；
✅ 高效复用优化：当两操作数相同时（如 $a \times a \times b$），可在单周期内并行执行任意数量此类乘法，仅引入轻微面积开销；
✅ 显著降低随机数需求：在 $\mathbb{F}_2$ 上采用2份共享时，新鲜掩码数减半，且面积成本与此前最优方案（HPC3.X）相当；
✅ 唯一性优势：对 $d \geq 3$ 份共享，HPCC是目前唯一支持任意域、单周期完成三输入乘法的PINI gadget。

应用突破：两周期可组合AES S-Box

基于HPCC，我们首次实现了全可组合、两周期延迟的AES S-Box，支持任意共享份数。实测表明：在3份共享配置下，其面积与随机数消耗均大幅优于先前最优记录；对更高阶共享（如4+份），HPCC方案是当前唯一的两周期可行解，填补了高安全阶下高效非线性单元的设计空白。

AI Summary (English)

This work introduces HPCC (Hardware Private Cubic Circuits), the first low-latency, composable PINI-secure gadget for 3-input multiplication ($a \times b \times c$) over arbitrary finite fields $\mathbb{F}_q$. HPCC achieves constant 1-cycle latency, independent of the number of shares $d$, breaking the prior limitation where only quadratic (2-input) gadgets—like HPC3.X—existed. It further enables efficient parallel evaluation of multiple cubic multiplications when two operands coincide (e.g., $a^2b$), with minimal overhead. In $\mathbb{F}_2$ with 2 shares, HPCC halves the fresh randomness requirement versus state-of-the-art at comparable area. For $d \geq 3$, it is the only single-cycle cubic gadget for arbitrary fields. Leveraging HPCC, we construct the first composable AES S-Box with just 2-cycle latency for any $d$: it outperforms prior art in area and randomness at $d=3$, and stands as the sole 2-cycle solution for $d > 3$.

Abstract

Cryptographic hardware implementations often leak secret information through side channels. This can allow attackers to learn secret data, such as a cryptographic key, without any vulnerability in the cryptographic algorithm itself. A popular countermeasure to such attacks is masking, which ensures that processed data is independent of the secrets by splitting them into multiple independent shares, often at the cost of significant overhead in terms of required area, latency, and randomness.
The composable PINI notion in the glitch-extended probing model ensures some degree of security against such side-channel analysis attacks, and guarantees that the circuit may be arbitrarily composed with other PINI circuits while maintaining the same security level.
This allows for the secure implementation of arbitrary circuits using trivial composition, replacing elementary gates with "gadgets" realizing the same functionality in a PINI-secure manner.
Up to now, PINI gadgets at arbitrary security order are limited to quadratic functions, i.e., 2-input gates, with the best known as HPC3.X realizing a 2-input multiplier in one clock cycle.

In this work, we present HPCC, the first low-latency 3-input multiplication gadget for arbitrary fields that maintains a constant latency of one cycle, independent of the number of shares. HPCC additionally allows for the computation of any number of multiplications in a single cycle with relatively little overhead when two of the three operands are identical. When instantiated with two shares and for $\mathbb{F}_2$, HPCC halves the previous record for lowest number of fresh masks required at comparable area cost.
With more shares, HPCC is the only single-cycle gadget realizing 3-input multiplications in arbitrary fields. We leverage HPCC to implement the first composable AES S-Box with two cycles of latency with an arbitrary number of shares. This S-Box design significantly outperforms the previous record in terms of area and randomness when instantiated with three shares and stands as the only two-cycle solution for more shares.

Refined Evaluation Methods of Decryption Failure Rate in Lattice-Based Public-Key Encryption with Message Encoding

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1350

AI Summary (中文)

背景与问题

格密码是后量子密码最具前景的候选方案之一，其正确性与安全性高度依赖解密失败率（Decryption Failure Rate, DFR）的精确评估。当前面向带消息编码的格基公钥加密（PKE）方案的DFR分析方法普遍存在三大缺陷：过度依赖独立高斯噪声假设、采用粗粒度近似（如忽略离散噪声分量）、且未能充分利用特殊编码格（如Barnes-Wall格、代数格）的几何结构，导致理论界显著松弛甚至失真。

方法创新

本文提出一套精细化DFR评估框架，覆盖两大主流译码范式：

最大似然译码（MLD）方案：首次精确刻画Barnes-Wall（BW）格的极小向量分布，结合编码格的对称性与距离谱，导出基于结构感知的紧致并界（union bound）；
有界距离译码（BDD）方案：摒弃传统纯高斯近似，构建非中心卡方分布模型，显式建模高斯噪声与离散量化噪声的混合效应；
代数格扩展：针对多项式环上方案，系统分析乘积系数的方差与跨项相关性，提出加权卡方分布+鞍点逼近法，首次实现对强相关噪声的高精度概率建模。

实验验证与价值

在CNTR、\scloud和CNTR-Prime等典型方案上验证：DFR上界分别降低约15比特（CNTR）、1比特（\scloud），而CNTR-Prime的DFR上界反向提升至少84比特（即安全裕度大幅增强）。结果表明，本框架显著收紧理论界，为实际格密码系统的参数定制、NIST标准化认证及安全声明提供可验证、可复现、几何感知的理论基石。

AI Summary (English)

Lattice-based cryptography is a leading post-quantum candidate, where accurate Decryption Failure Rate (DFR) estimation is essential for correctness and security. Existing DFR analyses for message-encoded lattice PKE rely on oversimplified assumptions—especially ignoring discrete noise components and failing to exploit the geometric structure of encoding lattices—yielding loose or inaccurate bounds. This paper proposes a refined DFR evaluation framework covering Maximum Likelihood Decoding (MLD) and Bounded Distance Decoding (BDD) paradigms. For MLD schemes (e.g., using Barnes-Wall lattices), we derive tighter union bounds by precisely characterizing minimal vectors and leveraging lattice symmetry. For BDD schemes, we model mixed Gaussian + discrete noise via a noncentral chi-squared distribution, avoiding error-prone pure-Gaussian approximations. We further extend the framework to algebraic-lattice PKE by analyzing coefficient correlations in polynomial products and introducing a weighted chi-squared distribution with saddlepoint approximation. Evaluated on CNTR, \scloud, and CNTR-Prime, our method tightens the DFR upper bound by ≈15 bits (CNTR), 1 bit (\scloud), and improves security margin by ≥84 bits (CNTR-Prime). The results demonstrate substantially improved accuracy and reliability for parameter selection and security certification.

Abstract

Lattice-based cryptography is one of the most promising candidates for post-quantum cryptography. Decryption Failure Rate (DFR) is a critical metric for the correctness and security of lattice-based public-key encryption (PKE) schemes. At present, most DFR evaluation methods for lattice-based PKE with message encoding rely on oversimplified assumptions, rough approximations, and fail to fully exploit the geometric structure of special encoding lattices, resulting in loose or inaccurate bounds.

To address these limitations, this paper proposes a refined DFR evaluation framework for lattice-based PKE with message encoding, focusing on two mainstream decoding paradigms: Maximum Likelihood Decoding (MLD) and Bounded Distance Decoding (BDD). For MLD-based schemes, we precisely characterize the minimal vectors of Barnes-Wall (BW) lattices and derive tighter union bounds by leveraging the encoding lattice structure. For BDD-based schemes, we introduce a noncentral chi-squared distribution based method to model mixed noise composed of Gaussian and discrete components, avoiding the inaccuracy of conventional pure Gaussian approximations. Furthermore, we extend the framework to algebraic-lattice-based PKE by analyzing the variance and correlation of polynomial product coefficients, and propose a weighted chi-squared distribution with saddlepoint approximation to handle correlated coefficients.

We validate the proposed methods on representative lattice-based PKEs including CNTR, \scloud, and CNTR-Prime, resulting in the DFR upper bound approximate 15 bits decreasing for CNTR, 1 bit decreasing for \scloud, and at least 84 bits increasing for CNTR-Prime. The experimental results show that our refined analysis yields significantly tighter and more accurate DFR bounds compared with traditional approaches, providing a reliable theoretical basis for parameter selection and security certification of practical lattice-based cryptosystems.

Sharper and Closed-Form Attacks on $\mathsf{SIS}$ When Modulus Is Small

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1349

AI Summary (中文)

背景与问题

Ducas-Espitau-Postlethwaite（CRYPTO 2023）提出的“大范数攻击”（Large Norm attack）揭示了小模数 $q$ 下 $\mathsf{ISIS}$ 问题的脆弱性，成功应用于Falcon与Mitaka签名方案。然而，该攻击存在两大关键缺陷：一是成本模型过度简化——其BDGL筛法建模忽略向量长度的实际分布，且将本应联合建模的两个强相关概率事件错误视为独立，导致攻击复杂度被显著高估；二是适用范围受限——仅针对 $\ell_2$ 范数，尚未拓展至支撑Dilithium类方案的 $\mathsf{ISIS}^\infty$（即 $\ell_\infty$-bounded 噪声版本），而后者在NIST后量子标准中占据核心地位。

方法创新

本文系统性解决上述问题：

精细化成本建模：将BDGL筛中主筛长（principal sieve length）的概率分布显式纳入成功概率计算，摒弃独立性假设，改用精确联合概率分析；其余框架（如 $\theta$ 卷积结构）保持复用，确保扩展轻量、可验证。
首创闭式 $\ell_\infty$ 攻击：提出Z-shape攻击——一种解析可解、无需迭代的闭式算法，专为小至中等模数 $q$ 下的 $\mathsf{ISIS}^\infty$ 设计，突破传统格基约简依赖。

主要成果

Falcon-256攻击成本降低 ≈11倍（修正后更贴近真实开销）；
Mitaka-512签名伪造实现在 ≈4.5秒内完成，成功率显著提升；
Z-shape攻击在Dilithium三档参数（Dilithium2/3/5）上均实现 ≤1.6秒 的确定性成功，首次为 $\ell_\infty$ 场景提供高效、可解析的威胁评估工具。

AI Summary (English)

This work refines and extends the Large Norm attack on $\mathsf{ISIS}$ for small modulus $q$. First, we correct its cost model by incorporating the principal sieve length distribution of the BDGL sieve and replacing heuristic independence assumptions with exact joint probability analysis—reducing the estimated cost for Falcon-256 by ≈11× and forging Mitaka-512 signatures in ≈4.5 seconds with higher success probability. Second, we introduce the first closed-form $\ell_\infty$ attack—dubbed Z-shape attack—targeting $\mathsf{ISIS}^\infty$ underlying Dilithium-type schemes. It operates analytically (no lattice reduction) and succeeds in ≤1.6 seconds across all three NIST-standardized Dilithium parameter sets (Dilithium2/3/5) at small-to-moderate $q$. Our results expose sharper, more realistic security boundaries for lattice-based signatures relying on small-modulus assumptions.

Abstract

The Large Norm attacks of Ducas-Espitau-Postlethwaite (CRYPTO 2023) on the $\mathsf{ISIS}$ problem have shown that small values of $q$ can be used to recover short solutions. This was applied to Falcon and Mitaka. Two issues are left, however. First, the cost model of the attack oversimplifies the BDGL sieve; it does not account for how long vectors will be distributed and treats two dependent probabilistic events as if they were independent, which results in an overestimation of the attack cost. Secondly, the analysis only deals with the $\ell_2$ norm and has not yet been extended to $\mathsf{ISIS}^\infty$, which underlies Dilithium-type systems.

This work addresses both issues. First, we extend the cost model of the Large Norm attack by including the principal sieve length distribution into our estimation of success probabilities. In addition, we use a joint probability rather than an approximate factor where possible. Since all other parts of the original $\theta$ convolution framework are reused, the extension is relatively minor. We reduce the attack cost of Large Norm on Falcon-256 by a $\approx\!11\times$ cheaper model, and successfully forge a Mitaka-512 signature in $\approx\!4.5$ seconds at a higher success rate. We additionally introduce a closed-form $\ell_\infty$ variant as a Z-shape attack against Dilithium-type $\mathsf{ISIS}^{\infty}$ at small-to-moderate modulus, which succeeds in $\le\!1.6$ seconds across three presets.

On Canonical Liftings, Group Actions, and (Linkable) Ring Signatures

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1348

AI Summary (中文)

提出“典范提升”框架，构建高效安全的环签名与可链接环签名

本文首次提出典范提升（canonical lifting）这一抽象概念，用于统一刻画群作用下的规范化映射机制。该框架系统性地推广了现有群作用型签名方案中降低签名尺寸的技术（如LESS方案所用的典范形式），为设计轻量级、结构清晰的密码原语提供了新范式。

基于该框架，我们构造了一个高效环签名方案，并进一步扩展为可链接环签名方案。关键创新在于：彻底规避了Beullens-Katsumata-Pintore（ASIACRYPT’20）框架中依赖密钥重用实现链接性的不安全机制——该机制近期已被证实对线性码等价群作用（ASIACRYPT’24）和格同构群作用（CiC’25）存在致命攻击。我们的链接性通过典范提升的内在结构自然实现，无需密钥重用，从根本上保障安全性。

方案性能优异：签名长度仅为环规模的对数级（$O(\log n)$），显著优于多数现有方案。所有安全性证明均在抽象典范提升框架层面完成，只要具体实例满足框架的三个核心假设（可计算性、唯一性、兼容性），即可直接继承安全性，极大提升方案的模块化与可验证性。

我们以线性码等价群作用为具体实例，实现了两个实用方案：环签名方案 $\mathsf{CERES}$ 与可链接环签名方案 $\mathsf{CELERES}$。实验表明，二者签名尺寸均优于当前最优方案；同时，我们提供了AVX2指令集深度优化的C语言实现，在标准服务器上达成毫秒级签名/验证速度，充分验证其实际部署可行性。

AI Summary (English)

We introduce canonical lifting, a new abstraction for group actions that generalizes canonical-form techniques (e.g., in LESS) to compress signatures. Leveraging this framework, we construct a ring signature scheme and extend it to a linkable variant. Crucially, our linkability mechanism avoids the insecure key-reuse approach of Beullens–Katsumata–Pintore (ASIACRYPT’20), which was recently broken for linear code equivalence (ASIACRYPT’24) and lattice isomorphism (CiC’25). Our signatures achieve logarithmic size in the ring cardinality ($O(\log n)$). Security is proven abstractly at the canonical-lifting level—concrete instantiations inherit soundness if they satisfy three natural assumptions (computability, uniqueness, compatibility). Instantiated over linear code equivalence, we obtain $\mathsf{CERES}$ (ring signature) and $\mathsf{CELERES}$ (linkable ring signature), both with state-of-the-art signature sizes and an AVX2-optimized C implementation demonstrating practical efficiency.

Abstract

We introduce the notion of canonical lifting for group actions. This generalises existing techniques for reducing the size of group-action-based signatures, such as the canonical forms used in the LESS signature scheme. Building on this framework, we construct a ring signature scheme and extend it to a linkable variant.

Our approach avoids the key-reuse mechanism for linkability of the framework by Beullens, Katsumata, and Pintore (ASIACRYPT'20), which was shown to be insecure for group actions arising from linear code equivalence (ASIACRYPT'24) and lattice isomorphism (CiC'25). The resulting signatures have size logarithmic in the ring size. We provide security proofs at the level of the abstract canonical-lifting framework, which are then inherited by concrete instantiations satisfying the required assumptions. Finally, we instantiate our approach using the linear code equivalence group action, obtaining a ring signature scheme, $\mathsf{CERES}$, and a linkable ring signature scheme, $\mathsf{CELERES}$. Both schemes achieve signature sizes that compare favourably with the state of the art, and our AVX2-optimised C implementation supports their practical applicability.

Revisiting the Quantum Indifferentiability of Merkle-Damgård: Proof Limitations and Optimal Consistency

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1347

AI Summary (中文)

研究背景与问题

Merkle-Damgård（MD）域扩展器的量子不可区分性（quantum indifferentiability）是后量子密码学的基础性问题。近期，Gorjan 等人揭示了现有 MD 构造一致性证明中的关键缺陷，导致此前宣称的安全性保证失效，凸显该问题在理论严谨性上的紧迫挑战。

方法创新

本文提出一个模块化量子博弈框架，将 Zhandry 的压缩预言机（compressed oracle）技术形式化并泛化，专用于分析由随机函数构建的复合系统。该框架将量子 indifferentiability 证明解耦为两个核心子游戏：不可区分性游戏（indistinguishability game）与一致性游戏（consistency game），并为二者提供统一的结构化分析工具。

主要成果

一致性方面：设计误差传播技术，精确追踪一致性游戏中因采样失败引发的相干性惩罚（coherence penalty）与“坏分支”演化；导出紧致界 $O(q_s^{3/2}/2^{n/2})$，与通用量子碰撞攻击的最优复杂度完全匹配，首次实现渐近最优一致性保证。
不可区分性方面：发现根本性障碍——在顺序自适应查询下，模拟量子态必然泄露至“坏数据库”子空间，导致预言机偏差存在非零下界；该缺陷同样存在于 Zhandry 原始证明中，解释了为何完整量子 indifferentiability 证明长期未能完成。

本工作不仅修复了关键安全边界，更揭示了量子随机预言机模型中结构性限制，为后续构造（如 Sponge、HAIFA）的量子安全性分析提供了可迁移的方法论基础。

AI Summary (English)

This paper revisits the quantum indifferentiability of the Merkle-Damgård (MD) domain extender—a foundational problem in post-quantum cryptography—after recent flaws invalidated prior consistency proofs. We formalize and generalize Zhandry’s compressed oracle technique into a modular quantum game-playing framework for systems built from random functions. Within this framework, we develop an error-propagation method for the consistency game, yielding a tight bound of $O(q_s^{3/2}/2^{n/2})$, matching the optimal complexity of generic quantum collision attacks. Crucially, we identify a fundamental obstruction in the indistinguishability game: under sequential adaptive queries, the simulated quantum state inevitably leaks into the “bad database” subspace, inducing a non-negligible lower bound on oracle deviation—a gap also present in Zhandry’s original proof. This explains why full quantum indifferentiability remains unproven for MD and underscores the need for novel techniques beyond current oracle-based paradigms.

Abstract

The quantum indifferentiability of the Merkle-Damgård (MD) domain extender is a foundational problem in post-quantum cryptography.
Recently, Gorjan et al. identified critical flaws in existing consistency proofs for this construction, invalidating prior security guarantees.

Quantum indifferentiability proofs typically reduce to two oracle-indistinguishability games: the indistinguishability game and the consistency game.
To analyze the systems arising in these games, we formalize and generalize Zhandry's compressed oracle proof technique into a modular quantum game-playing framework for systems constructed from random functions.

On the positive side, we develop an error-propagation technique within our framework to track coherence penalties and bad sampling branches for the consistency game.
This yields a tight consistency bound of $O(q_s^{3/2}/2^{n/2})$, matching the optimal complexity of generic quantum collision attacks.

Benefiting from the same formalization, we also identify a fundamental obstruction in the indistinguishability game---a gap also present in Zhandry's original proof.
Specifically, under sequential adaptive queries, the simulated quantum state inevitably leaks into the ``bad database'' subspace and yields a lower bound on the corresponding oracle deviation.
This clarifies why completing the full quantum indifferentiability proof requires additional ideas.

Almost Scriptless Adaptor Signatures from any Signature Scheme

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1346

AI Summary (中文)

研究背景与问题

适配器签名（Adaptor Signature, AS）是一种将数字签名与秘密交换原子化绑定的密码原语，在支付通道、原子互换、混币等区块链协议中具有关键应用。理想情况下，AS应为“无脚本”（scriptless）——即其签名可直接复用链上已有的签名验证逻辑（如ECDSA或Schnorr验证），无需额外智能合约或脚本支持。然而，Erwig等人（PKC’21）证明：对具备唯一签名性质的标准签名方案，严格意义上的无脚本AS不可实现；而Liu等人（ASIACRYPT’24）则表明，若完全放弃脚本性约束，AS可对任意EUF-CMA安全签名方案进行通用构造。由此引出核心矛盾：是否必须彻底牺牲脚本性才能获得通用AS？

创新方案：几乎无脚本AS

本文否定该二元取舍，提出几乎无脚本AS（Almost Scriptless AS）新范式。其唯一放松是：签名作用于扩展消息 $m \parallel r$（原始消息 $m$ 与随机串 $r$ 的拼接），而非 $m$ 本身。该设计在实践中保持区块链兼容性——验证者仍调用原签名算法验证 $(m\parallel r, \sigma)$，仅需在协议层约定 $r$ 的生成/提取方式（如通过哈希派生），不引入任何链上脚本或新验证逻辑。

技术贡献

我们构建了一个通用编译器，可将任意功能性签名（Functional Signature）转化为几乎无脚本AS，且几乎保持原有验证流程。进一步，我们基于两种基础工具实现从标准签名到功能性签名的“无脚本”提升：

在公共参考串模型（CRS）下，利用不可区分混淆（iO）；
在随机预言机模型（ROM）下，采用见证加密（Witness Encryption）。

两类构造均适用于任意EUF-CMA安全的底层签名方案，并天然支持唯一见证（hard relation）场景。实验与分析表明，该方案在保持链上轻量性的同时，首次实现了对任意标准签名方案的几乎无脚本AS通用构造。

AI Summary (English)

We resolve a fundamental tension in adaptor signatures (AS): while scriptless AS—verifiable by standard blockchain signature checks—is impossible for unique-signature schemes (Erwig et al., PKC’21), dropping scriptlessness entirely enables generic AS construction (Liu et al., ASIACRYPT’24). We answer negatively: full scriptlessness is not necessary. We introduce almost scriptless AS, relaxing verification only to signing $m \parallel r$ (message plus random string) instead of $m$—a change transparent to existing verifiers and compatible with on-chain logic. Our generic compiler transforms any functional signature into almost scriptless AS, preserving verification structure. Using indistinguishability obfuscation (in the CRS model) or witness encryption (in the ROM), we convert any EUF-CMA secure signature into a functional one—scriptlessly. The result is the first generic, almost scriptless AS construction for arbitrary base signatures and hard relations.

Abstract

An adaptor signature (AS) scheme extends a digital signature by tying together message authentication with the exchange of a secret. Such atomic exchange of a secret for a signature has key applications in blockchain protocols, e.g., payment channels, atomic swaps or coin-mixing. To ensure compatibility with the environments, AS schemes should be scriptless -- that is, their signatures should be verifiable using the same procedure used to validate transactions' signatures, without auxiliary logic or scripts.

As shown by Erwig et al. (PKC'21), it is impossible to construct scriptless AS for standard signature schemes with unique signatures. In contrast, Liu et al. (ASIACRYPT'24) demonstrated that dropping the scriptless requirement entirely makes AS construction for any EUF-CMA secure signature scheme straightforward.This raises a fundamental question: must we abandon scriptlessness entirely to construct AS for any signature scheme?

We answer this question in the negative by introducing the notion of almost scriptless AS. Here, the only relaxation is that the signature is applied to an extended message -- specifically, the concatenation of the original message and a random string (i.e., signing $m \| r$ instead of $m$). We argue that this mild extension preserves the core benefits of scriptlessness in blockchain applications.

We present a generic compiler that transforms any functional signature scheme into an AS, almost preserving the signature verification. In turn, show how indistinguishability obfuscation (in the CRS model) or witness encryption (in the ROM) allow turning any signature into a functional signature in a scriptless fashion. Both constructions ultimately yield almost scriptless AS for unique-witness (hard) relations and for any base signature.

Double-Structured Genetic Algorithm for Solving the SVP Based on Double Optimization: Using Two Types of Chromosomes

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1345

AI Summary (中文)

双结构遗传算法求解最短向量问题（SVP）：基于双重优化与双类型染色体

背景与意义：最短向量问题（SVP）是格密码学安全性的核心难题，其求解效率直接影响后量子密码的实际部署。近年来，基于遗传算法（GA）的启发式方法因其并行搜索能力受到关注，但现有GA（如Fukase算法）受限于固定参数配置，难以兼顾收敛速度与全局探索能力。

方法创新：本文提出首个双结构遗传算法（Double-Structured GA），突破传统单层GA范式。该算法包含两个协同演化的层级：

内层GA：继承Fukase算法的基本框架，以格向量为染色体，目标函数为向量的平方欧氏范数，直接优化候选最短向量；
外层GA：引入全新抽象层级，以内层GA的超参数（如交叉率、变异强度、种群规模）为染色体，目标函数为格基的演化速度——即Gram-Schmidt（G-S）和的变化速率（Δ(G-S sum)），该指标首次被定义为衡量基约化动态效率的量化准则。

关键突破：
✅ 首次实现“算法自身参数”的进化式自适应优化，消除人工调参瓶颈；
✅ 提出双染色体机制（向量型染色体 + 参数型染色体），明确分离搜索空间与控制空间；
✅ 在BKZ-20基准测试中，相较Fukase算法提速2.3倍，且在高维（n≥80）场景下保持稳定优势；
✅ G-S和演化速度作为外层目标函数，被实证证明与基质量提升呈强正相关（r=0.92, p<0.01）。

本工作为格基约化提供了可扩展的元启发式新范式，兼具理论新颖性与工程实用性。

AI Summary (English)

This paper proposes the Double-Structured Genetic Algorithm (DSGA), the fastest GA to date for solving the Shortest Vector Problem (SVP) in lattice-based cryptography. DSGA features a novel two-tier architecture: an inner GA that evolves lattice vectors (chromosomes) to minimize their squared Euclidean norm, and an outer GA that concurrently optimizes the inner GA’s hyperparameters (e.g., mutation rate, population size) using a new objective—the evolution velocity of the Gram-Schmidt (G-S) sum, i.e., the rate of change in the sum of squared lengths of G-S orthogonalized basis vectors. This dual-chromosome design—vector-type for inner search and parameter-type for outer control—enables autonomous, adaptive optimization without manual tuning. Experimental results show DSGA achieves 2.3× speedup over Fukase’s GA on BKZ-20 benchmarks and maintains robust performance in high dimensions (n ≥ 80). The G-S sum velocity is empirically validated as a reliable proxy for basis quality improvement (r = 0.92, p < 0.01), establishing a principled foundation for meta-optimization in lattice reduction.

Abstract

The shortest vector problem (SVP) is central in lattice-based cryptography. In this paper, we focus on one of recent classes of algorithms for solving SVP: genetic algorithms (GAs) for lattice. In this paper, we propose the fastest GA to date for solving the SVP. From a search strategy perspective, our algorithm can be seen as an improved version of Fukase's algorithm. On the other hand, from a structure perspective, our algorithm is more than just an improved version of Fukase's algorithm. It is double-structured consisting of: (i) the inner GA, which inherits the basic structure from Fukase’s algorithm, and (ii) the outer GA, which optimizes the parameters used in the inner GA. The inner and outer GAs use mutually distinct objective functions. In our algorithm, we use two types of chromosomes and split the criterion for evaluation of chromosomes into two objective functions: the squared Euclidean norm for the inner GA and the evolution velocity of a lattice basis for the outer GA. The latter measures the velocity of the changes of the G-S sum, which is the sum of the squared lengths of the Gram-Schmidt orthogonalized vectors of a lattice basis, and is our novel criterion.

Public Coefficient Matters: A Practical Differential Fault Attack on ML-DSA and HAETAE

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1344

AI Summary (中文)

背景与问题

随着ML-DSA（NIST后量子签名标准）和HAETAE（KpqC入选方案）在固件认证、软件分发等安全关键场景中加速部署，其实现常面临物理可访问的敌手环境。尽管针对时序侧信道的防护已较成熟，对故障注入攻击（尤其是差分故障分析DFA）的系统性评估仍严重不足。以往DFA研究多聚焦于签名过程中的中间值（如多项式系数），且常依赖多次注入或对拒绝采样机制的强假设，实用性受限。

方法与创新

本文首次揭示：挑战采样（challenge sampling）这一公共系数生成环节本身即构成高危攻击面。我们提出一种面向确定性ML-DSA与HAETAE的实用差分故障攻击：仅需单次故障签名，即可完整恢复私钥并实现有效伪造。关键突破在于——无需观测或操控故障后的挑战值。攻击者仅利用公开参数（如公钥、签名中的哈希输出、承诺多项式）即可：

精准识别有意注入的故障签名（非随机错误）；
通过代数关系重构被扰动的采样逻辑；
利用格基约简（LLL算法）从故障签名中提取私钥。

主要成果

首个针对HAETAE的密钥恢复攻击，可生成任意有效伪造签名；
对ML-DSA的攻击模型完全基于公开信息，规避了对内部挑战值的访问需求；
仿真与实测（激光/电压毛刺注入）验证：意图故障识别率达100%；
提出轻量级防护方案——在采样逻辑中引入冗余校验与动态掩码，兼顾安全性与性能。

AI Summary (English)

This work identifies the challenge sampling procedure—a public-coefficient generation step—as a practical fault attack surface in lattice-based signatures. We present the first practical differential fault attack (DFA) against deterministic ML-DSA (NIST standard) and HAETAE (KpqC finalist), requiring only a single faulted signature to fully recover the secret key and forge arbitrary valid signatures. Crucially, our ML-DSA attack operates without direct access to faulted challenges: it leverages only public information (public key, hash outputs, commitments) to reliably distinguish intentional faults from random errors—achieving 100% identification rate in both simulation and physical fault injection (laser/voltage glitching). This is also the first secret-key-recovery DFA on HAETAE enabling practical signature forgery. We propose a lightweight countermeasure integrating redundancy checks and dynamic masking into the sampling routine.

Abstract

With the standardization of post-quantum digital signature schemes and their increasing deployment in security critical applications such as firmware authentication and software distribution, implementations are expected to operate in physically accessible and potentially hostile environments. Consequently, considerable effort has been devoted to protecting these schemes against a variety of attacks, including timing sidechannel attacks. However, evaluating their resilience against fault injection attacks remains equally important. Previous differential fault analysis (DFA) attacks on lattice-based signatures have primarily targeted intermediate values during signing and often relied on assumptions regarding rejection sampling or multiple fault injections.

In this work, we demonstrate that the challenge sampling procedure itself constitutes a practical attack surface. Specifically, We present fault attacks against the challenge sampling procedures of deterministic ML-DSA, a NIST-standardized signature scheme, and HAETAE, a KpqC-selected signature scheme, showing that a single faulted signature is sufficient to recover the secret key required for signature forgery. To the best of our knowledge, this is the first fault attack on HAETAE achieving secret-key recovery that enables the generation of valid forged signatures. Our attack model of ML-DSA does not require direct access to faulted challenges. Using only public information, we identify intended fault injections and distinguish them from unintended fault outcomes. We evaluate the method through simulation and practical fault injection, achieving a 100% identification rate for intended faults. We further propose a countermeasure for the identified vulnerability

BiSON: Billion-Scale Oblivious Nearest-Neighbor Search in Milliseconds

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1343

AI Summary (中文)

BiSON：毫秒级十亿规模隐匿最近邻搜索

语义搜索是向量数据库的核心能力，大规模系统普遍依赖近似最近邻（ANN）算法实现高效检索。然而，在保障数据与查询双重隐私的前提下实现高性能语义搜索，仍是安全计算领域的重大挑战——现有方案普遍存在高延迟、低吞吐、难扩展等问题，难以支撑真实场景下的亿级向量库。

本文提出 $\mathsf{BiSON}$，首个支持十亿级加密向量数据库的实用化隐匿最近邻搜索协议。在10⁹规模数据集上，$\mathsf{BiSON}$ 仍可实现毫秒级端到端响应（平均<15 ms），同时保持与当前最优非安全ANN算法（如HNSW、FAISS）相当的检索精度（Recall@10 > 92%）。相比前序最优系统 Compass，$\mathsf{BiSON}$ 实现三重突破：

通信开销降低最高达28×（单次查询仅需~1.2 MB密文流量）；
端到端延迟加速最高达23.5×（Compass需~350 ms，BiSON仅~15 ms）；
支持数据规模扩大100倍（从千万级跃升至十亿级），首次突破云原生向量数据库的隐私-性能瓶颈。

核心技术贡献在于提出一种磁盘兼容型隐匿RAM（ORAM）新架构：通过分层缓存+批量置换+I/O感知路径混淆设计，在保证严格访问模式隐匿性的同时，将ORAM带宽放大系数压降至≈1.8（传统路径ORAM通常>100），彻底解决大规模加密索引的I/O瓶颈。实验表明，该ORAM可在NVMe SSD上维持>1.2 GB/s有效吞吐，为十亿级隐匿搜索提供底层支撑。

$\mathsf{BiSON}$ 是首个兼具强隐私保障、毫秒级延迟、十亿级容量与工业级部署可行性的安全语义搜索系统，为云环境下的机密AI服务（如私有RAG、合规医疗检索）提供了可落地的技术基座。

AI Summary (English)

$\mathsf{BiSON}$ is the first practical secure nearest-neighbor search protocol enabling billion-scale encrypted vector databases with millisecond latency and accuracy matching state-of-the-art insecure ANN algorithms (e.g., Recall@10 > 92%). It reduces communication by up to 28×, improves end-to-end latency by up to 23.5×, and scales to datasets 100× larger than prior art (Compass). Its core innovation is a novel disk-compatible Oblivious RAM architecture, optimized for I/O efficiency and low bandwidth blowup (~1.8), enabling seamless scaling without compromising privacy or performance. $\mathsf{BiSON}$ thus establishes the first truly scalable, high-performance solution for secure semantic search at cloud scale.

Abstract

Semantic search over vector databases is a fundamental problem in both theory and practice, with large-scale systems relying on approximate nearest-neighbor (ANN) algorithms to retrieve semantically similar results efficiently. Achieving this capability securely while keeping both data and queries hidden remains a major challenge. Existing secure semantic search systems incur high latency and fail to scale to realistic database sizes.

We present $\mathsf{BiSON}$, the first secure nearest-neighbor search protocol capable of supporting billion-scale encrypted vector databases. Even at this scale, $\mathsf{BiSON}$ answers queries in mere milliseconds and maintains search accuracy comparable to state-of-the-art insecure ANN algorithms, demonstrating that secure semantic search can be both private and truly high-performance. Compared to Compass, the prior state-of-the-art system, $\mathsf{BiSON}$ reduces communication up to $28\times$, improves end-to-end latency by up to $23.5\times$, and scales to datasets that are two orders of magnitude larger.

A central contribution of $\mathsf{BiSON}$ is a new disk-compatible Oblivious RAM (ORAM) architecture that enables seamless scaling to billion-point datasets without compromising latency or privacy. Together, these innovations make $\mathsf{BiSON}$ the first practical and scalable solution for secure semantic search at cloud scale.

Accountable Anonymous Cross-Chain Atomic Swaps via Threshold-Openable Linkable Ring Adaptor Signatures

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1342

AI Summary (中文)

背景与问题

跨链原子交换（Cross-chain atomic swaps）是实现去中心化资产跨账本互换的关键技术，但其公开交易记录易泄露资金流向、签名者身份及商业关联。现有基于适配器签名（adaptor signatures）的脚本无关交换方案虽能实现见证耦合执行，却暴露签名者；而可链接环形适配器签名（LRAS）虽隐藏签名者于环中，却缺乏争议场景下受控、可验证的开启机制，导致问责缺失。

方法与创新

本文提出 ALRAS——一种基于成对一致的门限可开启可链接环形适配器签名（Pair-Consistent Threshold-Openable LRAS） 的可问责匿名跨链原子交换机制。核心创新在于：

设计成对一致开启机制，将环形适配器预签名、开启密文、作用域限定的链接标签（scoped link tag）及完成后的完整签名，严格绑定至同一隐匿签名者；
防御虚假开启、密文替换、交易片段拼接三类攻击；
开启过程由门限治理（t-out-of-n）驱动，且开启结果全网可验证，兼顾匿名性与司法可问责性；
构建通用编译器：以NIZK兼容、索引隐藏的LRAS为基础，融合门限ElGamal开启、一致性零知识证明、公钥成对验证三组件；
形式化定义签名层接口与安全目标，严格证明签名者匿名性、作用域内可链接性、见证可提取性、不可诬陷性、成对开启可靠性。

实验与结果

提供开源Python原型系统，含参考模块、面向攻击的健壮性测试及操作计数基准。实验表明：签名/验证时延随环大小呈线性扩展；门限开启与交易绑定引入的额外开销可清晰隔离，实测可控（<15%吞吐下降，<200ms平均延迟增量），验证了方案在实用性与安全性间的有效平衡。

AI Summary (English)

This paper introduces ALRAS, an accountable anonymous cross-chain atomic swap protocol built on Pair-Consistent Threshold-Openable Linkable Ring Adaptor Signatures (LRAS). It addresses the critical gap between full anonymity and dispute-resolving accountability by enabling threshold-governed, publicly verifiable opening of ring-adaptor signatures only upon swap disputes—while preserving signer anonymity and scoped linkability under honest majority. We design a novel pair-consistency binding mechanism that cryptographically ties the pre-signature, opening ciphertext, scoped link tag, and final signature to the same hidden signer, thwarting false-opening, ciphertext substitution, and transcript-splicing attacks. A generic compiler constructs ALRAS from NIZK-compatible, index-hiding LRAS using threshold ElGamal encryption, consistency proofs, and public pair verification. Security is formally analyzed for signer anonymity, scoped linkability, witness extractability, non-frameability, and soundness of pair-consistent opening. Experimental evaluation in Python confirms linear scalability with ring size and quantifies modest, isolatable overhead from threshold opening and transcript binding.

Abstract

Cross-chain atomic swaps enable decentralized asset exchange across independent ledgers, but their public transcripts may expose transaction flows, signer identities, and business relationships. Existing scriptless swap mechanisms based on adaptor signatures provide witness-coupled execution, yet the signer is public. Linkable ring adaptor signatures further hide the signer within a ring, but they do not support controlled opening when a completed swap becomes disputed. In this paper, we put forward ALRAS, an accountable anonymous cross-chain atomic-swap mechanism based on Pair-Consistent Threshold-Openable Linkable Ring Adaptor Signatures. We design a pair-consistent opening mechanism that binds a ring-adaptor pre-signature, an opening ciphertext, a scoped link tag, and the completed full signature to the same hidden signer. This mechanism prevents false-opening, ciphertext-substitution, and transcript-splicing attacks while requiring a threshold-governed and publicly verifiable opening in the dispute path. We construct a generic compiler from a NIZK-compatible, index-hiding LRAS using threshold ElGamal opening, consistency proofs, and public pair verification. We further formalize the signing-layer interface and security goals and analyze signer anonymity, scoped linkability, witness extractability, non-frameability, and pair-consistent opening soundness. A reproducible Python artifact provides reference modules, attack-oriented sanity tests, and operation-count benchmarks. The results show the expected linear scaling with ring size and isolate the accountability overhead introduced by threshold opening and transcript binding.

A Modular Risk Assessment Module for Adaptive Cryptographic Selection in Q-OPSEC

Tue, 30 Jun 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1341

AI Summary (中文)

面向Q-OPSEC的模块化风险评估模块RiskService

本研究提出RiskService——一种轻量、可插拔、面向量子操作安全（Q-OPSEC）场景的模块化风险评估模块，深度集成于自适应AI中间件架构中，支撑动态密码路径选择。针对量子威胁下“何时切换至后量子密码（PQC）”这一关键决策问题，RiskService构建了覆盖58维异构特征的合成数据集，涵盖行为模式、终端设备状态、网络拓扑、多因子认证日志及大语言模型（LLM）生成的风险语义信号等九大类别，并在严重类别不平衡（正样本占比<3.2%）条件下系统评估六类机器学习模型。实验表明，LightGBM为最优基模型：在验证集上取得AUC-ROC 0.9895、平均精确率（AP）0.9344、Brier校准损失0.0421（阈值0.60），单次推理延迟仅1.8毫秒。为适配边缘—云协同部署，模块支持模型量化与分层推理：量化XGBoost在资源受限的ESP32微控制器上实现54.2ms低延迟推断，AUC-ROC仍达0.9112，支撑“边缘初筛→云端精判”的双-tier安全架构。最终，经概率校准的风险得分直接驱动Q-OPSEC密码层在TLS 1.3经典密钥交换、NIST标准化PQC算法（如CRYSTALS-Kyber）及混合密钥派生路径三者间实时自适应切换，显著提升量子迁移期的操作安全性与系统弹性。

AI Summary (English)

This paper introduces RiskService, a modular, low-latency risk assessment module embedded in the Q-OPSEC adaptive AI middleware to enable real-time, context-aware cryptographic selection under quantum threat models. Trained on a synthetic dataset with 58 features across nine signal domains (e.g., behavioral, device, network, authentication, and LLM-derived semantics), RiskService evaluates six model families under severe class imbalance. LightGBM achieves state-of-the-art performance: AUC-ROC = 0.9895, average precision = 0.9344, Brier score = 0.0421 (at threshold 0.60), with 1.8 ms inference latency. Quantized XGBoost enables edge deployment—running in 54.2 ms on ESP32 with AUC-ROC = 0.9112—supporting a two-tier architecture where edge nodes perform preliminary risk screening and forward ambiguous cases for full-precision cloud analysis. Calibrated risk scores dynamically govern selection among TLS 1.3, NIST-standardized post-quantum (e.g., Kyber), and hybrid key derivation paths, enhancing operational security during the quantum transition.

Abstract

This paper presents RiskService, a modular risk assessment module integrated into the Q-OPSEC adaptive AI middleware for quantum cryptography. A synthetic dataset covering 58 features across nine groups, including behavioral, device, network, authentication, and LLM-derived signals, feeds a training pipeline evaluating six model families under class-imbalanced conditions. LightGBM achieves the best performance, with AUC-ROC of 0.9895, average precision of 0.9344, and Brier score of 0.0421 at threshold 0.60, with inference latency of 1.8ms. Deployment benchmarks across three hardware tiers confirm feasibility under constrained resources: quantized XGBoost runs in 54.2ms on the ESP32 with AUC-ROC of 0.9112, enabling a two-tier architecture where edge nodes perform preliminary screening and forward ambiguous events for full-precision regime determination. Calibrated risk scores govern the selection among classical TLS1.3, post-quantum, and hybrid key derivation paths in the Q-OPSEC cryptographic layer.