Repeated Masks, Predictable Splices: Breaking AESpolyW and Its AE Applications
https://iacr.org/news/item/29000

ePrint Report: Repeated Masks, Predictable Splices: Breaking AESpolyW and Its AE Applications

Shuping Mao, Peng Wang, Jiadong Han, Tingting Guo, Yan Jia, Ying Chen
AESpolyW, proposed at IEEE S&P 2026, is a wide-block encryption mode designed to exploit instruction-level parallelism between AES and polynomial hashing. Although AESpolyW achieves high throughput and outperforms HCTR2 and EME on most tested platforms, we show that AESpolyW does not achieve strong tweakable-PRP security. Our attack requires only two encryption queries and one decryption query, and distinguishes AESpolyW from an ideal tweakable permutation with advantage close to one. We further show that this weakness directly compromises Encode-then-Encipher authenticated encryption (AE) instantiated with AESpolyW. For the appended-zero, prepended-zero, and inserted-zero variants, we construct fresh ciphertext forgeries that are accepted with probability one. The same attacks also yield chosen-ciphertext plaintext disclosure and complete IND-CCA breaks. These results are structural and do not rely on any weakness of AES, the polynomial hash, or PHASH.

BeeKEM: Decentralized, Secure and Efficient Group Key Agreement
https://iacr.org/news/item/29010

ePrint Report: BeeKEM: Decentralized, Secure and Efficient Group Key Agreement

Derek Yen, Andrés Fábrega, Liangrun Da, Martin Kleppmann, John Mumm, Sunoo Park, Brooklyn Zelenka
Group key agreement protocols are essential for modern secure messaging. Most existing group key agreement protocols assume a centralized model with a semi-trusted service that mediates the communication. This is efficient, but problematic for some important applications, since a central service can be a choke point for surveillance and censorship. There is a nascent literature on decentralized group key agreement that avoids such reliance, but existing proposals either do not scale, with update costs linear or quadratic in the group size, or lack proofs of security. Centralized protocols can offer much lower (logarithmic) cost.


We present BeeKEM, the first decentralized group key agreement protocol with logarithmic update cost in the common case (degrading to linear in the worst case) and proofs of security. We provide an open-source implementation and demonstrate that it is competitive with OpenMLS. BeeKEM opens the door for a range of communication and collaboration applications offering not only end-to-end encryption, but also metadata privacy and censorship resistance.

Reed–Solomon Mutual Correlated Agreement Beyond the Johnson Radius
https://iacr.org/news/item/29008

ePrint Report: Reed–Solomon Mutual Correlated Agreement Beyond the Johnson Radius

Sunghyeon Jo
Mutual correlated agreement (MCA) bounds how many points on an affine line of received words can agree with codewords on many coordinates when the line does not admit a common codeword explanation on those coordinates; the corresponding line parameters are called bad. MCA arises in the soundness analysis of code-based proof systems. For Reed-Solomon codes with arbitrary prescribed evaluation sets, existing deterministic bounds apply only at integer error budgets strictly below the exact Johnson boundary.


Fix integers $r\ge2$ and $h\ge1$. For every sufficiently large $K$, let $L\subseteq\mathbb{F}_q$ be any set of $n=rK$ distinct points and set $C=\operatorname{RS}_{

We also derive a MCA upper bound for maximum distance
separable (MDS) codes from a sharp lower bound on the number of rejected
local membership tests. For Reed-Solomon codes over sufficiently large
fields, the resulting endpoint bound is exact whenever at most $K+1$
agreements are required. It yields exact $2^{-128}$ thresholds for four explicit smooth-domain codes of length $64$: we identify the largest safe integer budget and prove that the next one is unsafe.


As a concrete application to the Grand MCA Challenge, we exhibit a single prime field $\mathbb{F}_Q$, with $Q<2^{256}$, that supports the required smooth domains at all four target rates. With $K=2^{18}$, the first post-Johnson budget has MCA error below $2^{-128}$ at rates $1/2,1/4,1/8,$ and $1/16$, as does the second such budget at rate $1/8$.

Shuffled-ArgMax: Securing ArgMax Decisions Against Side-Channel-Guided Fault Injection in Edge-AI IoT Devices
https://iacr.org/news/item/29009

ePrint Report: Shuffled-ArgMax: Securing ArgMax Decisions Against Side-Channel-Guided Fault Injection in Edge-AI IoT Devices

Le Wu, Liji Wu, Yuyang Pan, Xiangmin Zhang, Jian Wu
Edge-AI Internet-of-Things (IoT) devices increasingly perform local neural-network inference in physically accessible environments. While prior physical attacks on neural networks mainly focus on model extraction, parameter recovery, or intermediate computation, the final decision stage remains insufficiently studied. This paper investigates the physical security of ArgMax-based decision logic, which converts output scores into the final class label in many edge-AI deployments. We show that a sequential ArgMax implementation can expose deterministic power-trace patterns associated with loop iterations and conditional maximum updates. These patterns can be used to recover decision-related timing information and guide voltage fault injection, enabling targeted redirection of the final inference result. We implement the attack on a real MCU-based edge-AI platform using an STM32F407VG device running an X-CUBE-AI-deployed convolutional neural network. Under dual-point voltage fault injection, the unprotected ArgMax achieves targeted redirection to all non-original classes in the MNIST case study. To mitigate this threat, we propose Shuffled-ArgMax, a lightweight software-level defense that combines randomized traversal, loop-integrity checking, and redundant decision verification. Experimental results show that, under the same attack setting, Shuffled-ArgMax reduces the targeted redirection success rate from 56.92% to 0%, demonstrating strong resilience against targeted misclassification attacks. Meanwhile, it introduces only a small end-to-end runtime overhead relative to the complete DNN inference.

FiltrumVote: Scalable, Verifiable, and Coercion-Resistant Internet Voting
https://iacr.org/news/item/29011

ePrint Report: FiltrumVote: Scalable, Verifiable, and Coercion-Resistant Internet Voting

Leonardo Kimura, Dimitri Leskow, Diego F. Aranha, Roberto Araújo, Marcos Simplicio
Internet voting can increase voter turnout and reduce operational costs; however, it also facilitates voter coercion. One compelling approach to address this issue is deniable vote updating, which allows voters to cast multiple ballots while counting only their final vote. Despite its intuitive appeal, achieving deniable vote updating together with verifiability and scalability has proven challenging. Therefore, we present FiltrumVote, a scalable, publicly verifiable, and coercion-resistant Internet voting system based on deniable vote updating. It has a quasi-linear cleansing phase, and it is built mainly from zero-knowledge proofs with standard $\Sigma-$protocol techniques. As a result, FiltrumVote is highly scalable: a standard computer takes less than 5 hours to prove all zero-knowledge proofs for one million votes.

ABE for Unbounded Depth Circuits from the Doubly Circular Assumption
https://iacr.org/news/item/29015

ePrint Report: ABE for Unbounded Depth Circuits from the Doubly Circular Assumption

Shweta Agrawal, Anuja Modi, Anshu Yadav, Shota Yamada
The recent work of Hsieh, Lin and Luo [HLL23] (HLL23) provided the first construction of ABE for unbounded depth circuits from the circular evasive LWE assumption, which they introduced. Unfortunately, this assumption has been recently broken [AMYY25]. Finding a new construction for unbounded depth ABE from a safe assumption, without relying on compact functional encryption or obfuscation, is therefore an important open problem.


In this work, we provide a new candidate for ABE for circuits of unbounded depth as well as unbounded width from a novel, falsifiable ``doubly circular'' assumption which combines circular LWE with key dependent message security of a variant of ElGamal encryption in an inseparable manner. We show that the assumption holds in Shoup's bilinear generic group model, which rules out all non-generic attacks. In particular, this implies that our construction is secure assuming circular LWE in the bilinear generic group model, which has a long history of study. We also show that in a restricted setting, it is implied by the standard SXDH assumption and circular LWE.

Vela and Carina: Fast Pairing-Based Multilinear Polynomial Commitments from Reciprocal Polynomials
https://iacr.org/news/item/29014

ePrint Report: Vela and Carina: Fast Pairing-Based Multilinear Polynomial Commitments from Reciprocal Polynomials

Yuncong Zhang
Pairing-based multilinear polynomial commitments offer succinct verification for sum-check-based proof systems, but existing schemes trade prover group work against proof size and verifier cost. Building on Mercury's representation of a multilinear evaluation as the constant coefficient of a Laurent polynomial, we construct two schemes with different performance trade-offs. Vela uses inversion symmetry to derive a half-length auxiliary polynomial and opens two polynomials at $z$ and $z^{-1}$ with one univariate KZG proof. It has a $2G_1+4F$ proof, a two-term pairing check, and approximately $2N$ opening MSM scalars, at the cost of $O(N\log N)$ field operations. Carina applies the same constant-term reduction once in each coordinate and jointly proves evaluation claims for the committed bivariate polynomial and two auxiliary polynomials with one grid opening. For $N=2^{\mu}$ and $b=\sqrt{N}$, it has a $4G_1+8F$ proof, a three-term pairing check, $O(N)$ field operations, and exactly $N+2 b-6$ opening MSM scalars.


We prove completeness, commitment binding, and knowledge soundness in the algebraic group and random-oracle models under the standard bilinear $q$-DLOG assumption. Our curve-generic Rust implementation also provides common implementations of six pairing-based baselines. On BLS12-381 at $\mu=20$, \vela gives the smallest measured proof (232 bytes, 1.62x smaller than the next smallest) and the lowest measured verification time (2.09 ms). Carina's opening performance is in the same leading tier as the prover-oriented mKZG and CHOPIN implementations, while its 452-byte proof and 2.81 ms verifier improve on both. Compared with the verifier-oriented Mercury, Carina roughly halves opening time at the cost of a modest verifier slowdown.

SoK: On the Design of Secure Ranking-based E-voting Systems
https://iacr.org/news/item/29013

ePrint Report: SoK: On the Design of Secure Ranking-based E-voting Systems

Luke Harrison, Feng Hao, Bowen Zheng, Bingsheng Zhang
Vote privacy and verifiability are two fundamental properties which must be maintained for elections. Studies in e-voting technology have demonstrated how elections may be secured through cryptographic techniques including mix-nets, homomorphic encryption, and Zero Knowledge Proofs (ZKPs). The implications and trade-offs that must be considered when designing an e-voting system using multiple cryptographic techniques for simple majority or plurality voting are well understood in the literature. However, it is less clear how these techniques affect the design process for complex e-voting systems such as those based on ranked voting. Examples include Borda count, Condorcet voting, Instant Runoff Voting (IRV), and Single Transferable Vote (STV). In this paper, we systematically analyse the cryptographic design of ranking-based e-voting systems in the literature and explore how the cryptographic techniques utilised by such systems affect the strength of their security guarantees including vote privacy and verifiability. In addition, we explore how their cryptographic designs impact social choice properties including support for various counting functions as well as flexibility in vote casting. Our findings demonstrate that ranked e-voting systems may be largely classified according to the degree of information leakage present in each solution, and that systems belonging to each of these categories share similar properties and usage of cryptographic techniques. We then discuss an overview of our findings and identify a number of open problems following our analysis. Overall, this paper serves as a comprehensive study on the state-of-the-art for secure ranked e-voting systems in the literature.

Verifiable and Collusion-Resistant Multi-Party Quantum Private Set Operations
https://iacr.org/news/item/29012

ePrint Report: Verifiable and Collusion-Resistant Multi-Party Quantum Private Set Operations

Zixian Gong, Kun Tian, Yi Zhang, Fengxia Liu
Private set intersection (PSI) and, more broadly, private set operations (PSO) are fundamental primitives for secure multiparty computation (SMC), enabling participants to jointly compute set relations while revealing no information beyond the prescribed output. As quantum technologies advance, PSI have correspondingly evolved toward quantum secure phase. Existing quantum PSI (QPSI) solutions are limited in their threat models and collusion behavior between third party (TP) and participants. In this work, we present a multi-party QPSI (MP-QPSI) protocol that integrates verifiable quantum fully homomorphic encryption (vQFHE) as the verifiable outsourced quantum-evaluation layer and threshold fully homomorphic encryption (TFHE) as the threshold key-management mechanism. We instantiate the intersection computation via a \(C^{\mathsf{AND}}\) circuit accompanied by simulations on IBM Quantum Platform. We analyze correctness and participant privacy against TP, external eavesdroppers, and collusive behaviors, and we further prove verifiability against a malicious TP under the semantic security model. Finally, we present a modular framework perspective with several realizations, show how to extend the construction to quantum private set union (QPSU) via open-controlled operations. Compared with prior schemes, our protocol provides flexible set operations and stronger resilience under the TP model, including TP-participant collusion, thereby offering enhanced security and broader applicability.

Sublinear-Communication Layered MPC from HSS
https://iacr.org/news/item/29021

ePrint Report: Sublinear-Communication Layered MPC from HSS

Anasuya Acharya, Pierre Meyer, Divya Ravi, Rahul Satish
The server-aided Secure Multi-Party Computation (MPC) model with dynamic participation, where servers may join or leave during the computation is particularly well-suited for practical, long-running applications. Unfortunately, existing protocols supporting dynamic participation either incur communication costs that scale linearly with the circuit size or rely on the heavy hammer of Fully Homomorphic Encryption (FHE). This contrasts with “classic” MPC protocols, where sublinear communication can be achieved without FHE. Focusing on the Layered MPC framework (introduced by David, Ishai, Konring, Kushilevitz, and Narayanan, CRYPTO 2023), we show that this overhead is not inherent. We construct sublinear-communication Layered MPC protocols while maintaining a minimal number of online servers — only two or three per layer. Our constructions rely on a layered-friendly adaptation of Homomorphic Secret Sharing (HSS), which we formalize as HSS with Layered Resharing.

Quantum Circuit Optimization with LLMs under a Structured Guideline
https://iacr.org/news/item/29022

ePrint Report: Quantum Circuit Optimization with LLMs under a Structured Guideline

Kyungbae Jang, Hyunji Kim, Hwajeong Seo, Anupam Chattopadhyay
The cost of quantum cryptanalysis is dominated by the quantum circuit of the target cipher. Estimating the quantum attack cost of a cipher thus requires building that circuit and measuring its qubit count, Toffoli count, and Toffoli depth. This is manual work that needs expert knowledge and must be redone for each cipher and each cost target. Large language models handle ordinary programming well, but their use in constructing quantum circuits for ciphers is still limited. In this work, we collect quantum circuit optimization techniques that apply across many ciphers. We write these techniques into a guideline for a general-purpose LLM. Given this guideline and a single target cipher, the model produces two circuits. One minimizes the qubit count, and the other minimizes the Toffoli depth. Each circuit is verified against the test vectors of the cipher before its resources are estimated. Using this approach, we implement quantum circuits of CRAFT, MANTIS, QARMA, mCrypton, EPCBC, and Pyjamask for which quantum circuit implementations have not previously been reported.

QuantumScouter: Reinforcement Learning-Based Optimization of Variational Quantum Circuits for Differential Cryptanalysis
https://iacr.org/news/item/29032

ePrint Report: QuantumScouter: Reinforcement Learning-Based Optimization of Variational Quantum Circuits for Differential Cryptanalysis

Gilsang Ahn, Jiwoo Baek, Donggun Lee, Insung Kim, Changmin Lee, Seokhie Hong, Dongjae Lee
Classical deep learning for differential cryptanalysis requires millions of ciphertext pairs, rendering attacks infeasible or easily detectable. This work overcomes this data limitation by introducing quantum differential distinguishers, enabling a practical attacker model where executing few queries is feasible. We design these distinguishers via quantum machine learning based on variational quantum circuits. To address circuit design challenges, we propose QuantumScouter, a reinforcement learning method that discovers compact quantum circuits. Unlike prior work, QuantumScouter explicitly targets metrics like gate count and circuit depth, producing circuits suitable for noisy intermediate-scale quantum hardware. We apply QuantumScouter to the SPECK32/64 and SIMON32/64 ciphers. The models are trained to distinguish ciphertext pairs possessing a meaningful differential from completely random pairs. For SPECK, our approach achieves $0.80$ accuracy, outperforming the $0.53$ of prior work while reducing required qubits from $16$ to $6$. For SIMON, we establish a novel quantum baseline with $0.75$ accuracy. Notably, under a restricted regime of merely $400$ training samples, classical deep learning models struggle. A simple MLP with $361$ parameters fails to capture differential characteristics, resulting in an accuracy of $0.51$, while a deep ResNet with $64{,}737$ parameters overfits to yield an accuracy of $0.55$. In stark contrast, our data-efficient quantum distinguisher extracts meaningful features using only $49$ gates, maintaining $0.80$ accuracy.

Trout++: Robust Asynchronous Two-Round ECDSA for Arbitrary Thresholds
https://iacr.org/news/item/29031

ePrint Report: Trout++: Robust Asynchronous Two-Round ECDSA for Arbitrary Thresholds

Ariel Nof, Luke Parker
We present Trout++, a complete threshold signing suite for ECDSA signatures. Trout++ descends from the recent Trout protocol (Dahari-Garbian, Nof, and Parker, ACM CCS 2025) and inherits its transparent setup, two-round structure, and strong security guarantees, while introducing several significant improvements.


Unlike Trout, Trout++ offers pre-signing, where the first round is key-, signing-set-, and message- independent.
This property is not only important in its own right but also enables us to apply the ROAST transformation (Ruffing, Ronge, Jin, Schneider-Bensch, and Schröder, ACM CCS 2022) to our protocol, yielding the \textit{first} arbitrary-threshold (including with a dishonest majority), robust, asynchronous signing protocol for ECDSA signatures.


Furthermore, we introduce several optimizations to the building blocks in Trout that reduce both bandwidth and computation.
Our benchmark results show that our implementation of Trout++ is approximately twice as fast \emph{and} twice as small compared to the prior implementation of Trout. We also present a constant-time implementation with running time that is \textit{ten times faster} than Trout's constant-time implementation.


Finally, we show how Trout++ can be composed with an account derivation scheme that does not require additional setups per derivation, enabling more practical solutions for managing key material.


In total, we achieve complexities and functionality comparable to, and closing the gap with, leading solutions for Schnorr signatures (such as FROST).

Faster NTRU-based Bootstrapping with Extended and Sorting-based Techniques
https://iacr.org/news/item/29023

ePrint Report: Faster NTRU-based Bootstrapping with Extended and Sorting-based Techniques

Jingwei Feng, Baofeng Wu, Dongdai Lin
NTRU-based bootstrapping offers a high-performance variant of FHEW-like bootstrapping schemes and is simpler than its RLWE-based counterparts. Nevertheless, it remains costly in terms of both memory and time. A key computational bottleneck arises from the constraint $q\mid 2N$ which links the LWE ciphertext modulus $q$ to the NTRU dimension $N$. In this work, we apply extended techniques to remove the limitation $q \mid 2N$. With a large modulus $q$, we are able to complete the bootstrapping algorithms using a relatively small $N$-dimensional ring, thereby improving both time and memory efficiency. Additionally, we employ sorting-based techniques to eliminate unnecessary operations, which further enhances time performance. We also extend this approach to improve the efficiency of NTRU-based multi-key bootstrapping algorithms.

We implement our algorithms using the CHIFHE and MKFHE libraries. At the 128-bit security level, our sorting-based techniques (with factor $\eta=16$ ) accelerate single-key bootstrapping by factors of $1.82\times$ and $1.24\times$ over the FINAL scheme (ASIACRYPT 2021) and the key unrolling method (CHES 2024), respectively. For multi-key bootstrapping (with factor $\eta=4$), we achieve a $1.70\times$ speedup over the prior art (ASIACRYPT 2024). In addition, both single-key and multi-key algorithms reduce memory usage by a factor of $\eta$.

Batched Attribute-Based Encryption from Bilinear Pairings
https://iacr.org/news/item/29030

ePrint Report: Batched Attribute-Based Encryption from Bilinear Pairings

Ramprasad Sarkar, Shayeef Murshid, Mriganka Mandal
Batched identity-based encryption (batched IBE), introduced by Agarwal, Fernando, and Pinkas (CRYPTO 2025), enables a key authority to issue a single succinct key that decrypts an entire batch of ciphertexts. However, existing batched encryption protocols support only identity-based access control and do not accommodate expressive attribute-based policies. We are the first to introduce Batched Attribute-Based Encryption (B-ABE), a generalization of batched encryption to the attribute-based setting. In B-ABE, ciphertexts are associated with attribute sets and batch labels, while a single batch key is bound to an access policy and a public digest of the batch. The key decrypts exactly those ciphertexts in the batch whose attributes satisfy the policy, and its size is independent of the batch size. We construct B-ABE in asymmetric bilinear groups and prove security under the standard Decisional Bilinear Diffie-Hellman (DBDH) assumption in the random oracle model.


We further introduce the first Threshold Batched Attribute-Based Encryption (TB-ABE), in which the master secret is distributed among L authorities via Shamir secret sharing. Any subset of at least T authorities can non-interactively generate publicly verifiable key shares that aggregate into a succinct batch key of the same asymptotic size as in the single-authority setting. We formalize security against static corruptions of up to (T-1) authorities and adaptive key-share queries and prove security under the DBDH assumption in the random oracle model.

Celer: A Lookup Argument for Large-Scale Queries
https://iacr.org/news/item/29029

ePrint Report: Celer: A Lookup Argument for Large-Scale Queries

Wenjie Qu, Yanpei Guo, Zhen Xuan, Xuanming Liu, Jiaheng Zhang
Lookup arguments are designed to prove that all elements in a query vector appear in a lookup table.
These arguments are critical for efficiently proving ZK-unfriendly statements, such as range checks and the evaluation of complex functions. Most existing lookup arguments are optimized for scenarios where the query size is smaller than the table size.
However, in many real-world applications, the query size $m$ is often much larger than $n$, the table size. This disparity leads to inefficiencies in such schemes.


To overcome this limitation, we propose Celer, a novel lookup argument in which the prover's runtime increases slowly with $m$, thereby providing improved scalability. The efficiency of our lookup PIOP stems from reducing the number of commitments to be sublinear in the query size $m$, while maintaining field operations linear in $m$. Experimental results demonstrate that our lookup scheme significantly outperforms state-of-the-art lookup schemes. For the workload of query size $m=2^{28}$ and table size $n=2^{16}$ (a real world case in proving Llama language model inference), our scheme achieves a 25.9$\times$ prover-time speedup over plookup and is 9.4$\times$ faster than LogUp.

SECITC 2026: International Conference on Security for Information Technology and Communications
https://iacr.org/news/item/29033

Event Calendar: SECITC 2026: International Conference on Security for Information Technology and Communications

Bucharest, Romania, 12 November - 13 November 2026
Event date: 12 November to 13 November 2026

Submission deadline: 7 September 2026

Notification: 5 October 2026

FSP 2026: 2026 International Workshop on Future Security and Privacy
https://iacr.org/news/item/29036

Event Calendar: FSP 2026: 2026 International Workshop on Future Security and Privacy

Jeju, South Korea, 24 August - 26 August 2026
Event date: 24 August to 26 August 2026

Submission deadline: 31 July 2026

Notification: 7 August 2026

SSR2026: Security Standardisation Research Conference 2026
https://iacr.org/news/item/29035

Event Calendar: SSR2026: Security Standardisation Research Conference 2026

Baltimore, USA, 13 December - 15 December 2026
Event date: 13 December to 15 December 2026

Submission deadline: 15 September 2026

ITU Journal Special issue on quantum-safe communication
https://iacr.org/news/item/29034

Event Calendar: ITU Journal Special issue on quantum-safe communication

-
Event date: to

Submission deadline: 30 November 2026