We introduce PaCo, a novel and efficient bootstrapping procedure for the CKKS homomorphic encryption scheme, where PaCo stands for (Bootstrapping via) Partial CoeffToSlot. At a high level, PaCo reformulates the CKKS decryption equation in terms of blind rotations and modular additions. This reformulated decryption circuit is then evaluated homomorphically within the CKKS framework. Our approach makes use of the circle group in the complex plane to simulate modular additions via complex multiplication, and utilizes alternative polynomial ring structures to support blind rotations. These ring structures are enabled by a variant of the CoeffToSlot operation, which we call a partial CoeffToSlot. This yields a new bootstrapping approach within CKKS, achieving a computational complexity which is logarithmic in the number of complex slots. We further introduce a parallelized variant that enables bootstrapping over all CKKS slots with enhanced throughput, highlighting PaCo ’s suitability for practical and large-scale homomorphic applications. In addition to the bootstrapping technique itself, we develop several supporting tools—particularly in the context of bit-reversing and alternative ring structures for CKKS—which can be of independent interest to the community. Finally, a proof-of-concept implementation confirms that PaCo achieves performance competitive with state-of-the-art methods for CKKS bootstrapping.
We construct an efficient pseudorandom correlation generator (PCG) (Boyle et al., Crypto’19) for two-party programmable oblivious linear evaluation (OLE) functionality over 𝔽_2 . Our construction (i) has an efficient seed expansion phase, and (ii) comes with a concretely efficient protocol for distributing the seeds that makes black-box use of cryptography and runs in a constant number of rounds. PCGs for programmable OLE are known to imply PCGs for generating n-party Beaver triples over 𝔽_2 . The resultant PCG has a seed setup phase whose communication cost is n(n-1) times than that of the programmable OLE protocol. The per-party seed size and the seed expansion time have a multiplicative overhead of 2(n-1) . Prior constructions for efficiently generating multiparty Beaver triples only worked for finite fields 𝔽_q where q ≥ 3 or required one bit of per-party communication for each triple generated (and hence, do not satisfy the PCG definition). Thus, ours is the first concretely efficient PCG for generating Beaver triples over 𝔽_2 in the multiparty setting. Our distributed seed generation protocol generates N = 2^30 two-party programmable OLEs in 3.5 min with 255 MB of communication over a LAN network. The PCG seed size is around 55 MB and the expansion phase requires 10 PRG calls and around 229 thousand XOR and AND operations per triple, producing roughly 31,000 triples per second. Our PCG for generating multiparty Beaver triples has lower concrete communication cost than the state-of-the-art for small number of parties. When compared to the FOLEAGE protocol (Bombar et al., Asiacrypt 2024), which requires one bit of per-party communication per triple that is generated, our communication cost is lower by 2.4× when generating N = 2^36 triples between three parties and is 1.2 × lower for the case of five parties. At a conceptual level, our protocol deviates from the prior approaches which relied on variants of dual learning parity with noise (LPN) assumption. Instead, our construction combines both the primal and dual versions of LPN to achieve the aforementioned efficiency.
Fully Homomorphic Encryption (FHE) enables secure computation over encrypted data, offering a breakthrough in privacy-preserving computing. Despite its promise, the practical deployment of FHE has been hindered by the significant computational overhead, especially in general-purpose bootstrapping schemes. In this work, we build upon the recent advancements of [LY23] to introduce a variant of the functional/programmable bootstrapping. By carefully sorting the steps of the blind rotation, we reduce the overall number of external products without compromising correctness. To further enhance efficiency, we propose a novel modulus-switching technique that increases the likelihood of satisfying pruning conditions, reducing computational overhead. Extensive benchmarks demonstrate that our method achieves a speedup ranging from 1.75x to 8.28x compared to traditional bootstrapping and from 1.26x to 2.14x compared to [LY23] bootstrapping techniques. Moreover, we show that this technique is better adapted to the IND-CPA^D security model by reducing the performance downgrade it implies.
Deterministic signatures are often used to mitigate the risks associated with poor-quality randomness, where the randomness in the signing process is generated by a pseudorandom function that takes a message as input. However, some studies have shown that such signatures are vulnerable to fault-injection attacks. To strike a balance, recent signature schemes often adopt “hedged” randomness generation, where the pseudorandom function takes both a message and a nonce as input. Aranha et al. (EUROCRYPT 2020) investigated the security of hedged Fiat-Shamir signatures against 1-bit faults and provided a security proof for specific classes of bit-tampering attacks. Grilo et al. (ASIACRYPT 2021) extended this proof to the quantum random oracle model. Last year, NIST standardized the lattice-based signature scheme ML-DSA, which adopts the hedged Fiat-Shamir with aborts. However, existing security proofs against bit-tampering faults do not directly apply, as Aranha et al. left this as an open problem. To address this gap, we analyze the security of ML-DSA against multi-bit fault-injection attacks. We provide a formal proof of security for a specific class of faults at the inputs and outputs of internal functions, showing that faults at these points cannot be exploited. Furthermore, to highlight the infeasibility of stronger fault resilience, we survey key-recovery attacks that exploit signatures generated under fault injection at the other intermediate points.
White-box cryptography aims to protect cryptographic implementations against adversaries with full access to execution environments. The encoding-based white-box implementations in SASAS and ASA constructions without the external encodings are vulnerable to automated side-channel analysis such as differential computation analysis (DCA) and differential fault analysis (DFA). The proposed countermeasures for encoding-based white-box implementations, such as masking and table redundancy, are designed to provide one-side defense against either DCA or DFA. However, these approaches are insecure, and no unified countermeasure capable of simultaneously defending against both DCA and DFA has been proposed. This paper proposes the first encoding-based white-box implementation with an ASASA structure against both DCA and DFA attacks. By decomposing and recombining Sbox layers across rounds, our construction conceals round boundaries while enabling efficient representation via multivariate polynomials. Without the external encoding, the ASA-based first and last rounds inherently resist DFA while remaining vulnerable to DCA. To enhance the DCA resistance, we introduce a cipher-level defense framework integrating anti-DCA Sboxes and anti-DCA/DFA layers. This unified approach provides n-bit security for an n-bit block length cipher against both DCA and DFA attacks. Our work bridges critical gaps in white-box cryptography by enabling ASASA-based encodings and offering combined DCA and DFA countermeasures through novel cipher-level constructions.
A leakage suppressor is a compiler that transforms a structured encryption (STE) scheme into a new scheme with an improved leakage profile. General-purpose suppressors for the query equality (qeq) pattern—which reveals if and when two queries are the same—were given for both static (Kamara et al., Crypto ’18) and dynamic (George et al., Eurocrypt ’19) encrypted structures. While the schemes that result from these suppressors are asymptotically efficient, they are not practical due to large constants in their query complexity. In this work, we propose a new query equality suppressor for dictionary encryption schemes that results in practical qeq-hiding encrypted dictionaries at the cost of revealing the distribution of the queries. The resulting constructions are distribution-aware, in the sense that they make use of the query distribution, and distribution-leaking in the sense that they also reveal it. We show how to instantiate and optimize our suppressor for query distributions that are Zipf-distributed, resulting in a scheme with O(1) online query complexity at the cost of a rebuild with O(m log ^2 m/loglog m) complexity, where m is the size of the input dictionary.
Homomorphic Encryption (HE) enables the secure computation of functions on ciphertexts without requiring decryption. Specifically, AP-like HE schemes exploit an intrinsic bootstrapping method called blind rotation. In existing blind rotation methods, a look-up table is homomorphically evaluated on the input ciphertext through iterative multiplication of monomials. However, the algebraic structure of the multiplicative group of monomials imposes certain limitations on the input plaintext space, as it can bootstrap only a fraction of the input plaintext space. In this work, we introduce a new HE scheme, Carousel, that solves this problem. The key idea of our approach is to utilize the automorphism group instead of monomials. More specifically, the look-up table is encoded into a single polynomial that can be rotated via a series of homomorphic multiplications and automorphisms. We instantiate Carousel with subring encoding proposed by Arita and Handa (ICISC ’17) and provide a proof-of-concept implementation. Our benchmark result shows that Carousel can bootstrap 4-bit integers in under 30 ms.
Random beacons play a critical role in blockchain protocols by providing publicly verifiable, unpredictable randomness essential for secure assignment of protocol roles such as block producers and committee membership. In the interest of efficiency, many deployed blockchains adopt beacon algorithms that suffer from grinding: an adversarial attack in which a party exploits freedom given by the protocol to bias the outcome of the random beacon by resampling it several times and picking the most desirable outcome. To compound the problem, beacons often operate in an iterative manner, where the beacon output produced during one protocol epoch serves as the random seed for the beacon’s invocation in the next epoch. This amplifies the security threat, as such attacks may then aggregate their power over many epochs. In this article, we formulate a generic framework for information-theoretic analysis of grinding in iterated randomness beacons. We define the natural grinding capacity of a beacon, intuitively corresponding to the amount of grinding it allows with a uniformly random seed. We then prove that sufficiently strong tail bounds on this quantity can be transformed into a guarantee on smooth min-entropy of the iterated beacon’s output, even conditioned on all past outputs and irrespective of the inner workings of the beacon. Such min-entropy guarantees can immediately be translated into corresponding statements about various applications of the beacon to committee selection, incentives, or underlying protocol security. Our main technical result concerns conventional longest-chain protocols, where we establish that the combinatorial structure of the forest of longest chains can be leveraged to control grinding. Instantiating the generic framework with these grinding upper bounds, we establish that the randomness beacon of the Ouroboros Praos protocol is secure against adversaries controlling up to about 12
We initiate the holistic study of Policy Compliant Secure Messaging (PCSM). A content policy is a predicate over messages deciding which messages are considered harmful and which not. A PCSM protocol is a type of end-to-end encrypted (E2EE) messaging system that guarantees E2EE privacy and authenticity for all policy compliant messages but detects and verifiably reports harmful content prior to its delivery. This stands in contrast to prior content moderation systems for E2EE messaging where detection relies on receivers reporting the harmful content themselves which makes them unsuited for most PCSM applications (e.g., for preventing the wilful distribution of harmful content). Our holistic PCSM notion explicitly captures several new roles such as policy creator, auditor and judge, to more accurately separate and model the different goals and security concerns of stakeholders when deploying PCSM. We present efficient PCSM constructions for arbitrary policy classes, as well as for hash-based ones, achieving various levels of security, while maintaining the core security properties of the underlying E2EE layer. For hash-based PCSM, we encapsulate Apple’s recent PSI protocol used in their content moderation system, and we properly adapt it to realize the desired PCSM functionality, and analyze the resulting protocol’s security. To our knowledge, our work is the first that rigorously studies Apple’s PSI for server-side content moderation within the broader context of secure messaging, addressing the diverse goals and security considerations of stakeholders when deploying larger systems.
Leakage-resilient secret sharing is a fundamental building block for securing implementations against side-channel attacks. In general, such schemes correspond to a tradeoff between the complexity of the resulting masked implementations, their security guarantees and the physical assumptions they require to be effective. In this work, we revisit the Inner-Product (IP) framework, where a secret y is encoded by two vectors (ω,y) , such that their inner product is equal to y . So far, the state of the art is split in two. On the one hand, the most efficient IP masking schemes (in which ω is public but random) are provably secure with the same security notions (i.e., in the abstract probing model) as Boolean masking, yet at the cost of a slightly more expensive implementation. Hence, their theoretical interest and practical relevance remain unclear. On the other hand, the most secure IP masking schemes (in which ω is secret) lead to expensive implementations. We improve this state of the art by investigating the leakage resilience of IP masking with public ω coefficients in the bounded leakage model, which depicts well implementation contexts where the physical noise is negligible. Furthermore, we do that without assuming independent leakage from the shares, which may be challenging to enforce in practice. In this model, we show that if m bits are leaked from the d shares y of the encoding over an n -bit field, then, with probability at least 1 - 2^-λ over the choice of ω , the scheme is 𝒪( √(2^-(d-1)· n+ m+ 2λ)) -leakage resilient. We additionally show that in large Mersenne-prime fields, a wise choice of the public coefficients ω can yield leakage resilience up to 𝒪( n· 2^-d· n+ n+ d) , in the case where one physical bit from each share is revealed to the adversary. The exponential rate of the leakage resilience we put forward significantly improves upon previous bounds in additive masking, where the past literature exhibited a constant exponential rate only. We additionally discuss the applications of our results, and the new research challenges they raise.
Deployments of cryptographic protocols with thousands of participants are becoming more and more common. In these large-scale, permissionless settings, communication complexity is often a limiting factor. In practice, two tools are commonly used to address this challenge: committee sampling and gossip networks. Committee sampling reduces complexity by restricting most of the communication to a small, randomly sampled committee of participants. Gossip protocols replace a fully connected communication network (which is impractical on an Internet scale) with a sparse communication graph. Existing committee-sampling protocols either require a setup assumption (which is problematic in a fully decentralized setting) or have high communication complexity themselves. In this work, we construct a communication-efficient setup-free protocol for committee sampling. Our starting point is the protocol of Andrychowicz and Dziembowski (CRYPTO’15), who showed how to construct a setup-free random beacon based on proofs-of-work (PoWs) in the random-oracle model (ROM). Our protocol works in a similar setting, and samples a committee in which parties are chosen proportionally to their resource expenditure. We improve upon their construction in two ways: (1) we construct a formal framework for general resource proofs (RPs), and use it to generalize from PoWs to a larger class of resources, and (2) for a subset of RPs (including PoWs), we construct a much more efficient committee-sampling protocol that requires subquadratic communication. Our protocol is designed in the ROM and makes use of VDFs, as well as gossip techniques in the spirit of Cohen, Loss, and Moran (FC’24).
AES has cemented its position as the primary symmetric-key primitive for a wide range of cryptographic applications, which motivates the analysis on the concrete security of AES in practical instantiations, for instance, the collision resistance of AES-based hashing, the key commitment security of AES-based authenticated encryption schemes, and the one-wayness of AES-based one-way functions in MPC/ZK protocols. In this work, we further advance the meet-in-the-middle (MITM) attack framework on AES-like constructions. We introduce single-color initial structure (SCIS), which leverages new structural insights to reduce the complexity of neutral word generation, a critical bottleneck in MITM attacks. As a result, we yield a series of improved results on AES over the state-of-the-art, including the first classical one-block collision attack on 7-round AES-MMO/MP, marking the first round advancement in over a decade and matching the best attack round in the quantum setting, as well as the first one-block collision attack on 4-round AES-128-DM, bridging the gap highlighted by Taiyama et al. at Asiacrypt 2024 from a non-differential-based approach. Additionally, we provide a comprehensive list of new results on the security margins of AES-192, AES-256, Rijndael-192, and Rijndael-256 in multiple attack settings.
A common issue with using secure computation in practice is that its security does not place any restrictions on what an adversary can use as input in the protocol. In this work, we focus on the practically-motivated setting of (two-message, labeled) private set intersection (PSI), and advocate for a clean and versatile solution to this problem: PSI on authenticated inputs. Our central contributions are summarized as follows. We also explore various optimizations to our basic protocol, including reducing the receiver’s concrete run time, and a tradeoff between crs size and message size.
Following Mumford’s theory, theta structures on products of elliptic curves are induced by symmetries whose eigenvectors correspond to 4-torsion points on the Kummer line. These symmetries introduce a rich pattern of self-similarities within the theta structure that we exploit to enhance the computation of gluing isogenies. Focusing on the dimension-2 case, we show how theta structures can be computed projectively, thereby avoiding costly modular inversions. Moreover, by leveraging the sparsity of certain specific 4-torsion points and the action of the canonical 2-torsion points in the Kummer line, we derive new formulae for the evaluation of (2, 2)-gluing isogenies. These formulae require significantly fewer precomputations and arithmetic operations than previous methods. Additionally, our formulae also support the evaluation of points on the quadratic twist at negligible additional cost, without requiring operations in an extended field.
We introduce the notion of non-interactive zero-knowledge (NIZK) arguments with certified deletion, a new primitive that enables the recipient of a (quantum) NIZK argument to delete it and obtain a (classical) certificate proving such deletion. We formalize this notion and propose two candidate constructions from standard cryptographic assumptions. Our first construction is based on classical NIZK arguments and quantum-hard one-way functions, but requires both the prover and verifier to run quantum algorithms. We then present an extension based on the learning with errors problem that allows the prover to be classical. Our results have applications to signatures of knowledge and anonymous credentials with certified deletion, which we also define and construct.
As a theoretical cornerstone of post-quantum cryptography, the Learning With Errors (LWE) problem serves as the security foundation for standardized algorithms such as Kyber and Dilithium. Recently, a framework for provable dual attacks on LWE has been proposed by Pouly et al. in Eurocrypt 2024, addressing the limitations in effectiveness caused by existing methods’ reliance on heuristic assumptions in LWE dual attacks. Their paper also poses an open problem on how to formally integrate modulus switching into this framework to reduce attack costs. The main purpose of this paper is to give a solution of this open problem by presenting an improved provable dual attack method that incorporates modulus switching and Chinese Remainder Theorem (CRT) techniques. First, we design a modulus switching mechanism that eliminates practical errors via the Poisson summation formula. By embedding the inherent noise from modulus switching into a rational lattice framework, our approach effectively preventing the risk of attack failure caused by the merging of such errors with LWE noise. Theoretical guarantees (Theorems 4 and 5) rigorously quantify the parameter ranges for successful attacks. Second, we introduce a CRT-based secret recovery method that aggregates partial secrets from independent sub-attacks. By leveraging the Chinese Remainder Theorem to reconstruct full secrets from congruence relations, our method adapts to arbitrary secret distributions. Furthermore, by using a tighter variant of Banaszczyk’s measure inequality, we obtain a precise parameter range for the dual attack’s efficacy through rigorous mathematical proof, and achieve the same complementary gap with the contradictory regime (proposed by Ducas et al.) as in Pouly et al.’s work. Experiments show 15-29 bit superior performance in attack estimation compared to the original framework.
We describe an algorithm to efficiently evaluate class group actions on supersingular elliptic curves that are oriented by an imaginary quadratic order of arbitrarily large discriminant. Contrary to CSIDH, this allows to increase the post-quantum security of the group action without increasing the size of the base field. In particular, we describe instances where Kuperberg’s algorithm loses to generic supersingular isogeny path finding. Our algorithm is fully deterministic, strictly constant time, dummy free, and can be implemented without conditional branches. We show that the (restricted effective) group action can be employed in a non-interactive key exchange protocol, that we argue is asymptotically more efficient than CSIDH.
Non-interactive blind signatures (NIBS), introduced by Hanzlik (Eurocrypt’23), enable the issuance of blind signatures on random messages without requiring interaction and have found applications in a variety of privacy-preserving protocols. Despite recent progress, all known constructions of NIBS rely on the random oracle model and/or the common reference string model, or on complexity-leveraging techniques. As a result, constructing such schemes in the plain model under standard assumptions remains an open problem. In this work, we present new results showing that it is hard to construct NIBS in the plain model from standard assumptions, as long as the adversary is used in a black-box manner. Specifically, we first focus on black-box reductions for basing the security of statistically blind NIBS on any non-interactive assumption. We then extend this limitation to the computationally blind setting under conditions inspired by the known impossibility results for standard blind signatures, introduced by Fischlin and Schröder (Eurocrypt’10). As an independent contribution, we study the relationship between two strong notions of blindness—strong recipient blindness and strong nonce blindness—recently introduced by Baldimtsi et al. (Asiacrypt ’24). We show the separation result by constructing schemes that satisfy strong recipient blindness but not strong nonce blindness, and vice versa. Our results suggest that both notions are independently necessary for the provable security of NIBS schemes.
In this paper, we revisit the security of randomized hash sign. More precisely, we present an improved security analysis for the underlying hash function property multi-target extended target collision resistance ( 𝗆-𝖾𝖳𝖢𝖱 ) in the quantum random oracle model (QROM). While prior work relied on reprogramming techniques to handle adversarial challenge queries, we leverage the hybrid compressed oracle framework of Hamoudi, Liu, and Sinha [19] to formulate an adaptive search problem. To do so, we had to extend their framework to cover partially randomized classical adversary queries. We conjecture that this extension will also allow to analyze further hash function properties that allow adversaries to define challenges via a classical oracle. By applying the extended framework to 𝗆-𝖾𝖳𝖢𝖱 , we give an improved upper bound on the adversary’s success probability. Our results show that the required key size for 𝗆-𝖾𝖳𝖢𝖱 can be reduced by more than half (from 192 to 72 bits), and we prove the tightness of our bound in the number of queries via matching attacks. To illustrate practical impact, we optimize parameters for Falcon in the hash sign paradigm, enabling more efficient instantiations with reduced salt sizes resulting in smaller signature lengths. For the example of multiple signatures aggregation, we achieve a signature size improvement of 30 kB for typical parameters.
