This paper presents algorithms to compute the reciprocal of an integer g modulo an odd integer f. This paper also presents software speeds for f=2^255-19 as a case study. As in some previous work, the software timings are independent of g when 0
Zero-knowledge simulators, initially developed for proving the security of proof systems, turned out to be also useful in constructing advanced protocols from simple three-move interactive proofs. However, in the context of multi-round public-coin protocols, the interfaces of these auxiliary algorithms become more complex, introducing a range of technical challenges that hinder the generalization of these constructions. We introduce a framework to enhance the usability of zero-knowledge simulators in multi-round argument systems for protocol designs. Our main conceptual contribution is critical-round zero-knowledge, which refers to the ability to perform complete zero-knowledge simulations by knowing the challenge of just one specific round in advance. We show that this notion is satisfied by diverse protocols based on MPC-in-the-Head, interactive oracle proofs, and split-and-fold arguments. We demonstrate the usefulness of the critical round zero-knowledge notion by constructing proofs of partial knowledge (Cramer, Damgård, and Schoenmakers, CRYPTO’94) and trapdoor commitments (Damgård, CRYPTO’89) from critical-round multi-round proofs.
Succinct non-interactive arguments of knowledge (SNARK) is a powerful cryptographic primitive with diverse real-world applications. The rank-one constraint system (R1CS), an intermediate representation of SNARK, has been widely used for proving arithmetic circuits. Distributed SNARKs allow multiple provers to jointly generate proofs for improving prover efficiency. However, existing distributed SNARKs for R1CS, i.e., DIZK (USENIX Sec. ’18) and Hekaton (CCS ’24), fail to simultaneously achieve constant proof size and scalable prover efficiency. In this paper, we propose , a distributed SNARK for R1CS with constant proof size, amortized communication and verification. For a size-O(n) R1CS, its prover complexity is O(n/ℓ·log (n/ℓ )) given ℓ sub-provers. Experiments show that the concrete prover time of is ∼ℓ× as fast as the non-distributed R1CS-targeted Marlin (Eurocrypt ’20) given ℓ sub-provers. Compared with Hekaton, features a 100× smaller communication overhead, and has a 7× faster prover time when proving general circuits. For R1CS-friendly zkRollups, outperforms the state-of-the-art Plonk-targeted Pianist (S P ’24) with a 2.5× smaller memory cost, a 2.8× faster preprocessing, and a 1.8× faster prover. To build , we design a distributed polynomial oracle proof (PIOP) for R1CS. Its core techniques include an improved (and distributed) inner product PIOP, and a distributed preprocessing PIOP via lookup tables. To instantiate the PIOPs, we build a (distributed) batch scheme for bivariate KZG, which enables opening multiple points on multiple polynomials with a proof size irrelevant to polynomial size or point number.
Modern SNARK constructions, almost ubiquitously, rely on a polynomial commitment scheme (PCS)—a method by which a prover can commit to a large polynomial P and later provide evaluation proofs of the form “ P(x)=y ” to the verifier. In the context of zkVMs (i.e., proof-systems for general-purpose RAM computations), the common design is to represent the computation trace as a sequence of tables, one per CPU instruction, and commit to the these tables, or even their individual columns, as separate polynomials. Committing separately to these polynomials has a large overhead in verification costs, especially in hash-based systems. In this work we drastically reduce this cost via a new construction which we call the jagged PCS. This PCS enables the prover to commit to the entire computation trace as a single polynomial, but then allows for the verifier to emulate access to the individual table or column polynomials, so that the arithmetization can proceed in the usual manner. The jagged PCS may be thought of as a sparse PCS for a very particular form of sparsity – namely, a “jagged” matrix in which each column has a different height. Our construction of the jagged PCS is highly performant in practice. In contrast to existing sparse PCS constructions for general sparse polynomials, the jagged PCS does not require the prover to commit to any additional oracles and the prover cost is dominated by 5 finite field multiplications per element in the trace. Furthermore, we implement the verifier as a purely arithmetic circuit that depends only on the total trace area—thereby significantly reducing the problem of “combinatorial explosion” often encountered in zkVM recursion.
In this work, we introduce dynamic zk-SNARKs. A dynamic zk-SNARK extends a standard zk-SNARK with an additional update algorithm. This algorithm takes as input a valid source statement-witness pair (𝕩,𝕨)∈ℛ together with a verifying proof π , and a valid target statement-witness pair (𝕩',𝕨')∈ℛ . It outputs a verifying proof π ' for (𝕩',𝕨') in sublinear time (when (𝕩,𝕨) and (𝕩',𝕨') have small Hamming distance), potentially with the help of a data structure. To the best of our knowledge, no commonly used zk-SNARKs are dynamic: even a single update to (𝕩,𝕨) currently requires recomputing the proof from scratch, which takes at least linear time. After formally defining dynamic zk-SNARKs, we present two constructions: one with O(√(nlog n)) update time and O(1) proof size (Dynaverse), and another with O(log ^3 n) update time and O(log ^3 n) proof size (Dynalog). Both Dynaverse and Dynalog rest on Dynamo, a new zk-SNARK for permutation relations that we introduce. Crucially, Dynamo is sparse, meaning its prover complexity depends only on the number of non-zero entries in the input vector. Our constructions can also be made universal in the random oracle model. We highlight two central applications of dynamic zk-SNARKs. First, we show that they naturally give rise to sparse zk-SNARKs—SNARKs whose prover complexity can be sublinear when the witness vector contains many zeros. In addition, by slightly modifying Dynaverse (rather than using it as a black box), we construct Aero, which to the best of our knowledge is the first sparse zk-SNARK with O(klog ^2 k) prover complexity, where k is the Hamming weight of the witness. Second, we develop a compiler from any dynamic zk-SNARK to recursion-free and bounded incremental verifiable computation (BIVC). Interestingly, when instantiated with a dynamic zk-SNARK that uses a sublinear-size data structure (which we build and call Dynavold), this transformation yields the first BIVC scheme with sublinear state. We finally discuss further applications of dynamic zk-SNARKs, including dynamic state proofs and dynamic ML proofs for retraining.
Cryptocurrencies enable transactions among mutually distrustful users. While UTXO-based cryptocurrencies offer mature solutions achieving strong privacy and supporting multi-receiver transfers, account-based cryptocurrencies currently lack practical solutions that simultaneously guarantee these properties. To close this gap, we propose a generic framework for account-based cryptocurrencies that attains strong privacy and supports multi-receiver transfers, and then give a practical instantiation called Anonymous PGC. Our system also outperforms in efficiency: for a 64-sized anonymity set and 8 receivers, Anonymous PGC achieves 2.4 × faster transaction generation, 5.7 × faster verification, and 2.2 × reduction in transaction size compared to state-of-the-art Anonymous Zether (IEEE S P 2021), which offers only weak privacy and no multi-receiver support. At the core of Anonymous PGC are two novel zero-knowledge proofs of partial knowledge. First, we generalize the Groth-Kohlweiss (GK) 1-out-of-n proof (EUROCRYPT 2015) to the k-out-of-n case, resolving an open problem regarding its generalization. Particularly, the obtained proof lends itself to seamlessly solder with range proofs, yielding an efficient k-out-of-n range proof that demonstrates k witnesses among n instances lie in specific ranges. Second, we extend the Attema-Cramer-Fehr (ACF) k-out-of-n proof (CRYPTO 2021) to support distinct group homomorphisms, boosting its expressiveness while slashing both prover and verifier complexities from quadratic to linear. We believe these proofs are of independent interest in broader privacy-preserving applications.
Enhanced Privacy Identification (EPID) is one of the anonymous authentication mechanisms that found their way into the industry, being deployed in billions of chips and standardized at ISO. The linchpin of EPID lies in its decentralized revocation procedure that allows to revoke a signer by simply placing one of its signatures on a signature revocation list SRL. Each new signature must then include a proof that it has been generated with a key different from those used to produce the signatures on the SRL. This proof of non-revocation in current post-quantum schemes either relies on general-purpose NIZKs or on regular zero-knowledge proofs (ZKP) but with a witness dimension linear in the size of the SRL, which leads to large size and/or computational complexity. In this paper, we rethink the standard approach of non-revocation so as to avoid its heavy reliance on ZKP. Our construction indeed combines features from different tools (such as Falcon signatures) that are unusual in this context to pull most elements out of the ZKP, leading to significant performance improvements. Providing all these elements unconcealed creates many security challenges for our construction but we yet manage to address all of them and prove security under well-understood lattice assumptions, and in the strong model of Sanders-Traoré (CT-RSA’21) allowing malicious SRLs.
Sigma protocols are fundamental cryptographic tools, serving as the foundation of many practical schemes—most notably, the Schnorr identification and signature schemes. To prove the security of Sigma protocols, one typically reduces breaking a Sigma protocol to solving a presumed hard problem (e.g., computing the discrete logarithm in a certain group). In many settings, however, these reductions are not tight: given an adversary that breaks a Sigma protocol with probability ε , the reduction only yields an adversary for the underlying problem with probability ε ^2 . This quadratic loss affects efficiency, as it forces choosing larger security parameters to reach a target security level. In this work, we show that this quadratic loss is inherent for two natural classes of reductions. For interactive protocols, we prove it for uniform-challenge, black-box reductions, which query the adversary using uniformly sampled challenges. For non-interactive protocols (i.e., in the random-oracle model), we prove it for weakly programmable, black-box reductions, which answer the adversary’s oracle queries with uniformly sampled outputs. Applying our bounds to the reductions from Schnorr identification and signatures to discrete logarithm yields lower bounds that match known positive results—namely, the classical worst-case reduction of Pointcheval and Stern (Journal of Cryptology, 2000) and the higher-moment reduction of Rotem and Segev (Journal of Cryptology, 2024). Our approach reduces the analysis of such reductions to the values of simple hitting games—combinatorial games that we introduce. Bounding these games is our main technical contribution, and we believe these bounds can enable more modular proofs of related results.
Oblivious RAM (ORAM) is a cryptographic primitive that enables a trusted client to hide its memory access patterns from an untrusted memory. In this work, we explore the notion of resizability—a dimension that has been underexplored in ORAM literature. Resizability refers to a trusted client’s ability to dynamically expand or shrink the untrusted memory based on the number of elements it contains. This feature is crucial for high-level cryptographic primitives, particularly those related to outsourced storage, such as structured encryption and searchable symmetric encryption, where storage frequently fluctuates over time. The most common resizing approach in ORAM, often referenced in folklore, involves reinitializing the ORAM with a new capacity. While straightforward, this method has several limitations, including a superlinear resize cost, as the client must transfer all content from one ORAM instance to another. In this work, we first formalize the notion of resizable oblivious RAM. We model the reinitialization-based approach using a black-box construction, , which transforms any ORAM into a resizable one. We then introduce our two primary constructions, and , which build upon the non-recursive and recursive variants of Path ORAM, respectively. Both maintain the same asymptotic performance as their non-resizable counterparts while achieving O(logN) and O(log ^2N) resize communication complexity, where N represents the RAM size. These improvements significantly reduce the superlinear costs associated with folklore approaches in the vein of .
Verifiable Delay Functions (VDFs) and Time-Lock Puzzles (TLPs) are central to timed cryptography and have many applications to randomness beacons, fair multiparty computation, proofs of replication, and resource-efficient blockchains – to mention just a few. Constructions of VDFs and TLPs follow two general approaches. The first is direct constructions from suitable sequentiality assumptions (e.g., repeated squarings in hidden-order groups and the existence of non-parallelizing languages) and possibly additional cryptographic assumptions. The second approach is generic constructions of VDFs and TLPs from each other, possibly relying on additional non-sequential assumptions. While there is an impressive body of results following the first approach, the second is far less successful. In particular, we are only aware of the results of (a) Abusalah et al. [PKC’26], who construct one-time VDFs (restricted VDFs that don’t provide preprocessing security) from TLPs and indistinguishability obfuscation, and (b) Renawi [bachelor thesis 2020], who constructs TLPs from VDFs and (extractable) witness encryption. In this paper, we study fully-black-box (FBB) constructions of VDFs and TLPs from each other and prove the impossibility of such constructions. In particular, we prove the impossibility of (a) oracle-aided VDFs from oracle-aided TLPs, and (b) oracle-aided TLPs from oracle-aided VDFs. Besides their theoretic relevance, our results partially explain the lack of success of constructing VDFs and TLPs from each other in a black-box way and leave open the possibility of non-black-box constructions and constructions that rely on additional assumptions.
Steganography studies methods to not only protect the confidentiality of messages but also to conceal the very act of message transmission. Prior provably secure stegosystems are predominantly constructed based on a rejection sampling technique which achieves an encoding rate inversely proportional to the min-entropy of the cover channel. Furthermore, while replayable chosen-covertext attack (RCCA) secure stegosystems for general channels can be constructed based on standard cryptographic assumptions, it is known [Berndt and Liśkiewicz, EUROCRYPT’18] that achieving (standard) CCA-security for channels with memory in the so-called non-look-ahead model is in general impossible and the only known CCA-secure construction crucially relies on the channels being memoryless. In this work, we show that the impossibility on CCA-secure stegosystems can be circumvented, in the random oracle model, by dropping the non-look-ahead restriction and by restricting to a natural class of channels which we call “partially sampleable channels”. These capture channels which partly consist of explicitly sampleable distributions, such as Gaussian sensor noise of digital photographs. To achieve a high encoding rate, we extend the formalisation of stegosystems to capture a technique known as “cover-source switching” in the practical steganography literature. This allows us to construct CCA-secure stegosystems for Gaussian channels using Gaussian preimage sampling techniques borrowed from lattice-based cryptography, which can theoretically achieve an embedding rate of 1/ω (loglogλ ) regardless of the min-entropy of the channel. Our prototype implementation suggests that our scheme is practical, achieving an embedding rate of 24.7
An oblivious pseudorandom function (OPRF) is an interactive protocol between a client and server, where the client aims to evaluate a keyed pseudorandom function for a key held by the server, without revealing its input. OPRFs are a versatile tool for enhancing privacy, inciting extensive research and standardization efforts in this area. The round-efficient 2Hash-Diffie-Hellman OPRF is widely deployed, but unfortunately, it is prone to quantum attacks. The search for post-quantum alternatives started in 2019 and is currently more disputed, with several candidates on the table. Given the lack of test of time of post-quantum OPRFs and their underlying cryptographic assumptions, hybridization can help mitigate risks in this interim period. Most preferably, we want to combine existing classical deployments like 2HashDH with post-quantum candidates. However, analogous two-party settings like oblivious transfer, where both parties have security requirements, indicate that combining OPRFs might be trickier than it is for hashing or encryption. In this paper, we give combiners for OPRFs with minimal overhead over the combined schemes. We also formally prove that “ideal” combiners, i.e., ones that do not make additional assumptions on how an underlying OPRF may break, cannot exist. Our constructions avoid this theoretical result by assuming the underlying OPRFs to satisfy certain statistical guarantees. Crucially, these extra conditions are satisfied by both the 2Hash-Diffie-Hellman OPRF and the currently most efficient post-quantum candidates, rendering our results suitable for upgrading existing deployments with quantum-safe guarantees already today.
A group signature scheme enables users of a group to anonymously sign messages on behalf of the group, while a designated authority can revoke anonymity when needed to ensure user accountability. In this paper, we build a post-quantum fully dynamic group signature scheme from only symmetric encryption and hash functions. Our protocol, DGSP, achieves the following: (i) the set-up time is effectively constant in the number of signatures that may be issued, with support for up to 2^64 signatures; (ii) the tracing algorithm run by the authority has constant runtime in the number of users; (iii) the set of users is fully dynamic and users can be revoked or added as needed without system-wide updates; and (iv) forward anonymity, where if a user’s secrets are compromised they cannot be used to de-anonymize previous signatures. DGSP is the first group signature based only on symmetric primitives to achieve all of these properties: the previous state-of-the-art in this area is SPHINX-in-the-Head (SITH), which does not achieve (ii) or (iv), and DGMT, which does not achieve (i) and may not achieve (iv). Like DGMT, but unlike SITH, DGSP is stateful and users must refresh a local storage of “certificates” to issue new signatures. We provide a full Rust implementation, showing that our signatures are roughly 5× larger than DGMT but nearly 100× smaller than SITH, and all basic operations run in under 2 milliseconds. We prove security in the standard model based on typical assumptions for symmetric primitives. DGSP is a compelling solution for applications requiring large-scale user support, efficient operations, and conservative post-quantum security.
End-to-end encryption allows data to be outsourced and stored on an untrusted server, such as in the cloud, without compromising data privacy. When this data is shared between a group of users, all members also share access to the key material used for data encryption. In existing solutions, this key material is static and not rotated when group membership changes. Thus, also removed members can decrypt shared data, precluding post-compromise security and cryptographic access control. We propose to move away from static keys and instead use a group key progression (GKP) scheme, a novel primitive that enables a dynamic group of users to agree on a persistent sequence of keys while keeping a compact local state. GKP ensures that group members can only derive keys within a certain interval of the sequence, a notion that we call interval access control (IAC), and also provides post-compromise security. Our GKP construction, called Grappa, combines continuous group key agreement (Alwen et al., 2020) with a new abstraction called an interval scheme. The latter is a symmetric-key primitive that can derive a sequence of keys from a compact state while preserving IAC. We explore different interval scheme constructions and simulate their storage and communication costs when used in group settings. The most efficient instantiation is a generalization of dual key regression (Shafagh et al., 2020), which we formalize and prove secure. Overall, our protocols offer a practical and robust solution to protect shared, persistent data.
Coin flipping in the presence of a dishonest majority is a fundamental cryptographic primitive whose requirements lack a clean characterization. Recent work (Bonneau et al., Eurocrypt 2025) showed a lower bound that fair dishonest-majority coin-flipping implies delay functions. However, until now known upper bounds exhibited a significant gap: All existing protocols rely on assumptions that we do not know how to instantiate in the plain model. In this work, we close this gap. Specifically, we show that fair n -party coin flipping in the presence of up to n-1 malicious corruptions follows from the minimal assumption of delay functions. This completes the equivalence between delay functions and fair dishonest-majority coin-flipping protocols.
The Shortest Vector problem (SVP) is one of the most important problem in lattice-based cryptanalysis. There is currently a gap in the understanding of this problem with respect to its worst-case complexity and its average-case behaviour. For instance, SVP has worst-case complexity 2^n+o(n) on an n-dimensional lattice [2]. However, in practice, people rely on heuristic (unproven) sieving algorithms of time complexity 2^0.292n+o(n) [10] to assess the security of lattice-based cryptography schemes. Those heuristic algorithms are experimentally verified for lattices used in cryptography, which are usually random in some way (There exists several formal notions of random lattices). In this paper, we try to bridge the gap between worst-case and heuristic algorithms. Using the formalism of random real lattices developed by Siegel [45], we show a tighter upper bound on an important lattice parameter called the smoothing parameter that applies to almost all random lattices. Using a known discrete Gaussian sampler at the smoothing parameter, we can then directly sample short vectors. This allows us to provably solve an approximation version of the SVP on almost all random lattices with a small constant approximation factor 1.123, in time 2^n/2+o(n) . With further analysis, we can also provably solve the exact SVP in time 2^0.63269n+o(n) on most random lattices. We also provide a smooth time/approximation factor tradeoff between these two cases. All our algorithms work in space 2^n/2+o(n) .
We present an exponential-time key recovery attack on the public-key encryption scheme using matrix codes proposed by Aragon et al. [1] at Asiacrypt 2024. The secret key is a Gabidulin code expanded using an 𝔽_q -basis of 𝔽_q^m to obtain a matrix code, which is then hidden by appending random rows and columns and by left- and right-multiplication with invertible matrices. Our attack does not rely on the Gabidulin structure and hence applies to most 𝔽_q^m -linear codes hidden by their transform. Its complexity is better than the previously best-known distinguisher and significantly better than the naive key recovery algorithm. Our attack breaks some of their proposed parameters. For example, a parameter set targeting 192-bit security is reduced to about 161 bits, and a 256-bit set to about 223 bits.
The Unbalanced Oil and Vinegar (UOV) construction has been a central framework in multivariate cryptography since its appearance in 1999. In fact, four schemes in the second round of NISTs additional call for signatures are UOV-based. For efficiency considerations, most of these schemes are defined over a field of characteristic 2. This has as a side effect that the polar forms of the UOV public maps are not only symmetric, but also alternating. In this work, we propose a new key-recovery attack on UOV over fields of characteristic 2 that exploits this alternating property. We interpret the polar forms of the UOV public map as elements of the exterior algebra. Moreover, we show that these forms exhibit a structure that is dependent on the secret oil space. Using the Plucker embedding, we also express the dual of the secret oil space as an element of the exterior algebra. Utilizing the structure of the public maps, we can formulate relations on this secret element in this algebra. Finally, we demonstrate that the secret oil space can be recovered using sparse linear algebra techniques. This new attack has a lower time complexity than previous methods and reduces the security of uov-Ip, uov-III, and uov-V, by 4, 11, and 20 bits respectively. In addition, the attack is applicable to MAYO(2) and reduces its security by 28 bits.
This paper reports details of our record-breaking computations on lattice problems, including the Shortest Vector Problem (SVP), Learning With Errors (LWE), and NTRU challenges. The results were obtained using successive bucket sieving (Becker–Gama–Joux 2015) implemented on a GPU-enabled, heterogeneous memory architecture. Our method achieves lower computational complexity and reduced memory demands compared to all existing work, while scaling to massive parallelism. In particular, we are able to place the hundred-terabyte sieving data on disk without disk I/O becoming a bottleneck. And our work points out a clear path to solve SVP 260 with reasonable cost in a reasonable time frame (1 year). We also compare the practical quality of BGJ and BDGL (Becker–Ducas–Gama–Laarhoven 2016) bucketing, and evaluate the effect of quantization on lattice sieving. It turns out that even in a pure algorithmic setting, the advantage of BDGL over BGJ is minor and grows tamely with the sieving rank. This work suggests that lattice attacks remain rapidly advancing, and that large-scale sieving may be less memory-bound than commonly assumed. Consequently, we recommend conservative parameter choices when migrating to lattice-based post-quantum cryptography.
