Threshold signatures split the secret key among n parties, where any subset of at least t parties can collaboratively produce a valid signature. They have been widely deployed in applications such as blockchain systems. Lattice-based threshold signatures have also attracted considerable attention due to their post-quantum security guarantees. However, existing lattice-based constructions still face significant efficiency challenges, particularly when the number of parties becomes large. Recent lattice-based threshold signatures such as TRaccoon (Eurocrypt’24) and Ringtail (S P’25) support large thresholds, but they either require three interaction rounds or incur heavy communication costs in the two-round setting, limiting their practicality. In this paper, we present , a novel two-round lattice-based threshold signature that overcomes these limitations via a new trapdoor semi-commitment technique. This variant of commitment relaxes the standard binding requirement to a weaker form, allowing an efficient instantiation from the NTRU assumption and enabling a compact two-round signing protocol with low communication. For t=1024 and 128-bit security, achieves significant improvements among existing lattice-based threshold signatures: its total communication per party and public key size are both minimal, at 26.9 KB and 2.0 KB, respectively. While the resulting signature size is larger (17.7 KB), it remains practical and highly competitive. is thus well-suited for real-world large-scale deployments where both round efficiency and communication load are critical.

As future telecom networks evolve toward the integration of sensing, communication, and computing, data-driven services are becoming increasingly prevalent. However, there are security concerns regarding Over-The-Top (OTT) servers accessing user data from the User Equipment (UE). Fully Homomorphic Encryption (FHE) allows data to be processed in ciphertext and is considered one of the necessary ways to guarantee secure privacy computing in telecom networks. Nevertheless, the inherent ciphertext expansion of FHE results in massive data volumes, imposing significant overhead on resource-constrained wireless air interfaces. To address the issue of enabling UE privacy computing in the future telecom network, this paper proposes an edge homomorphic transciphering framework. We deploy the transciphering function within edge computing nodes, such as the User Plane Function (UPF). UE only needs to transmit symmetrically encrypted data at low expansion rates, and the network edge computing node converts this into FHE ciphertext and forwards it to the OTT server. We validated the framework using multi-modal payloads. Our scheme reduces transmission overhead in air interface and enables the telecom network to apply FHE while mitigating the impact of ciphertext expansion. Furthermore, we tested the system by integrating two representative block ciphers, AES and HIGHT, verifying the framework’s flexibility for future telecom devices.

Ensuring the secure and proper deployment of Enclaves is critical for the security of Trusted Execution Environments (TEEs). Recently, the increasing attacks targeting Enclaves have made the traditional solution risky to use different enclaves for each task. An ideal solution is a pre-designed enclave that can be flexibly reused across different computational tasks. To address this issue, we propose FH-TEE, a novel framework that integrates Fully Homomorphic Encryption (FHE) with TEE. In this approach, computational tasks are partitioned so that only fixed, logic-independent operations are performed within the Enclave, enabling its reuse across various tasks. Flexibility in accommodating diverse computational requirements is achieved through FHE. Furthermore, because computationally intensive FHE operations, such as bootstrapping and ciphertext transformation, are logic-independent and offloaded to the Enclave, FH-TEE significantly improves efficiency compared to purely FHE-based solutions, while maintaining robust privacy and security. In our demo program, the server receives ciphertext from the client, performs ten iterations of the Game of Life computation, and then sends the resulting ciphertext back to the client. The results show that our scheme is 10.57× faster in computation speed and 32064× smaller in transmission size compared to a pure FHE scheme.

Recently, and have been proposed as new isogeny-based key exchange protocols to resist torsion point attacks. In this work, we propose two novel types of isogeny-based key exchange protocols based on and . Firstly, we propose ^ and ^ using different forms of primes in and . Secondly, we introduce a similar hardness assumption that reveals an image of torsion point of small order based on the assumption of . We show that this assumption is sufficient to build parallel isogenies and construct two key exchange protocols called ^ and ^ . Finally, we provide the corresponding parameters for the new protocol proposed at different security levels and develop a Sagemath implementation of these protocols. For example, compared to the original , when the security strength is 128 bits, ^ and ^ achieve speeds that are 2.2 × and 28.5 × faster in the key generation phase and 2.0 × and 19.1 × faster in the key exchange phase. The size of the public key is reduced by factors of 1.1 × and 2.7 × , respectively.

Double-base chain (DBC) has been extensively studied for speeding up scalar multiplication, which significantly impacts the execution efficiency of ECC. In this paper, we estimate the theoretically optimal upper bound and lower bound for the leading term of a canonic DBC. Firstly, we develop a new method to estimate the bounds and prove its correctness, based on Yu et al.’s work in EUROCRYPT 2020. Secondly, we obtain the new bounds by applying this new method. Thirdly, we compare the efficiency improvements of canonic DBC generation algorithms and scalar multiplication algorithms using the new theoretically optimal upper bound. Compared to NAF algorithm, our new scalar multiplication algorithm achieves about 13% efficiency gains. Finally, we analyze the bounds for the leading term proposed by Eom et al., identify their limitations and provide counterexamples to demonstrate the issues.

Resource-constrained devices in future telecom systems, including Narrowband IoT (NB-IoT) deployments and personal IoT networks (PINs), typically rely on lightweight symmetric encryption to satisfy strict communication and latency constraints, but ciphertexts produced by such ciphers do not support computation in the encrypted domain. Fully homomorphic encryption (FHE) enables computation over encrypted data, yet its computational and communication overhead makes it impractical to deploy at resource-constrained devices in communication-oriented edge–cloud systems, posing a fundamental challenge for deploying PPML in telecom environments. To bridge this gap, we propose a privacy-preserving generative-AI inference framework based on transciphering of lightweight symmetric ciphertexts. Specifically, the framework transforms symmetric ciphertexts into the homomorphic domain at the server by homomorphically evaluating the decryption circuit, enabling non-interactive inference with low uplink overhead. We evaluate the proposed framework through homomorphic evaluation of the lightweight cipher ASCON. Under a standard 128-bit security setting, our implementation achieves an end-to-end latency of 45.3s for homomorphic ASCON translation, providing a 2.9× improvement over an FHEW-like function-bootstrapping baseline under comparable parameters. These results indicate that lightweight-to-FHE ciphertext translation can be made practical for communication-oriented PPML pipelines.

Functional bootstrapping can evaluate a look up table (LUT) almost for free during refreshing ciphertexts, making fully homomorphic encryption (FHE) more efficient. But the original functional bootstrapping requires the LUT to be negacyclic, or the plaintext should be distributed in the first half torus. This limitation lies in the selection of the negacyclic cyclotomic ring in the blind rotation procedure, which greatly restricts the power of functional bootstrapping. Full domain functional bootstrapping (FDFB) is more attractive. While the plaintext can be distributed throughout the whole torus, it lends us an opportunity to use the natural homomorphism of Regev encryption to evaluate affine functions for free, while maintaining the efficiency of the LUT evaluation.In this paper, we analyze in depth the manifestation of blind rotation on the prime cyclotomic ring, and use this structure to turn the traditional functional bootstrapping into the full domain. Compared with existing full domain solutions, our approach achieves the lowest noise growth and the fewest polynomial multiplications, since the expensive blind rotation procedure only needs to be called once while other solutions require at least twice. Furthermore, our scheme presents good scalability, which can be extended to more functional variants, such as private FDFB, multi-value FDFB and high precision FDFB.

The Blum-Kalai-Wasserman (BKW) algorithm is a significant combinatorial algorithm used to tackle the Learning with Errors (LWE) and Learning with Rounding (LWR) problems. In 2015, Duc et al. (in: Oswald and Fischlin (eds) EUROCRYPT 2015, Springer, Berlin, 2015) proposed the first BKW algorithm applied directly to LWR, which consists of the reduction phase and the solving phase. In this paper, we propose an improved LWR-solving BKW algorithm. For the reduction phase, we design a novel coding method with relaxed collision conditions and introduce a post-processing stage and for the solving phase, we switch to a more efficient Fast Fourier Transform (FFT) distinguisher with pruning. Compared to previous LWR-solving BKW algorithms, our new BKW algorithm achieves a time complexity improvement of 4.0–48.5 bits for the instances considered. Additionally, by incorporating a novel heuristic method in the reduction phase, our algorithm further improves the sample complexity by 3.7–48.7 bits.

TFHE is a fully homomorphic encryption scheme over the torus that supports fast bootstrapping. Its primary evaluation mechanism is based on gate bootstrapping and programmable bootstrapping (PBS), which computes functions while simultaneously refreshing noise. PBS-based evaluation is user-friendly and efficient for small circuits; however, the number of bootstrapping operations increases exponentially with the circuit depth. To address the challenge of efficiently evaluating large-scale circuits, Chillotti et al. introduced a leveled homomorphic evaluation (LHE) mode at Asiacrypt 2017. This mode decouples circuit evaluation from bootstrapping, resulting in a speedup of hundreds of times over PBS-based methods. However, the remaining circuit bootstrapping (CBS) becomes a performance bottleneck, even though its frequency is linear with the circuit depth. In this paper, we refine the LHE mode by mitigating the high cost of CBS. First, we patch the NTT-based CBS algorithm proposed by Wang et al. [WWL+, Eurocrypt 2024], accelerating their algorithm by up to 2.6x. Then, observing the suboptimal parallelism and high complexity of modular reduction in NTT under CBS parameters, we extend WWL+ to an FFT-based algorithm by redesigning the pre-processing method and introducing a split FFT technique. This achieves the fastest CBS implementation with the smallest key size, outperforming the open-source WWL+ implementation by up to 12.1x (resp. 5.12x compared to our patched algorithm), and surpassing TFHEpp [MBM+, USENIX 2021] by 3.42x with a key size reduction of 33.2x. Furthermore, we proposed an improved integer input LHE mode by extending our CBS algorithm to support higher precision and combining it with additional optimizations such as multi-bit extraction. Compared to the previous integer input LHE mode proposed by Bergerat et al. [BBB+, JoC 2023], our approach is up to 10.7x faster with a key size reduction of up to 4.4x. To demonstrate the practicality of our improved LHE mode, we apply it to AES transciphering and general homomorphic look-up table (LUT) evaluation. For AES evaluation, our method is 4.8x faster and reduces the key size by 31.3x compared to the state-of-the-art method, Thunderbird [WLW+, TCHES 2024]. For LUT evaluation, we compare our results with the recent work of Trama et al. [TCBS, ePrint 2024/1201], which constructs a general 8-bit processor of TFHE. Our method not only achieves faster 8-to-8 LUT evaluation but also improves the efficiency of most heavy 8-bit bivariate instructions by up to 21x and the 16-bit sigmoid function by more than 26x.

The study of attack algorithms for the Learning with Errors (LWE) problem is crucial for the cryptanalysis of LWE-based cryptosystems. The BKW algorithm has gained significant attention as an important combinatorial attack for solving LWE. However, its exponential time and memory requirements severely limit its practical applications, even with medium-sized parameters. In this paper, we present a memory-efficient BKW algorithm for LWE, which extends Bogos’s work [Asiacrypt’16] on the Learning Parity with Noise (LPN) problem. While their work improved efficiency, it overlooked the high memory demands of the BKW algorithm. We address this with two key improvements. First, we propose an efficient reduction technique for low-memory regimes, c -sum-PCS-reduce, which combines the c -sum technique with Parallel Collision Search (PCS) to achieve a better time-memory trade-off. Second, we present an improved memory-optimized finite automaton for our optimized BKW algorithm by incorporating several efficient memory-saving reduction techniques and pruning potential high-memory paths. Our algorithm, using graphs as a meta tool, can automatically identify the optimal reduction path within the graph, aiming to reduce both time and memory complexities. Compared to the state-of-the-art coded-BKW in the lattice-estimator, our algorithm achieves time complexity improvements ranging from 2^3.3 to 2^26.2 . Furthermore, memory complexity is improved, with reductions ranging from 2^9.7 to 2^71.3 .

At EUROCRYPT2012, Banerjee, Peikert, and Rosen introduced Ring Learning With Rounding (RLWR) problem and constructed lattice-based pseudorandom functions for the first time. Subsequently, Banerjee, Brenner, Leurent, Peikert, and Rosen named this family of lattice-based pseudorandom functions as SPRING, reanalyzed the security, and gave two practical instances. Building upon the SPRING family, Bouillaguet, Delaplace, Fouque, and Kirchner further extended it to a pseudorandom number generator called SPRING-RS. It is quite fast but still has a certain gap compared with the classical pseudorandom number generator based on symmetric cryptography, and the key size is large. In this work, we present LEAP, a lattice-based pseudorandom number generation scheme characterized by high performance, adaptable parameter selection, and extensive support for parallel processing. Unlike the RLWR problem used in public key cryptography, LEAP treats the public parameter in the RLWR problem as the key as well. Hiding the public parameters leads to larger lattice dimensions and higher standard deviations of error in the concrete security analysis compared to RLWR under identical parameters. These adjustments imply enhanced security, allowing smaller parameters while maintaining the same security level, thereby improving performance. Additionally, we introduce a novel framework that reuses multiple parameters, significantly enhancing overall performance. To mitigate the issue of increased key size caused by treating the public parameter as the key, we design a pseudorandom number generator leveraging the small key size characteristic of a variant of the NTRU assumption, which provides the key required for the high-performance pseudorandom number generator. Compared with the SPRING-RS, the LEAP can reduce the key size by 1.71X while improving performance by 3.30X at the same security level. Under the AV%2 and AV%512 implementations, the performance reaches 1.61 Cycles/byte and 1.14 Cycles/byte, and the throughput reaches 16.12 Gbps and 22.60 Gbps, respectively.

In the NIST standardization competition, LAC and Saber served as frontrunners due to their small parameter sizes. However, this emphasis on minimalism introduced a trade-off: the modulus chosen was incompatible with the Number Theoretic Transform (NTT), thereby substantially reducing computational efficiency. In this work, we present a novel compact lifting technique, inspired by the work of Chung et al. (TCHES 2021) and Basso et al. (ePrint 2021), which demonstrates the potential to revitalize these algorithms. Our approach transitions the polynomial computation to an NTT-friendly ring with a compact modulus, and minimizes the number of NTT operations, thereby enhancing overall efficiency. Notably, we accelerate the polynomial multiplication in LAC by 7 × , propelling its Public Key Encryption (PKE) efficiency to exceed that of Kyber. Our compact lifting can also be applied to Saber, achieving a speed-up of up to 35% for a polynomial multiplication. Our method demonstrates that through strategic modifications, it is possible to retain the size advantage of LAC-like cryptosystems while enhancing their efficiency to outperform Kyber, thereby restoring their competitive edge in the PQC standardization.

In this paper, we propose two more efficient implementations for the FHEW scheme. First, for the gate bootstrapping case, we employ approximate gadget decomposition and refined Number Theoretic Transform (NTT) with AVX-512 instructions to improve the efficiency of blind rotation. Compared to the state-of-the-art implementation that uses FFT-based polynomial multiplication, our technique takes 4.7 ms, which is approximately 1.9 × faster than TFHEpp and 1.4 × faster than TFHE-rs. Furthermore, for the circuit bootstrapping case, we introduce the Residue Number System (RNS) to decompose the larger modulus. Experimental results demonstrate that the RNS decomposition is more efficient than the original numerical decomposition. Our optimized method is more applicable in scenarios involving prime moduli, such as homomorphic trace and automorphism.

Hybrid homomorphic encryption (a.k.a., transciphering) can alleviate the ciphertext size expansion inherent to fully homomorphic encryption by integrating a specific symmetric encryption scheme, which requires selected symmetric encryption scheme that can be efficiently evaluated homomorphically. While there has been a recent surge in the development of FHE-friendly ciphers, concerns have arisen regarding their security. A significant challenge for the transciphering community remains the efficient evaluation of symmetric encryption algorithms that have undergone extensive study and standardization. In this paper, we present an evaluation framework, dubbed Thunderbird, which for the first time presents efficient homomorphic implementations of stream ciphers SNOW 3G and ZUC that are standardized in the 3G Partnership Project (3GPP). Specifically, Thunderbird combines gate bootstrapping mode and leveled evaluation mode of TFHE to cater to various function types within symmetric encryption algorithms. In the gate bootstrapping mode, we propose a variant of the homomorphic full adder that consumes only a single blind rotation, which may be of independent interest. In the leveled evaluation mode, we employ the CMux gate combining with hybrid packing technique to efficiently achieve lookup tables, significantly reducing the need for gate bootstrapping, and adapt the current optimal circuit bootstrapping to expedite the Thunderbird framework. We have implemented the Thunderbird framework in the TFHEpp public library. Experimental results demonstrate that SNOW 3G and ZUC can homomorphically generate a keyword in only 7 seconds and 9.5 seconds, which are 52x and 32x faster than the trivial gate bootstrapping mode, respectively. For the homomorphic evaluation of the AES-128 algorithm using Thunderbird, we achieve a speedup of 1.9x in terms of latency and use less evaluation key compared to the state-of-the-art work.

We present eBiBa (enhanced BiBa), a hash-based signature scheme with the smallest possible signature size, while ensuring high feasibility and security in a specific application model. Our scheme is tailored to address the communication requirement of a large-scale public data stream continuously disseminated between two participants while ensuring data source and data integrity authentication. To achieve these goals, firstly, we optimized the classical hash tree mode into a hybrid mode to efficiently perform public key authentication and eliminate the need for an authenticated channel to transmit large amounts of data, unlike the initial BiBa-based broadcast authentication protocol. Secondly, we employed a specific tweakable hash chain function to digest a batch of messages, reducing the required conditions for post-quantum existential unforgeability under adaptive chosen message attack (EUCMA) of eBiBa to a second-pre-image-resistance-like property instead of collision resistance. This results in reduced pre-computation in both key and signature generations. Thirdly, we utilized a forward-secure pseudorandom function to achieve forward-secure of the proposed scheme. Finally, we minimize the signature size through a series of procedures. Firstly, we select BiBa few-time signature as the underlying signature scheme since it is currently the few-time hash-based signature with the smallest signature size that we are aware of; in addition, the hybrid approach we employed can also significantly reduce the signature size compared to using a hash tree solely; for the hash tree structure, we design a specific authentication path in combination with the related communication model to further minimize the signature size; finally, we optimize the authentication approach to achieve the minimum signature size in a single transmission. Our construction minimizes the signature size in the aforementioned model, achieving a compression rate of 0.017 to 0.828 based on distinct values of parameters, as compared to XMSS-256. We also demonstrated that eBiBa can achieve post-quantum forward-secure and EUCMA security.

We present a novel circuit bootstrapping algorithm that outperforms the state-of-the-art TFHE method with 9.9 × speedup and 15.6 × key size reduction. These improvements can be attributed to two technical contributions. Firstly, we redesigned the circuit bootstrapping workflow to operate exclusively under the ring ciphertext type, which eliminates the need for conversion between LWE and RLWE ciphertexts. Secondly, we improve the LMKC+ blind rotation algorithm by reducing the number of automorphisms, then propose the first automorphism type multi-value functional bootstrapping. These automorphism-based techniques lead to further key size optimization, and are of independent interest besides circuit bootstrapping. Based on our new circuit bootstrapping we can evaluate AES-128 in 26.2 s (single thread), achieving 10.3 × speedup compared with the state-of-the-art TFHE-based approach.

The window τ -adic non-adjacent form (window τ NAF) was initially proposed by Solinas in 2000 as a method to calculate scalar multiplication on the Koblitz curves. To ensure the correctness of the window τ NAF, Blake, Murty, and Xu demonstrated that the pre-computation scheme of this method must be convergent. To date, the standard representation system for scalar multiplication on the Koblitz curve E_a/ 𝔽_2^m using the Frobenius map τ remains the window τ NAF. In this paper, we present a novel algorithm that extends the window τ NAF approach and improves its pre-computation scheme. Our algorithm integrates several window τ NAFs, where the initial few are non-convergent and the final one is the standard window τ NAF. Compared with the previous state-of-the-art method, our approach achieves a 5% reduction in the time for implementing scalar multiplication when using the μ _4 -Koblitz curves and LD coordinates. This work offers significant advancements in optimizing scalar multiplication on Koblitz curves.

Functional bootstrapping (FBS) is a powerful technique that evaluates a look-up table (LUT) while refreshing an LWE ciphertext in FHEW and TFHE schemes. However, the LUT evaluation over the message space is constrained by negacyclicity, which affects the practical application of functional bootstrapping. Existing methods require multiple FBS and some homomorphic operations to address this issue, which results in inferior performance compared with the original functional bootstrapping. In this paper, we utilize the variant least significant bit (LSB) encoding method to efficiently achieve the full domain functional bootstrapping for message space in FHEW-like schemes. Specifically, the message space ℤ_t is embedded into the encoding space ℤ_N by setting the most significant bit of noise to zero. As a result, the encoding space is equal to the domain of the LUT and our functional bootstrapping can evaluate arbitrary functions. In addition, our technique can be applied to multi-value bootstrapping and tree-based bootstrapping. Thus, these algorithms only need one FBS to achieve the full domain property. Finally, we implement our full domain functional bootstrapping in the OpenFHE cryptography library. Experiments demonstrate that up to 2 × performance improvement is achieved compared with the state-of-the-art work [27].