Threshold signatures split the secret key among n parties, where any subset of at least t parties can collaboratively produce a valid signature. They have been widely deployed in applications such as blockchain systems. Lattice-based threshold signatures have also attracted considerable attention due to their post-quantum security guarantees. However, existing lattice-based constructions still face significant efficiency challenges, particularly when the number of parties becomes large. Recent lattice-based threshold signatures such as TRaccoon (Eurocrypt’24) and Ringtail (S P’25) support large thresholds, but they either require three interaction rounds or incur heavy communication costs in the two-round setting, limiting their practicality. In this paper, we present , a novel two-round lattice-based threshold signature that overcomes these limitations via a new trapdoor semi-commitment technique. This variant of commitment relaxes the standard binding requirement to a weaker form, allowing an efficient instantiation from the NTRU assumption and enabling a compact two-round signing protocol with low communication. For t=1024 and 128-bit security, achieves significant improvements among existing lattice-based threshold signatures: its total communication per party and public key size are both minimal, at 26.9 KB and 2.0 KB, respectively. While the resulting signature size is larger (17.7 KB), it remains practical and highly competitive. is thus well-suited for real-world large-scale deployments where both round efficiency and communication load are critical.

As future telecom networks evolve toward the integration of sensing, communication, and computing, data-driven services are becoming increasingly prevalent. However, there are security concerns regarding Over-The-Top (OTT) servers accessing user data from the User Equipment (UE). Fully Homomorphic Encryption (FHE) allows data to be processed in ciphertext and is considered one of the necessary ways to guarantee secure privacy computing in telecom networks. Nevertheless, the inherent ciphertext expansion of FHE results in massive data volumes, imposing significant overhead on resource-constrained wireless air interfaces. To address the issue of enabling UE privacy computing in the future telecom network, this paper proposes an edge homomorphic transciphering framework. We deploy the transciphering function within edge computing nodes, such as the User Plane Function (UPF). UE only needs to transmit symmetrically encrypted data at low expansion rates, and the network edge computing node converts this into FHE ciphertext and forwards it to the OTT server. We validated the framework using multi-modal payloads. Our scheme reduces transmission overhead in air interface and enables the telecom network to apply FHE while mitigating the impact of ciphertext expansion. Furthermore, we tested the system by integrating two representative block ciphers, AES and HIGHT, verifying the framework’s flexibility for future telecom devices.

Physical layer key generation (PLKG) methods are widely studied in academia due to their independence from trusted third parties and computational efficiency. However, the security of these methods depends on the statistical testing of the post-processed random sequences, which raises concerns about their reliability. While min-entropy is commonly used to evaluate the quality of random sequences, few studies provide explicit min-entropy estimation results. Additionally, existing methods for min-entropy estimation, such as the NIST SP 800-90B (90B) standard and entropy estimators based on deep neural networks (DNNs), have not been adequately validated in the context of PLKG. In this work, we present the first empirical study of min-entropy estimation tailored for PLKG. We systematically analyze five representative key generation schemes using both public and collected datasets. We first experimentally demonstrate the overestimation and underestimation behaviors of 90B estimators on time-varying data and propose a practical strategy for their use. Then, we formally analyze the limitations of DNN-based estimators and introduce a Bidirectional Temporal Training and Testing strategy to improve estimation accuracy. Furthermore, we provide theoretical and empirical insights into how preprocessing and quantization affect entropy. Our results show that PLKG sequences often exhibit significant local predictability, leading to lower-than-expected entropy values. These findings highlight previously overlooked security risks and provide practical guidance for designing more robust PLKG systems.

The transition to post-quantum cryptography is reshaping the Secure Shell (SSH) protocol for remote administration. Post-quantum key exchange has been deployed in OpenSSH and is being standardized, while SSH authentication largely remains a signature-replacement effort. This path preserves the familiar public-key credential model, but inherits the size and computation overhead of post-quantum signatures, which can increase latency, traffic, and server-side load. KEM-based authentication offers a natural alternative to this signature-centric path, and SSH makes this especially attractive at the user-authentication layer, which is method-extensible, separated from transport-layer key exchange and host-key authentication, and already protected by the established channel. We present a drop-in KEM-based user-authentication method for SSH that replaces client public-key signatures with a session-bound challenge-response proof. The method fits into SSH's existing user-authentication framework, preserving the public-key credential model and enabling incremental deployment alongside existing methods. We provide a reduction-based security argument in the post-quantum ACCE framework, implement the design in OpenSSH using liboqs, and evaluate it under representative RTTs, TCP initial-window settings, and post-quantum migration configurations. Our results show that KEM-based authentication is competitive with compact signature-based authentication under representative network settings, while reducing median handshake latency by up to about 10

Ensuring the secure and proper deployment of Enclaves is critical for the security of Trusted Execution Environments (TEEs). Recently, the increasing attacks targeting Enclaves have made the traditional solution risky to use different enclaves for each task. An ideal solution is a pre-designed enclave that can be flexibly reused across different computational tasks. To address this issue, we propose FH-TEE, a novel framework that integrates Fully Homomorphic Encryption (FHE) with TEE. In this approach, computational tasks are partitioned so that only fixed, logic-independent operations are performed within the Enclave, enabling its reuse across various tasks. Flexibility in accommodating diverse computational requirements is achieved through FHE. Furthermore, because computationally intensive FHE operations, such as bootstrapping and ciphertext transformation, are logic-independent and offloaded to the Enclave, FH-TEE significantly improves efficiency compared to purely FHE-based solutions, while maintaining robust privacy and security. In our demo program, the server receives ciphertext from the client, performs ten iterations of the Game of Life computation, and then sends the resulting ciphertext back to the client. The results show that our scheme is 10.57× faster in computation speed and 32064× smaller in transmission size compared to a pure FHE scheme.

Fully homomorphic encryption (FHE) is an appealing and promising solution for privacy-preserving transformer inference to protect users' privacy. However, the huge computational overhead makes it unrealistic to apply FHE in realworld transformers for large language models (LLM). Current FHE-based non-interactive approaches to secure transformer inference face significant performance challenges, especially in CPU environment. NEXUS (NDSS'25) [1] reported a latency exceeding 7 hours for 32-input batches on the BERT-base model in their CPU environment. The feedforward block, comprising a large-scale matrix multiplication followed by a GELU evaluation, is widely recognized as one of the most computationally intensive components in privacy-preserving transformer inference. We aim to reduce the latency and propose LEAF, a lowlatency evaluation architecture for the feedforward block. LEAF introduces a novel combination of fast matrix multiplication and an asymptotically efficient algorithm for computing nonpolynomial activations. LEAF achieved significant improvement from existing techniques with a total latency of 53.4 seconds and 19.2 seconds for the feedforward block in the BERT-base model with a 128-token input and the Llama-3-8B model with an 8-token input, respectively, on a single CPU. Compared to prior methods on FHE-based non-interactive inference, LEAF achieved 58×-100×; speedups over batched approaches such as NEXUS [1] and MOAI [2], and about 11×97; speedups over nonbatched approaches such as THOR [3] and PowerFormer [4] for the BERT-base feedforward block. For the feedforward block in Llama-3-8B model, LEAF further demonstrated an improvement of approximately 1,800×97; than existing works [1], [2]. Our implementations are open-sourced.

Wiretap coding, evolving in parallel with cryptography for nearly 50 years, focuses on secure transmission under the assumption that the wiretap channel is no less noisy than the main channel. Most provably secure schemes rely on information-theoretic security but often achieve limited practical rates. This paper proposes a framework for computationally secure modular wiretap coding. We integrate error correction encoding with the channel transition process to define the wiretap channel function, which consists of an invertible function and a lossy function. Secure encoding is then modeled as a computational entropy extractor. A detailed analysis of the lossy function for symmetric wiretap channels is presented. To leverage this lossiness, we design two computational extractors: the invertible fooling extractor (IFE) and the compressed randomness extractor (CRE). For practical implementation, we demonstrate that a 4-round optimal asymmetric encryption padding serves as an IFE in the random oracle model. Experimental comparisons show that our scheme achieves approximately 3 times and 2.7 times the code rates of the Invert-then-Encode and code-based schemes—classical information-theoretic schemes—under equivalent channel conditions. By instantiating IFE and CRE with hash algorithms such as SHAKE-128/256, we develop a practical wiretap coding scheme that achieves high rates with reasonable computational overhead.

Transport Layer Cryptography Protocol (TLCP) is a secure communication protocol developed in China, featuring a dual-certificate architecture and incorporating ShangMi cryptographic algorithms. It has been widely deployed in security-critical domains such as finance, government, and energy. Despite its practical significance, TLCP did not undergo comprehensive formal analysis during its standardization process, leaving potential design-level vulnerabilities insufficiently explored. Moreover, the advent of quantum computing poses fundamental challenges to the classical cryptographic primitives employed by TLCP, motivating the need for both systematic security evaluation and post-quantum enhancements. To address these gaps, we first construct the comprehensive formal model of TLCP, covering certificate-based and identity-based cipher suites as well as its distinctive dual-certificate mechanism, under a realistic threat model and security assumptions that capture both classical and quantum adversaries. Based on this model, we conduct an automated security analysis using ProVerif, identifying nine potential attack vectors and deriving five concrete mitigation recommendations. Finally, motivated by the analysis results and the limitations of incremental fixes against quantum threats, we propose KEMTLCP, a post-quantum secure variant of TLCP that leverages key encapsulation mechanisms (KEMs) for both key exchange and authentication while preserving TLCP’s architectural principles through a novel explicit authentication mechanism. We further provide a security proof for the core authentication mechanism, show that KEMTLCP effectively mitigates the majority of identified vulnerabilities through formal analysis, and evaluate its practical performance.

Resource-constrained devices in future telecom systems, including Narrowband IoT (NB-IoT) deployments and personal IoT networks (PINs), typically rely on lightweight symmetric encryption to satisfy strict communication and latency constraints, but ciphertexts produced by such ciphers do not support computation in the encrypted domain. Fully homomorphic encryption (FHE) enables computation over encrypted data, yet its computational and communication overhead makes it impractical to deploy at resource-constrained devices in communication-oriented edge–cloud systems, posing a fundamental challenge for deploying PPML in telecom environments. To bridge this gap, we propose a privacy-preserving generative-AI inference framework based on transciphering of lightweight symmetric ciphertexts. Specifically, the framework transforms symmetric ciphertexts into the homomorphic domain at the server by homomorphically evaluating the decryption circuit, enabling non-interactive inference with low uplink overhead. We evaluate the proposed framework through homomorphic evaluation of the lightweight cipher ASCON. Under a standard 128-bit security setting, our implementation achieves an end-to-end latency of 45.3s for homomorphic ASCON translation, providing a 2.9× improvement over an FHEW-like function-bootstrapping baseline under comparable parameters. These results indicate that lightweight-to-FHE ciphertext translation can be made practical for communication-oriented PPML pipelines.

Abstract Fully Homomorphic Encryption (FHE) enables arbitrary computation on encrypted data without decryption, making it a cornerstone of privacy-preserving outsourcing, such as cloud computing. However, homomorphic operations cause ciphertext noise to grow until decryption fails. The efficient solution is bootstrapping, which refreshes the noise in FHE ciphertexts to sustain arbitrary deep homomorphic evaluation. But in practice, bootstrapping consumes over 50% of total execution time, posing a serious obstacle to FHE adoption. This paper presents a systematic survey of FHE bootstrapping algorithms and their optimizations. We organize existing works into three main paradigms: word-wise bootstrapping for BGV, BFV, and CKKS schemes; bit-wise bootstrapping for FHEW and TFHE schemes; and hybrid bootstrapping, which leverages both word-wise schemes and bit-wise schemes. We analyze the evolution of crucial techniques, highlight latest advances in reducing latency, enhancing parallelism, and controlling noise growth, and compare the advantages and limitations of different schemes. Finally, we discuss emerging research trends.

Manual formal analysis of cryptographic schemes is labor-intensive and requires substantial expertise. While model-checking tools (e.g., Scyther and Tamarin) and computational-security tools (e.g., CryptoVerif and EasyCrypt) improve the automation of security proofs, they still rely on experts to abstract schemes and write tool-specific formal descriptions. Large language models (LLMs) are a promising alternative, but their effectiveness in this domain remains unexplored due to the absence of standardized evaluation methodologies. To fill this gap, we introduce CrypFormBench (C.F.B for short), a comprehensive benchmark jointly covering symbolic and computational security to evaluate five core LLM capabilities: interpretation, generation, completion, transformation, and correction. It comprises 700 instances spanning 677 schemes, 7 mainstream formal verifier languages, and 160 security properties. The evaluation of 9 state-of-the-art LLMs reveals that most of them perform well on interpretation and completion, given their code-awareness advantages, but struggle with generation, transformation, and correction. Overall, their performance remains limited, with Claude-3.5 achieving the highest score at 48.7 out of 100. We further provide practical guidance, e.g., few-shot prompting, Pass@K sampling, and lightweight fine-tuning, to mitigate the executability bottleneck and improve tool-usable outputs. Taken together, our benchmark and analyses offer a grounded view of current progress and concrete directions toward reliable LLM-assisted formal cryptographic analysis.

Post-quantum migration will be uneven: stacks and PKI will evolve on different timelines, producing deployments where peers authenticate with different long-term key types (e.g., a KEM certificate on one side and a signature certificate on the other, or PQC KEM versus PQC signature). Most mutually authenticated key-exchange (AKE) mechanisms assume homogeneous credentials, creating an interoperability gap precisely when operators need agility—the ability to phase in PQC without synchronized certificate changes. We address this need with HetAKE: two-message, mutually authenticated protocols (KEM–SIG and SIG–KEM) that establish secure channels across mixed key types using only standardized primitives (KEMs and signatures) and avoiding DH-like structures that are difficult to instantiate post-quantum. We prove security in the Quantum Random Oracle Model (QROM) under active attacks and state exposure, obtaining indistinguishability against active attacks (IND-AA) for KEM-SIG and the state-attack-excluding variant (IND-StAA) for SIG-KEM. We implement both variants with widely used PQC and classical libraries and benchmark them against practical baselines (FSXY and Signed-DH/KEM). Results show competitive performance and a tunable asymmetry that shifts compute and bandwidth between initiator and responder via the choice of KEM and signature instantiations, which is useful for IoT, mobile, and other resource-skewed settings. In sum, HetAKE advances migration agility by providing a practical, provably secure AKE core for mixed-credential deployments, enabling incremental, low-friction movement toward post-quantum readiness.

Functional bootstrapping can evaluate a look up table (LUT) almost for free during refreshing ciphertexts, making fully homomorphic encryption (FHE) more efficient. But the original functional bootstrapping requires the LUT to be negacyclic, or the plaintext should be distributed in the first half torus. This limitation lies in the selection of the negacyclic cyclotomic ring in the blind rotation procedure, which greatly restricts the power of functional bootstrapping. Full domain functional bootstrapping (FDFB) is more attractive. While the plaintext can be distributed throughout the whole torus, it lends us an opportunity to use the natural homomorphism of Regev encryption to evaluate affine functions for free, while maintaining the efficiency of the LUT evaluation.In this paper, we analyze in depth the manifestation of blind rotation on the prime cyclotomic ring, and use this structure to turn the traditional functional bootstrapping into the full domain. Compared with existing full domain solutions, our approach achieves the lowest noise growth and the fewest polynomial multiplications, since the expensive blind rotation procedure only needs to be called once while other solutions require at least twice. Furthermore, our scheme presents good scalability, which can be extended to more functional variants, such as private FDFB, multi-value FDFB and high precision FDFB.

The Blum-Kalai-Wasserman (BKW) algorithm is a significant combinatorial algorithm used to tackle the Learning with Errors (LWE) and Learning with Rounding (LWR) problems. In 2015, Duc et al. (in: Oswald and Fischlin (eds) EUROCRYPT 2015, Springer, Berlin, 2015) proposed the first BKW algorithm applied directly to LWR, which consists of the reduction phase and the solving phase. In this paper, we propose an improved LWR-solving BKW algorithm. For the reduction phase, we design a novel coding method with relaxed collision conditions and introduce a post-processing stage and for the solving phase, we switch to a more efficient Fast Fourier Transform (FFT) distinguisher with pruning. Compared to previous LWR-solving BKW algorithms, our new BKW algorithm achieves a time complexity improvement of 4.0–48.5 bits for the instances considered. Additionally, by incorporating a novel heuristic method in the reduction phase, our algorithm further improves the sample complexity by 3.7–48.7 bits.

TFHE is a fully homomorphic encryption scheme over the torus that supports fast bootstrapping. Its primary evaluation mechanism is based on gate bootstrapping and programmable bootstrapping (PBS), which computes functions while simultaneously refreshing noise. PBS-based evaluation is user-friendly and efficient for small circuits; however, the number of bootstrapping operations increases exponentially with the circuit depth. To address the challenge of efficiently evaluating large-scale circuits, Chillotti et al. introduced a leveled homomorphic evaluation (LHE) mode at Asiacrypt 2017. This mode decouples circuit evaluation from bootstrapping, resulting in a speedup of hundreds of times over PBS-based methods. However, the remaining circuit bootstrapping (CBS) becomes a performance bottleneck, even though its frequency is linear with the circuit depth. In this paper, we refine the LHE mode by mitigating the high cost of CBS. First, we patch the NTT-based CBS algorithm proposed by Wang et al. [WWL+, Eurocrypt 2024], accelerating their algorithm by up to 2.6x. Then, observing the suboptimal parallelism and high complexity of modular reduction in NTT under CBS parameters, we extend WWL+ to an FFT-based algorithm by redesigning the pre-processing method and introducing a split FFT technique. This achieves the fastest CBS implementation with the smallest key size, outperforming the open-source WWL+ implementation by up to 12.1x (resp. 5.12x compared to our patched algorithm), and surpassing TFHEpp [MBM+, USENIX 2021] by 3.42x with a key size reduction of 33.2x. Furthermore, we proposed an improved integer input LHE mode by extending our CBS algorithm to support higher precision and combining it with additional optimizations such as multi-bit extraction. Compared to the previous integer input LHE mode proposed by Bergerat et al. [BBB+, JoC 2023], our approach is up to 10.7x faster with a key size reduction of up to 4.4x. To demonstrate the practicality of our improved LHE mode, we apply it to AES transciphering and general homomorphic look-up table (LUT) evaluation. For AES evaluation, our method is 4.8x faster and reduces the key size by 31.3x compared to the state-of-the-art method, Thunderbird [WLW+, TCHES 2024]. For LUT evaluation, we compare our results with the recent work of Trama et al. [TCBS, ePrint 2024/1201], which constructs a general 8-bit processor of TFHE. Our method not only achieves faster 8-to-8 LUT evaluation but also improves the efficiency of most heavy 8-bit bivariate instructions by up to 21x and the 16-bit sigmoid function by more than 26x.

Verifiable Computation over encrypted data (VCoed) has two popular paradigms: SNARK-FHE (applying SNARKs to prove FHE operations) and FHE-SNARK (homomorphically evaluating SNARK proofs). For the existing works, FHE-SNARK has a much better efficiency compared to SNARK-FHE. In this work, we follow the line of FHE-SNARK and further improve its efficiency by designing Phalanx-an FHE-friendly SNARK that is: a) 3x lower multiplicative depth than FRI-based SNARKs; and b) Compatible with FHE SIMD operations. Based on Phalanx, we construct an FHE-SNARK scheme that has: a) 7.3x similar to 24.4x speedup: 2.27-hour proof generation for 2(20)-gate circuits on a single core CPU and 0.68-hour when the input ciphertexts are in iNTT form (vs. 16.57 hours in the state-of-the-art); and b) Practical verification: 61.4 MB proofs with 2.8 seconds verification (single core).

This paper introduces DAWN, a compact and efficient NTRU encryption utilizing double encoding, which is provably secure under the NTRU assumption and the Ring-LWE assumption. We propose a technique for NTRU encryption called the zero divisor encoding. Unlike the polynomial encoding technique proposed by Hoffstein and Silverman (2001) and the vector encoding technique proposed by Zhang, Feng, and Yan in NEV (Asiacrypt 2023), our zero divisor encoding technique leverages the algebraic structure of the ring used in NTRU, enabling greater ciphertext compression while maintaining negligible decryption failure. We further develop a paradigm for NTRU encryption called the double encoding paradigm to maximize the potential of the zero divisor encoding. This paradigm transforms optimizing an NTRU-based encryption into constructing a better encoding within the NTRU context, providing more concrete direction for scheme development. Several previous NTRU encryptions can be situated within this paradigm with different parameters, facilitating direct comparison. We instantiate this paradigm based on the provably IND-CPA secure NTRU variant by Stehlé and Steinfeld (Eurocrypt 2011) to achieve an IND-CPA secure PKE, and subsequently employ the Fujisaki-Okamoto transformation to achieve an IND-CCA secure KEM. We present two parameter settings of DAWN: DAWN- α minimizes ciphertext size, achieving lengths of 436 bytes under NIST-I security and 973 bytes under NIST-V security; DAWN- β minimizes the combined size of the public key and ciphertext, attaining combined sizes of 964 bytes under NIST-I security and 2054 bytes under NIST-V security. DAWN achieves superior compactness and performance among current lattice-based KEMs without introducing additional security assumptions. Compared to NEV (Asiacrypt 2023), the previously leading NTRU-based KEM in balancing compactness and performance, DAWN demonstrates 20

Prediction-based min-entropy estimation methods, also known as predictors, are essential tools for assessing the security of entropy sources. As recommended in NIST SP 800-90B (90B), these methods estimate min-entropy by forecasting the outputs of entropy sources. Owing to their computational efficiency, considerable research has focused on enhancing the accuracy of predictors, including approaches based on deep neural networks (DNNs). However, concerns remain about their interpretability, reliability, and applicability, particularly for DNN-based predictors. In this paper, we first identify key deficiencies in existing prediction-based methods, including those in 90B and DNN-based predictors, which lead to unreliable estimates and poor adaptability across diverse entropy sources. To improve reliability, we model the predictor output distribution and revise the local predictability metric to produce more stable estimates with associated confidence levels. To enhance the interpretability of DNN-based predictors in entropy estimation, we provide the first theoretical analysis linking neural network optimization objectives to min-entropy, clarifying the suitability and learnability of different architectures. We further reveal the inapplicability of existing methods under time-varying sources and propose a new estimation framework that combines online learning, change detection, and Bayesian optimization for dynamic model updates. The experimental results demonstrate that our methods surpass existing approaches in terms of reliability and applicability, especially when dealing with time-varying sources.