Time-release cryptography is a flourishing research area with a long history and has been extensively studied. In this work, we enrich it by introducing a novel concept: a time-release zero-knowledge proof (TRZKP). A TRZKP is a non-interactive zero-knowledge proof that allows one to publish a proof for a given relation R_ℒ , such that anyone can only finish the verification after time T by performing a sequential computation. This work formalizes the concept of TRZKP and presents light constructions for the time-release version of any NIZK obtained from a public-coin protocol via Fiat-Shamir transformation. TRZKPs can be applied to provide time-release authentication, for example, they can be employed to construct verifiable timed signatures (VTS), introduced by Thyagarajan et al. (CCS’20). Through both theoretical and practical analysis, our construction has advantages over existing VTS for Fiat-Shamir signatures. Specifically, when instantiated with Shnorr signature, our VTS signing time remains basically unchanged as the delay time grows, and is preferable for longer delay times; our VTS verification time is significantly small (on the level of milliseconds, while existing works on the level of seconds), and our VTS size is 67 times smaller than the state-of-the-art. It also has the time-verifiability property, which ensures the signature is recoverable after the specified time.

The cost of homomorphic multiplications for existing FHEs to evaluate a degree-D polynomial f(x) at some point x is very expensive. When x is encoded in a plaintext slot having a power-of-two degree d = 2^ℓ and D ≤ d , one can efficiently evaluate f(x) with O(log d) multiplications using the heuristic algorithms of Okada et al. (ASIACRYPT 2023). However, neither d = 2^ℓ nor D≤ d is satisfied for most practical FHE parameters, and the Paterson–Stockmeyer (P-S) method with O(√(D)) multiplications remains the state-of-the-art for d 2^ℓ or D>d . In this paper, we first present a polynomial evaluation algorithm with O(log d) multiplications for any non-power-of-two d and D≤ d , which achieves the same asymptotic complexity as that of Okada et al. Then, we gave a polynomial evaluation algorithm with O(√(D/d)) multiplications for plaintext modulus p>2 and d < D≤ dlog p , which beats the P-S method by a factor of √(d) and essentially achieves logarithmic multiplication complexity when D ≤ d ·min (log ^2 D, log p) . As a major application, we implement our algorithms in experiment to evaluate the digit extraction polynomials of the BGV bootstrapping with parameter d ranging from 14 to 45 in HElib, and obtain a 1.22-2.16× speedup over the recent work of Ma et al. (EUROCRYPT 2024).

Multi-key fully homomorphic encryption (MK-FHE) enables secure computation over ciphertexts under different keys, but its practicality is hindered by inefficient bootstrapping. In this work, we propose , a new MK-FHE scheme with highly efficient bootstrapping. Our bootstrapping framework improves upon the best-known complexity, reducing it from O(dkn) to O(kn), and further to O(√(kn)) under parallelization, where d is the gadget length (typically scaling with the number of parties k) and n is the LWE dimension. The framework consists of two main components: (i) a ciphertext conversion algorithm that transforms a multi-key LWE ciphertext into k vectorized RLWE ciphertexts via k optimized blind rotations and dk key-switching operations, and (ii) a hybrid accumulator that aggregates these into a single multi-key RLWE ciphertext. We implemented on both CPU and GPU platforms to demonstrate its practicality. For k=16 , we achieve 3.3× and 7.2× improvements on CPU, compared to the state-of-the-art schemes by Kwak et al. (PKC 2024) and by Xiang et al. (ASIACRYPT 2024), respectively. We further achieve a 195× GPU acceleration, compared to our CPU runtime. As a byproduct, we design a new distributed-decryption protocol, which allows us to obtain a ciphertext with a small noise bound, and thus does not blow up the parameters.

Fully Homomorphic Encryption (FHE) enables arbitrary computations on encrypted data, a paradigm that Multi-Key FHE (MKFHE) extends to the decentralized setting by supporting operations on ciphertexts encrypted under multiple, distinct keys. However, the high computational cost of bootstrapping remains a major bottleneck, especially in the multi-key scenario where blind rotation is the dominant overhead. To address this, we propose a novel and parallel-friendly blind rotation scheme based on the NTRU assumption for efficient MKFHE bootstrapping. Our core technical contribution is a grouped inner product algorithm optimized for automorphism-based blind rotation, which reorganizes hybrid product storage and extends the external product to be compatible with both NTRU and MK-RLWE ciphertexts. Our parallelized algorithm reduces the time complexity from O(n) to O(√(n)) . Our scheme demonstrates significant improvements over prior MKFHE works in both computational efficiency and storage requirements. At a 100-bit security level with k=8 participants, our scheme achieves a ciphertext bootstrapping time of 0.048 seconds, representing a 6.8 × speedup compared to Kwak et al.’s state-of-the-art work. Furthermore, our scheme substantially reduces storage overhead, requiring only 81.5MB for evaluation keys ( 1.7 × smaller) and 64KB for re-linearization keys ( 6.0 × smaller) relative to Kwak et al.’s implementation.

Registered attribute-based signature(registered ABS), introduced by Zhang et al.(PKC’24), eliminates the key escrow problem associated with classical attribute-based signature(ABS). It allows users to generate public/sectret key pairs themselves and register the related public key and attribute with a key curator. Different from a trusted attribute authority, the key curator is fully transparent and retains no secrets. In this paper, we propose the first generic framework for anonymous registered ABS that supports circuits as policies. We achieve this goal through an approach we call “accumulate-then-sign-then-prove”, which leverages commonly used cryptographic primitives including digital signature, accumulator, and non-interactive zero-knowledge schemes(NIZKs). We further enrich the functionality by adding user removal, making our scheme dynamic. Our generic framework can be instantiated from various combinations of inner and outer layer protocols based on different assumptions. We provide recommendations from three different perspectives for the choice of concrete cryptographic schemes. Compared with current work on registered ABS, our framework: i) provides diversity regarding the assumptions to instantiate cryptographic primitives; ii) has advantages in proof size and verification time.

Recent years have seen the widespread adoption of zkSNARKs constructed over small fields, including but not limited to, the Goldilocks field, small Mersenne prime fields, and tower of binary fields. Their appeal stems primarily from their efficacy in proving computations with small bit widths, which facilitates efficient proving of general computations and offers significant advantages, notably yielding remarkably fast proving efficiency for tasks such as proof of knowledge of hash preimages. Nevertheless, employing these SNARKs to prove algebraic statements (e.g., RSA, ECDSA signature verification) presents efficiency challenges, particularly in critical applications like zk-bridges and zkVMs that require verifying standard cryptographic primitives. To address this problem, we first define a new circuit model: arithmetic circuits with additional exponentiation gates. These gates serve as fundamental building blocks for establishing more intricate algebraic relations. Then we present a Hash-committed Commit-and-Prove (HCP) framework to construct Non-interactive Zero-knowledge (NIZK) proofs for the satisfiability of these circuits. Specifically, when proving knowledge of group exponentiations in discrete logarithm hard groups and RSA groups, compared to verifying complex group exponentiations within SNARK circuits, our approach requires proving only more lightweight computations within the SNARK, such as zk-friendly hash functions (e.g., Poseidon hash function). The number of these lightweight computations depends solely on the security parameter. This differentiation leads to substantial speedups for the prover relative to direct SNARK methods, while maintaining competitive proof size and verification cost.

Toward practical and client-friendly single-server private information retrieval, we introduce FlashPIR, a scheme achieving both low client overhead and high server throughput. Constructed based on fully homomorphic encryption, our protocol possesses two distinct advantages: First, a majority of the resource-intensive computations can be performed in an offline phase, prior to query reception, significantly reducing the online response time. Second, database updates operate independently of clients, with low client computational overhead remaining nearly constant regardless of the database scale. We conducted comprehensive experiments to evaluate the performance of FlashPIR. The results demonstrate that for database sizes of 256 MB, our scheme achieves a throughput 2.6× greater than KsPIR (Luo et al., CCS 2024) and 18.5× greater than Spiral (Menon and Wu, S P 2022).

Abstract Data Availability Sampling (DAS) is a pivotal paradigm for addressing scalability challenges in blockchains. However, the predominant DAS schemes rely on KZG commitments, which necessitate a trusted setup. While the recently proposed FRIDA (Crypto’24) offers a transparent, FRI-based alternative, it suffers from large commitment sizes due to its restriction to the unique decoding radius. In this work, we generalize the protocol to the list decoding radius by leveraging the DEEP (Domain Extension for Eliminating Pretenders) technique. We provide a formal proof of the opening-consistency of the DEEP-FRI, established via the notion of mutual correlated agreement, instead of the weighted correlated agreement in the original DEEP-FRI protocol. In terms of efficiency, our scheme reduces the commitment size by a factor of $$1.2 \sim 1.8\times$$ 1.2 ∼ 1.8 × while preserving the computational efficiency of both the prover and the verifier.

Two most common ways to design non-interactive zero knowledge (NIZK) proofs are based on Sigma ( )-protocols (an efficient way to prove algebraic statements) and zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARK) protocols (an efficient way to prove arithmetic statements). However, in the applications of cryptocurrencies such as privacy-preserving credentials, privacy-preserving audits, and blockchain-based voting systems, the zk-SNARKs for general statements are usually implemented with encryption, commitment, or other algebraic cryptographic schemes. Moreover, zk-SNARKs for many different arithmetic statements may also be required to be implemented together. Clearly, a typical solution is to extend the zk-SNARK circuit to include the code for algebraic part. However, complex cryptographic operations in the algebraic algorithms will significantly increase the circuit size, which leads to impractically large proving time and CRS size. Thus, we need a flexible enough proof system for composite statements including both algebraic and arithmetic statements. Unfortunately, while the conjunction of zk-SNARKs is relatively natural and numerous effective solutions are currently available (e.g. by utilizing the commit-and-prove technique), the disjunction of zk-SNARKs is rarely discussed in detail. In this paper, we mainly focus on the disjunctive statements of Groth16, and we propose a Groth16 variant—CompGroth16, which provides a framework for Groth16 to prove the disjunctive statements that consist of a mix of algebraic and arithmetic components. Specifically, we could directly combine CompGroth16 with -protocol or even CompGroth16 with CompGroth16 just like the logical composition of -protocols. From this, we can gain many good properties, such as broader expression, better prover’s efficiency and shorter CRS. In addition, for the combination of CompGroth16 and -protocol, we also present two representative application scenarios to demonstrate the practicality of our construction.

The inefficiency of bootstrapping is the primary bottleneck preventing fully homomorphic encryption (FHE) from practical applications. One of the main obstacles to improving the bootstrapping performance using hardware acceleration is the large storage overhead of the bootstrapping keys. To the best of our knowledge, a recent TFHE-like FHE scheme proposed by Xiang and colleagues in 2023 has the smallest bootstrapping key size, which is about 70 MB for 128-bit security parameter (including 60 MB for the key-switching keys and about 10 MB for the blind rotation keys). In this paper, we further improved the bootstrapping algorithm of Xiang et al. with a 30x reduction in key size and a 1.2x speedup. In particular, our new algorithm only requires less than 3 MB bootstrapping keys and can be completed in merely 3 ms at 128-bit security. Technically, we rearranged the main process of the TFHE-like bootstrapping algorithm which allows us to greatly reduce the size of the key-switching keys from previous (O) over tilde (n(2)) to (O) over tilde (n) bits, where n is the dimension of the lattice. We also improved the computation of the automorphisms by using a single generator, which allows us to reduce the blind rotation key size from previous (O) over tilde (n+q) to (O) over tilde (n) bits, where q is the modulus of the ciphertext. Finally, we apply our new FHE scheme to discretized neural networks (DiNNs). Experimental results show that compared to a previous FHE-friendly DiNN approach by Bourse and colleagues in 2018 at the same security and accuracy, our approach achieves a 36x reduction in memory and a 8x speedup in time.

This paper introduces the first multilinear polynomial commitment scheme (PCS) over Galois rings achieving 𝒪(log ^2 n) verification cost. It achieves 𝒪(nlog n) committing time and 𝒪(n) evaluation opening prover time. This PCS can be used to construct zero-knowledge proofs for arithmetic circuits over Galois rings, facilitating verifiable computation in applications requiring proofs of polynomial ring operations (e.g., verifiable fully homomorphic encryption). First we construct random foldable linear codes over Galois rings with sufficient code distance and present a distance preservation theorem over Galois rings. Second we extend the commitment (Zeilberger et al., Crypto 2024) to multilinear polynomials over Galois rings. Our approach reduces proof size and verifier time from 𝒪(√(n)) to 𝒪(log ^2 n) compared to Wei et al., PKC 2025. Furthermore, we give a batched multipoint opening protocol for evaluation phase that collapses the proof size and verifier time of N polynomials at M points from 𝒪(NM log ^2 n) to 𝒪(log ^2 n) , prover time from 𝒪(NMn) to 𝒪(n) , further enhancing efficiency.

Verifiable Computation over encrypted data (VCoed) has two popular paradigms: SNARK-FHE (applying SNARKs to prove FHE operations) and FHE-SNARK (homomorphically evaluating SNARK proofs). For the existing works, FHE-SNARK has a much better efficiency compared to SNARK-FHE. In this work, we follow the line of FHE-SNARK and further improve its efficiency by designing Phalanx-an FHE-friendly SNARK that is: a) 3x lower multiplicative depth than FRI-based SNARKs; and b) Compatible with FHE SIMD operations. Based on Phalanx, we construct an FHE-SNARK scheme that has: a) 7.3x similar to 24.4x speedup: 2.27-hour proof generation for 2(20)-gate circuits on a single core CPU and 0.68-hour when the input ciphertexts are in iNTT form (vs. 16.57 hours in the state-of-the-art); and b) Practical verification: 61.4 MB proofs with 2.8 seconds verification (single core).

The proposal of registered attribute-based signature(registered ABS) recently eliminates the long-standing key-escrow problem that has plagued classical attribute-based signature(ABS) for a long time. It allows users to generate public and secret key pairs themselves and register their public key and attribute with a key curator. The key curator is fully transparent and retains no secrets. Due to the introduction of public user registration, unlike classical ABS where only attribute authorities are aware of user's attribute information, in registered ABS, all other users in the system can directly view a user's attributes during registration phase. This is not conducive to the deployment of the scheme in scenarios that pursue user privacy. In this paper, we propose a new model of registered ABS that addresses the key-escrow problem while preserving users' attribute privacy. We have provided a complete security definition of our registered ABS and proposed a detailed construction framework. Although our scheme necessitates a trusted authority, it ensures that adversaries cannot forge user signatures even if the authority is compromised.

Zero knowledge succinct non-interactive arguments of knowledge protocol (zk-SNARK) is an application oriented variant of zero knowledge proof, which enables a prover to convince a verifier that a statement is true, without revealing any other information beyond the correctness of the statement itself. Due to its powerful capabilities and high efficiency, it has been widely deployed in various blockchain based applications to provide privacy and scalability. While these applications place high demands on small proof size, fast verification and decentralization, currently available zk-SNARK with the shortest proof size and the fastest verification speed is in the common reference string (CRS) model, that is they require the trusted setup. After the pioneering results proposed by Bellare et al. in ASIACRYPT 2016, there have been lots of efforts to construct zk-SNARKs that satisfy subversion zero knowledge (S-ZK) and standard soundness from the zk-SNARK in the CRS model. These constructions could be regarded secure in the bare public key (BPK) model because that the equivalence between S-ZK in the CRS model, and uniform non-black-box zero knowledge in the BPK model has been proved by Abdolmaleki et al. in PKC 2020. Thus, compared to the CRS model, the BPK model better characterizes decentralized blockchain based application such as cryptocurrencies and anonymous credentials. In this study, by leveraging the power of random oracle (RO) model, we proposed the first publicly verifiable non-uniform ZK zk-SNARK scheme in the BPK model maintaining comparable efficiency with its conventional counterpart, which can also be compatible with the well-known transformation proposed by Bitansky et al. in TCC 2013 to obtain an efficient designated-verifier zk-SNARK. We achieve this goal by only adding a constant number of elements into the CRS, and using an unconventional but natural method to transform Groth’s zk-SNARK in EUROCRYPT 2016. In addition, we propose a new speed-up technique that provides a trade-off. Specifically, if a logarithmic number of elements are added into the CRS, according to different circuits, the CRS verification time in our construction could be approximately 9–23% shorter than that in the conventional counterpart.

Recently, there is a growing need for SNARKs to operate over a broader range of algebraic structures, and one important structure is Galois ring. We present transparent SNARK schemes over arbitrary Galois rings. Compared with Rinocchio scheme in Ganesh et al. (J Cryptol 2023), our SNARK schemes do not require a trusted third party to establish a structured reference string (SRS). In this paper, we present the expander code over arbitrary Galois rings, which can be encoded in O(n) time. Using this expander code, we then extend the Brakedown commitment scheme in Golovnev et al. (CRYPTO 2023) to Galois rings. By combining the Libra framework in Xie et al. (CRYPTO 2019), we present a transparent SNARK for log-space uniform circuits over Galois rings, achieving O(n) prover time, O(√(n)) proof size, and O(√(n)) verifier time. And by combining HyperPlonk in Chen et al. (EUROCRYPT 2023), we present a transparent SNARK for NP circuits over Galois rings, with O(nlog ^2 n) prover time, O(√(n)) proof size, and O(√(n)) verifier time.

Recent attacks on NTRU lattices given by Ducas and van Woerden (ASIACRYPT 2021) showed that for moduli q larger than the so-called fatigue point n^2.484+o(1) , the security of NTRU is noticeably less than that of (ring)-LWE. Unlike NTRU-based PKE with q typically lying in the secure regime of NTRU lattices (i.e., q

With the application and popularization of IoT,cloud computing,and artificial intelligence,data security and privacy protection have become the focus of attention.Fully homomorphic encryption,as an effective solution to the privacy security problem,allows performing arbitrary homomorphic computation on encrypted data,and is a powerful encryption tool with a wide range of potential applications.The paper summarizes the proposed fully homomorphic encryption schemes since 2009,and divides them into four technical routes based on the core technologies of the schemes,analyzes and discusses the key constructs,algorithm optimization processes,and future development directions of each type of scheme.The paper firstly introduces fully homomorphic encryption-related mathematical principles,covering the basic assumptions and security features of fully homomorphic encryption schemes.Subsequently,according to the technical routes of the four fully homomorphic encryption schemes,it summarizes the structural general formulas of the encryption schemes,summarizes the core steps of the bootstrap algorithms,discusses the latest research progress,and on the basis of this,comprehensively analyzes and compares the storage efficiencies and computing speeds of various schemes.The paper finally shows the application implementation of homomorphic algorithm library for encryption schemes under each technical route,analyzes the opportunities and challenges of fully homomorphic encryption schemes in the current era,and makes an outlook on the future research prospects.