Lattice-based cryptosystems typically employ either direct modulation or its combination with error-correcting codes (ECC) for error correction mechanisms. In this paper, we propose a scalable nested lattice coding framework based on Barnes-Wall lattices that unifies modulation and ECC, enabling efficient and reliable error correction. Our design can serve as a drop-in replacement for direct modulation in lattice-based schemes, significantly improving overall robustness and communication efficiency. By carefully integrating low-dimensional lattice codes into high-dimensional module-lattice-based constructions, we incorporate this technique into MLWE-based key encapsulation mechanism and present an enhanced version of 𝖬𝖫-𝖪𝖤𝖬 , the NIST-standardized lattice-based KEM. We conduct a detailed analysis of the joint distribution of noise polynomial coefficients, from which we derive a methodology for evaluating the decryption failure rate (DFR) without any independence assumptions on the noise coefficients. Our scheme, 𝖡𝖶-𝖪𝖤𝖬 , offers stronger security guarantees, more compact ciphertexts, and significantly reduced DFRs across all security levels compared to 𝖬𝖫-𝖪𝖤𝖬 . Extensive benchmarking demonstrates that 𝖡𝖶-𝖪𝖤𝖬 outperforms 𝖬𝖫-𝖪𝖤𝖬 in key generation and encapsulation, while incurring only marginal overhead in decapsulation. For instance, at the highest security level, 𝖡𝖶-𝖪𝖤𝖬 achieves a 14-bit and 13-bit improvement in classical and quantum security estimates, respectively, or equivalently, a 16.33 𝖡𝖶-𝖪𝖤𝖬 is a promising candidate for practical and quantum-resistant key encapsulation mechanism.

Most PQC schemes remain too resource-intensive for ultra-constrained 8-bit AVR wireless sensor nodes. In this work, we present a comprehensive approach to practical lightweight PQC for such devices, covering scheme design, implementation optimization, and protocol integration. Our contributions are threefold: (i) We propose CTRU-Light, a lattice-based KEM specifically tailored for IoT sensor nodes. It combines small moduli, low-degree polynomials, and NTT-friendly arithmetic for high efficiency, with ASCON used for lightweight symmetric operations. (ii) We explore NTT-friendly moduli for the first time to accelerate modular multiplication on 8-bit AVR platforms and design optimized variants of Montgomery and Barrett multiplication. We show that K-RED2X multiplication exhibits approximate equivalence to Montgomery multiplication under small NTT-friendly moduli. We apply these optimizations to the latest implementations of Kyber (ASIACCS 2025) and Saber (CHES 2025), achieving significant improvements in both speed and code size. Furthermore, we present a highly optimized AVR assembly implementation of CTRU-Light that delivers high efficiency and low stack usage. (iii) We design a Hybrid KEM–MQTT protocol that integrates classical ECDH with post-quantum KEMs. We present the first implementation of this protocol and provide a detailed empirical analysis of its performance. Experiments show that CTRU-Light is the only scheme capable of supporting both pure PQ and hybrid KEM–MQTT on 8-bit WSNs, achieving lower handshake latency than Kyber-512 and LightSaber.

Modern isogeny-based cryptosystems spend much of their running time in finite-field, elliptic-curve, and higher-dimensional isogeny arithmetic. Exploiting SIMD parallelism is nontrivial: routines such as Montgomery ladders contain loop-carried dependencies, while point, pairing, and theta-coordinate formulas expose only irregular fine-grained parallelism. We show that substantial SIMD parallelism can be recovered by reorganizing the arithmetic dependency graphs of higher-level primitives rather than vectorizing field multiplication in isolation. We develop an end-to-end AVX-512IFMA implementation of SQIsign in which data remain in a radix-2^51 vector representation across most of the curve-side computation. Our redesign includes projective xDBLADD schedules, batched point doubling in several coordinate systems, a vectorized biscalar ladder, fused cubical-arithmetic pairing steps, and batched one- and two-dimensional isogeny evaluation. Relative to the reference C implementation, we achieve end-to-end speedups of 1.76×, 1.71×, and 3.18× for key generation, signing, and verification at NIST level I; combined with Qlapoti, key-generation and signing speedups rise to 2.90× and 2.69×. We further apply the same backend and methodology to CORAL, a recent isogeny group action for post-quantum non-interactive key exchange based on two-dimensional 2-isogenies. Across five parameter sets, this yields 1.28–1.40× speedups for key generation and 1.92–2.46× for shared-key computation. These results provide cross-scheme evidence that algorithm-level SIMD scheduling is a reusable optimization dimension for higher-dimensional isogeny cryptography.

In this work, we present a new framework for signature-free, post-quantum secure authenticated key exchange (AKE) that simultaneously satisfies: (1) exchanging at most two standard ciphertexts of a key encapsulation mechanism (KEM); (2) computational symmetry; (3) perfect forward secrecy (PFS); (4) strong resilience to secret-state exposure; (5) strong resistance to decryption-error attacks; (6) admitting instantiations based on the native structure of ML-KEM under the MLWE assumption; and (7) provable security in both the random oracle model (ROM) and the quantum-accessible random oracle model (QROM) under the post-id - framework. This resolves several fundamental open questions in the literature. The core technical building block is a new cryptographic primitive, called an authenticated forward-secure KEM (AFS-KEM), which unifies authentication and forward secrecy within a single KEM abstraction and may be of independent interest.

Traffic violation reporting schemes for fog-assisted vehicular ad hoc networks are generally designed to support traffic management centers (TMCs) in detecting traffic violations so that appropriate actions can be taken against the involved vehicle owners. However, there are ongoing challenges such as ensuring accuracy or accountability with minimal privacy dis closure (e.g., accurate and reliable detection of traffic violations without disclosing the contents of the incident, achieving identity authentication while protecting the privacy of reporters), and how to guarantee the reports are correctly processed complicate the design of such schemes. To address these challenges, we propose a threshold anonymous traffic violation reporting (TATVR) scheme under the assumptions that the fog nodes (i.e., roadside units) and the TMC are semi-trusted, and the number of colluding vehicles is limited. We then extend the TATVR scheme (i.e., extended TATVR or E-TATVR) that does not rely on these assumptions. We explain how TMC can process the received reports more efficiently using the proposed E-TATVR scheme. We also evaluate the security of both proposed schemes and demonstrate that they simultaneously support (strong) confidentiality, non-frameability, conditional unlinkability, unforgeability, and conditional anonymity. In particular, we show that both schemes guarantee strong confidentiality, and the E-TATVR scheme additionally supports report traceability.

The rise of quantum computing necessitates postquantum cryptography (PQC) to secure Internet communications on edge platforms. CTRU is an NTRU-based key encapsulation mechanism (KEM) that features a small modulus and an efficient scaled E8 lattice encoding, offering strong security and performance. However, two critical gaps impede its deployment for Internet of Things (IoT) edge platforms: the absence of an optimized implementation for ARMv8 devices, which dominate the mobile and embedded IoT ecosystems, and a lack of integration and evaluation in practical protocols such as Transport Layer Security (TLS) 1.3. To address these challenges, we present the first NEON-optimized CTRU implementation for ARMv8-A. Our implementation reduces CPU cycles by 3.24 & times; , 2.62 & times; , and 2.99 & times; in key generation (KeyGen), encapsulation (Encaps), and decapsulation (Decaps) compared to the reference C (REF-C) implementation, while lowering energy consumption by 55.2%. Among all evaluated KEMs, it achieves the lowest energy consumption and a competitive memory footprint. We further design a batch KeyGen scheme that boosts KeyGen throughput by 3.73 & times; . Finally, we integrate CTRU into TLS 1.3 to enable postquantum (PQ) key exchange. Comprehensive benchmarks show that CTRU outperforms all evaluated KEMs and classical key exchange scheme Elliptic Curve Diffie-Hellman Secp384r1 (ECDH P384) on ARMv8-A platform. Specifically, it achieves lower TLS handshake latency and higher throughput under ideal network conditions, and its handshake latency distribution is superior to that of all alternatives under narrowband IoT (NB-IoT) constraints. These results demonstrate CTRU's practical suitability for real-world deployment on IoT edge platforms.

Vehicle Edge Computing (VEC) with blockchain faces key storage challenges due to edge nodes' limited capacity and the need for updates and corrections to on-chain data. This paper presents a Scalable Threshold Chameleon Hash (STCH) scheme and Hierarchical Redactable Blockchain (HRB-Chain) framework that enable selective data modification. Unlike conventional immutable blockchains, our solution permits data substitution, decreasing storage requirements while maintaining system integrity. STCH provides improved collision resistance with a consistent global trapdoor despite changing node participation. HRB-Chain implements a three-tier data categorization (static, temporary, dynamic) to handle vehicular data based on update frequency and lifespan, supporting redactions at both block and transaction levels. Security evaluation demonstrates that STCH guarantees indistinguishability, enhanced collision resistance, and semantic security under the discrete logarithm assumption. Tests show a 33% decrease in computational costs during redactions versus current approaches, while HRB-Chain keeps memory usage at only 0.5% with a 1GB allocation, significantly below traditional blockchain systems. This framework effectively transforms blockchain's storage constraints into benefits for resource-limited vehicular networks requiring real-time data modifications.

Blockchain technology, known for its decentralized and tamper-resistant nature, offers strong auditing guarantees across a wide range of applications. However, its inherent immutability presents challenges when correcting erroneous transactions or removing sensitive information is necessary. To address this, the concept of redactable blockchain has emerged, aiming to improve adaptability to real-world regulatory and operational needs. Yet, existing designs often suffer from limitations in decentralization, security, or efficiency. This paper introduces an Enhanced Threshold Chameleon Hash (ETCH) scheme as a foundational building block for redactable blockchains. ETCH enables redactions only when a predefined threshold of nodes collaborates to generate trapdoor shares, preserving decentralization. It also enhances collision resistance, overcoming key security flaws in prior schemes, and incorporates a periodic trapdoor refresh mechanism to improve long-term robustness. Experimental results show that ETCH reduces computational overhead by 50% in Hash and Verify phases and by 22.26% in the Adapt phase. The prototype implementation of the ETCH-based redactable blockchain further confirms ETCH's effectiveness in supporting low-latency redactions and mitigating blockchain state growth. Overall, ETCH improves both the security and efficiency of redactable blockchains, broadening their applicability in privacy-sensitive and regulated scenarios.

The advancement of quantum computing threatens traditional public-key cryptographic systems, prompting the development of post-quantum cryptography (PQC). As part of the NIST PQC standardization process, code-based cryptographic schemes have gained attention due to their strong security foundations and longstanding resistance to both classical and quantum attacks. CROSS is a code-based digital signature scheme that relies on the hardness of decoding restricted vectors. It is designed to offer a flexible trade-off between signature size and speed performance, making it a promising candidate for post-quantum cryptography. This work introduces a faster modular reduction method for the pseudo-Mersenne prime in CROSS, significantly improving modular arithmetic efficiency. The proposed method is also applicable to other primes of similar structure. In addition, we present vectorized implementations of key operations. Matrix-vector multiplication is vectorized with parameter-specific strategies, and the processing of tree structures in CROSS is optimized using batch hashing methods adapted to the Neon extension. This paper presents the first vectorized implementation of the CROSS digital signature scheme on the ARMv8-A architecture, leveraging the Neon extension for optimized performance. The implementation is evaluated on both ARM Cortex-A72 and Apple M3 processors, achieving up to 63.3% speedup in signature generation and 56.3% in verification, demonstrating significant performance improvements over the reference implementation. These results highlight the potential of CROSS for efficient post-quantum cryptography on ARMv8-A architecture.

With the rapid development of quantum computing technology, blockchain systems based on traditional digital signature algorithms (such as elliptic curve digital signatures) face potential security risks. To construct post-quantum-secure blockchains, this paper primarily integrates the lattice-based post-quantum digital signature algorithm Dilithium-Prime into a UTXO model blockchain system. Given that the Dilithium-Prime algorithm faces challenges such as large storage overhead and lack of key derivation capabilities while ensuring post-quantum security, this paper proposes targeted solutions: innovatively designing UTXO_PUBKEY transaction data structures, separating public key storage from transaction execution logic, and introducing Pubkey-type UTXOs to reuse public key resources; simultaneously optimizing private key storage strategies by using dynamic seeds as temporary private keys to reduce long-term storage pressure on user nodes. This paper provides optimization ideas and directions for the efficient application of lattice-based signature schemes in UTXO-type blockchains, which has important theoretical and practical value for promoting the development of post-quantum blockchain systems.

In this paper, we propose a new structure for the SQIsign family: Pentagon Isogeny-based Signature in High Dimension (referred to as PIsignHD). The new structure separates the hash of the commitment and that of the message by employing two cryptographic hash functions. This feature is desirable in reality, particularly for applications based on mobile low-power devices or for those deployed interactively over the Internet or in the cloud computing setting. This structure can be generally applied to all SQIsign variants. In this work, we focus on the instance based on SQIsignHD. Compared with SQIsignHD, PIsignHD has the same signature size (even smaller for some application scenarios). For the NIST-I security level, the signature size of PIsignHD can be reduced to 519 bits, while the SQIsignHD signature takes 870 bits. Additionally, PIsignHD has an efficient online signing process and enjoys much desirable application flexibility. In our experiments, the online signing process of PIsignHD runs in 4 ms.

Recent work by Houben (Asiacrypt’25) introduced a new formulation for class group actions on supersingular elliptic curves oriented by an imaginary quadratic order for an arbitrarily large discriminant. The algorithm is not only constant-time but also fully deterministic, dummy-free, and branch-free. As a result, it gives the fastest isogeny-based non-interactive key exchange (NIKE) in theory, referred to as OSIDHLD in this paper. However, the current proof-of-concept SageMath implementation remains substantially slower than mainstream post-quantum key-exchange candidates. In this paper, we develop an efficient implementation of OSIDH-LD with several approaches. First, we provide algorithmic-level optimizations: (i) we develop the "tail pruning" approach such that key agreement avoids redundant orientation updates. This optimization maintains the fully deterministic and dummy-free feature of OSIDHLD; (ii) we adapt a faster codomain isomorphism identification adapted from the technique used in the SQIsign implementations; and (iii) we present effective isogenycomputation strategies tailored to the cost profile of OSIDH-LD. Second, we adapt the parallelism technique. We apply the fork-join parallel execution model to optimize the class group action performance, and achieve a near perfect parallelism in key generation, and a better performance in key agreement. We provide two kinds of implementations to show the impacts of our improvements. The first one is in C with assembly language for field arithmetic, which verifies the correctness of our optimization techniques targeting OSIDH-LD. The experimental results show that our techniques lead to an overall 1.56x and 1.87x acceleration for key generation and key agreement, respectively. Second, we provide parallel implementations that exploit multi-threads and AVX-512 vector extensions, respectively, by batching independent subroutines in the class group action. In particular, the AVX-512 vectorized implementation is 4.97x faster than the improved C+assembly implementation in key generation, which is close to the theoretical optimum.

TLS 1.3 is at the heart of secure modern internet communications. With the rise of quantum attacks, post-quantum TLS 1.3, built on post-quantum key encapsulation mechanisms (KEMs), has naturally become a major research focus. At Eurocrypt 2022, Huguenin-Dumittan and Vaudenay demonstrated that KEMs secure against chosen-plaintext attacks (CPA) are sufficient to construct a secure TLS 1.3 handshake in the random oracle model (ROM), but their security reduction incurs an 𝒪(q^6) loss, where q is the number of random oracle queries. Improving their security bounds was left as an open problem. To address this problem, Zhou et al. took the first step at Asiacrypt 2024, improving the loss factor to 𝒪(q^2) in the ROM and 𝒪(q^4) in the quantum ROM (QROM) for OW-CPA secure KEMs, and to 𝒪(q) (ROM) and 𝒪(q^2) (QROM) for IND-CPA secure KEMs. In this work, we advance the state-of-the-art by providing tighter security reductions for TLS 1.3 handshake based on CPA-secure KEMs. We introduce a new security notion, IND-1CCA-1MAC, and show that with a slight ciphertext expansion, the reduction losses can be significantly improved to 𝒪(q) (ROM) and 𝒪(q^2) (QROM) for OW-CPA secure KEMs, and to only 𝒪(1) in both models for IND-CPA secure KEMs. Moreover, we prove that without additional modifications such as ciphertext expansion, the loss of 𝒪(q) (ROM) and 𝒪(q^2) (QROM) is unavoidable. Finally, we analyze the security of TLS 1.3 from CPA-secure KEMs in the hybrid key exchange setting, and provide experimental evidence that ciphertext expansion is a practical trade-off for mitigating reduction losses.

The rapid advancement of quantum computing has ushered in a new era of post-quantum cryptography, urgently demanding quantum-resistant digital signatures to secure modern communications and transactions. Among NIST-standardized candidates, Falcon stands out because it is a compact lattice-based signature scheme suitable for size-sensitive applications. In this paper, we present cuFalcon, a high-throughput GPU implementation of Falcon that addresses its computational bottlenecks through adaptive parallel strategies. At the operational level, we optimize Falcon key components for GPU architectures through memory-efficient FFT, adaptive parallel ffSampling, and a compact computation mode. For signature-level optimization, to improve scalability across different GPU architectures, we implement three versions of cuFalcon: the raw key version, the expanded key version, and the balanced version. Additionally, we design batch processing, streaming mechanisms, and memory pooling to handle multiple signature tasks efficiently. Ultimately, performance evaluations show significant improvements, with the raw key version achieving 172 k signatures per second and the expanded key version reaching 201 k. Compared to the raw key version, the balanced version achieves a 7% improvement in throughput, while compared to the expanded key version, it reduces memory usage by 70%. Furthermore, our raw key version implementation outperforms the reference implementation by 36.74 & times; and achieves a 2.71 & times; speedup over the state-of-the-art GPU implementation.

Sign-then-encrypt is a classical composition method of public-key encryption (PKE) and signatures. It is also viewed as a generic construction of signcryption scheme, a primitive that provides confidentiality and authenticity simultaneously. In this work, we study how to sign-then-encrypt with CPA-to-CCA security enhancement and shorter ciphertext.Our first step is to combine sign-then-encrypt with the Fujisaki-Okamoto (FO) transformation. The FO transformation is a useful technique to construct CCA-secure PKE from CPA-secure schemes in the random oracle model (ROM). Some extra randomness should be encrypted in the FO transformation. We show that when combined with sign-then-encrypt, we can realize “free” FO transformation by replacing the encrypted randomness in the FO transformation with a high-entropy signature. Then we give another construction based on a variant of the FO transformation, requiring a CPA-secure key encapsulation mechanism (KEM) instead of PKE.Our second step is to further compress the ciphertext, focusing on signatures from the Fiat-Shamir transformation. We use the challenge part of the signature as the random coins used in the KEM, for which we call our general construction “Encrypt-with-Challenge”. Requiring some joint properties between the signature scheme and the KEM, the symmetric key or the key encapsulation can replace the challenge in the signature. We thus further remove the encrypted challenge from the ciphertext.Finally, we give instantiations of Encrypt-with-Challenge. Our ElGamal-based construction has comparable ciphertext size with existing signcryption schemes and is the first to achieve CCA security from standard CDH assumption.

CRYSTALS-Dilithium is a lattice-based signature scheme to be standardized by NIST as the primary post-quantum signature algorithm. In this work, we make a thorough study of optimizing the implementations of Dilithium by utilizing the Advanced Vector Extension (AVX) instructions, specifically AVX2 and the latest AVX-512. We first present an improved parallel small polynomial multiplication with tailored early evaluation (PSPM-TEE) to further speed up the signing procedure. Our PSPM algorithm outperform the NTT by 47%-66% in AVX2 and AVX-512 implementation. We then present a tailored reduction method that is simpler and faster than Montgomery reduction. We minimize the CPU cycles of tailored reduction AVX-512 implementation by using AVX-512IFMA. Finally, we propose a fully and highly vectorized implementation of Dilithium using AVX-512. This is achieved by carefully vectorizing most of Dilithium functions with the AVX-512 instructions in order to improve efficiency both for time and for space simultaneously. With all the optimization efforts, our AVX-512 implementation improves the performance by 43.2%/39.3%/45.6% in key generation, 36.6%/41.6%/43.7% in signing, and 45.3%/46.5%/47.4% in verification for the parameter sets of Dilithium2/3/5 respectively. To the best of our knowledge, our AVX-512 implementation has the best performance for Dilithium on the Intel x86-64 CPU platform to date.

The rapid development of quantum computing would pose a threat to traditional public-key cryptography. Post-quantum cryptography has gained significant attention to address this threat, with lattice-based schemes playing a central role. This paper focuses on CTRU [21], an NTRU-based key encapsulation mechanism (KEM), which is now in the standardization process in China. CTRU is the first NTRU scheme with ciphertext compression, high efficiency in both computation and bandwidth, security stronger than that of R, MLWE-based KEMs, and versatile choices in parameters and underlying algebraic structures. However, efficiently implementing CTRU on embedded platforms such as the ARM Cortex-M4 remains challenging due to its costly polynomial operations and the limited computational resources available. This work presents the first optimized implementation of the complete parameter sets of CTRU on the Cortex-M4, enhancing the efficiency of post-quantum cryptography in resource-constrained environments. The main contributions include: The experimental results show that CTRU-768 achieves speedups of 60.07

In this work, we make systematic optimizations of key encapsulation mechanisms based on Module Learning-with-Errors, covering algorithmic design, fundamental operation of the Number Theoretic Transform (NTT), approaches to expanding the encapsulated key size, and AVX2/ARM implementations. We observe that decryption can be simplified, leading to a both faster and less error-prone decryption process. Based on a systematic study of variants of NTT, we present a new variant named hybrid-NTT that combines the advantages of existing NTT methods, and derive its optimality in computational complexity. We analyze and compare the different approaches to expand the size of the key to be encapsulated and conclude with the most economic approach. Each above optimization technique is of independent value, and we apply all of them to KYBER and Aigis, resulting in new scheme variants named OSKR and OKAI, respectively. For all new schemes proposed in this work, we provide optimized AVX2 and ARM Cortex-M4 implementations and present the performance benchmarks. Our AVX2 implementation provides up to 19.7% and 26.4% speedups compared with KYBER and Aigis, respectively. Meanwhile, with our new parameter set and optimization techniques, we show up to a 17% improvement compared with KYBER on the ARM Cortex-M4 platform.