Abstracts

The year 2026 marks exactly 50 years since the publication of the fundamental article by Diffie and Hellman, which marked the beginning of a new era in the development of cryptography in general and of such a class of protocols as authenticated key establishment protocols. Since then, several hundred different protocols have been proposed, with different properties and based on different cryptographic primitives. The report will describe a large overview of well-known AKE protocols and the general approach developed by the authors to their uniform description. It will also provide a systematic overview of the adversary's capabilities and threats that were considered during the cryptographic analysis of such protocols. In conclusion, attacks using some of the adversary's non-standard capabilities on a number of classic and fairly new protocols, in particular, on the SIGMA family protocols, will be described.

Post-Quantum Cryptography (PQC) is widely recognized as the primary solution against quantum attacks on classical public-key cryptography. Significant efforts are currently focused on migrating systems from RSA and ECC to standardized PQC algorithms. However, replacing cryptographic algorithms does not automatically guarantee long-term security. Many critical systems must remain trustworthy for several decades, during which cryptographic standards, trust anchors, regulations, and operational infrastructures will inevitably evolve. This talk revisits the concept of long-term security beyond the traditional PQC migration narrative. Using remote signing systems as a representative case study, we examine challenges associated with long-term verification, timestamp preservation, certificate lifecycle management, archival validation, and trust continuity across multiple generations of cryptographic transitions. We argue that cryptographic agility is a necessary but insufficient condition for long-term security. The ultimate challenge is maintaining verifiable trust despite continual technological and organizational change. We discuss future research directions toward trust lifecycle management in the post-PQC era.

A group signature scheme enables users of a group to anonymously sign messages on behalf of the group, while a designated authority can revoke anonymity when needed to ensure user accountability. In this talk, I present a post-quantum fully dynamic group signature scheme, called DGSP, built from only symmetric encryption and hash functions. DGSP achieves the following: (i) the set-up time is effectively constant in the number of signatures that may be issued, with support for up to 2⁶⁴ signatures; (ii) the tracing algorithm run by the authority has constant runtime in the number of users; (iii) the set of users is fully dynamic and users can be revoked or added as needed without system-wide updates; and (iv) forward anonymity, where if a user’s secrets are compromised they cannot be used to de-anonymize previous signatures. DGSP is the first group signature based only on symmetric primitives to achieve all of these properties: the previous state-of-the-art in this area is SPHINX-in-the-Head (SITH), which does not achieve (ii) or (iv), and DGMT, which does not achieve (i) and may not achieve (iv). Like DGMT, but unlike SITH, DGSP is stateful, and users must refresh a local storage of “certificates” to issue new signatures. DGSP signatures are roughly 5× larger than DGMT but nearly 100× smaller than SITH, and all basic operations run in under 2 milliseconds. We prove security in the standard model under standard assumptions for symmetric primitives. DGSP is a compelling solution for applications requiring large-scale user support, efficient operations, and conservative post-quantum security.

Crypto agility implies that different cryptographic primitives can be substituted within a protocol. The presentation discusses the requirements that cryptanalysis of these primitives must meet. It concludes that true crypto agility requires automated cryptanalysis – an approach that is reproducible, verifiable, and clearly defines its scope of applicability.

The report addresses the combinatorial-geometric problem of partitioning finite-dimensional vector spaces over a finite field into disjoint affine subspaces of a given dimension. We investigate structural properties of such partitions, including estimates of their total number, efficient construction algorithms based on linear transformations and recursive schemes, as well as the problem of efficient generation and enumeration for exhaustive search and classification purposes. Special attention is paid to additional constraints, such as pairwise orthogonality of the direction subspaces and the absence of vectors orthogonal to a large number of affine subspaces in the partition. Cryptographic applications are discussed: we show how specially designed partitions can be used to construct bent functions (maximally nonlinear Boolean functions); ideas for constructing cryptographically strong S‑boxes for symmetric ciphers are presented. We also propose approaches to evaluating resistance to differential and linear cryptanalysis and the impact of the partition structure on computational implementation complexity, thus outlining ways to optimize the trade‑off between performance and security.

The McEliece cryptosystem, introduced in 1978 and based on binary Goppa codes, is the oldest public-key encryption scheme still considered secure against quantum attacks. Its remarkable longevity rests in part on the apparent difficulty of distinguishing a McEliece public key from a random linear code. In this talk, I will describe a simple classical quasipolynomial-time distinguisher for Goppa-McEliece in the asymptotic regime underlying Classic McEliece. For code length n, the algorithm runs in time n^{O(log n)} and distinguishes a McEliece public key from a uniformly random binary linear code with advantage 1-o(1). The attack is not purely asymptotic: it applies to all Classic McEliece parameter sets considered in the NIST process and gives improved, although still far from practical, concrete attack estimates. Interestingly, the attack arose from an unsuccessful attempt to construct doubly efficient private information retrieval (PIR) schemes from algebraic locally decodable codes. I will explain the distinguisher through this PIR perspective, which gives a relatively intuitive view of the structure being exploited. Finally, I will discuss heuristic extensions of the distinguisher to quasipolynomial-time ciphertext decryption and key recovery. The key-recovery attack, in particular, remains structurally close to the distinguisher and may have implications for concrete security estimates of Classic McEliece. This is joint work with Yuval Ishai, Aayush Jain and Nuozhou Sun.

The McEliece cryptosystem, built on binary Goppa codes, is the oldest public-key scheme to have resisted both classical and quantum cryptanalysis. Ghoshal, Ishai, Jain and Sun recently gave an efficient quasipolynomial-time distinguisher separating Goppa codes from random ones. In this talk we describe two key-recovery attacks arising from that distinguisher. Both proceed through the derivative spaces of the hidden curve underlying the public code. The first reconstructs the curve from deep osculating flags, computed order by order at a few positions. The second is less complex, it uses the first-order spaces to build a tangent minor code —which turns out to be a full GRS code, to which the Sidelnikov–Shestakov attack applies directly. Both routes were verified end to end on Goppa codes over GF(4). Direct verification for binary Goppa codes is out of computational reach, but we present some supporting evidence. On the Classic McEliece parameter sets the estimated cost falls far below the claimed security levels, so under the stated conditions the scheme should be considered broken. Note that concurrently and independently, a later update of the work of Ghoshal et al. gives a different key recovery, reading the support off cross-ratios of the top-order interpolation coefficients.

In this talk, we will present the recent progress in Algebraic Attacks on UOV family of cryptosystems including the alternative algebra attack, symmetric algebra attacks and other new attacks. We will explain the details of the attacks and the related problems.

We propose a new approach in cryptanalysis based on an evolution of the concept of Combinatorial Equivalence. The aim is to rewrite a cryptosystem under a combinatorially equivalent form in order to make appear new properties that are more strongly discriminating the secret key used during encryption. We successfully applied this approach to the most secure stream ciphers category nowadays. We first define a concept cipher called Cipherbent6 that capture most of the difficulty of stream cipher cryptanalysis. We significantly outperformed all known cryptanalysis. We applied this approach to the Achterbahn cipher and we obtained again far better cryptanalysis results.

We consider the sequence of random finite-state automata ℵ_n(X, Q_n, Y, F_n, Φ_n) with finite input X and output Y alphabets, a growing number |Q_n| = n of internal states and functions of the output and state transition f_n,t, φ_n,t in each clock cycle t of the automata selected randomly from the sets of functions F_n and Φ_n. The possibility of asymptotic local inversion of the automaton ℵ_n is proved. Namely, the value x_n,t of the input sequence {x_n,t}_t=1^T of the automata at the moment t, as T, t, n → ∞ so that √n = o(min(t, T−t)), with a probability of at least 1/3 can be reconstructed from the known output sequence {y_n,t}_t=1^T and the known sequences of functions {φ_n,t}_t=1^T and {f_n,t}_t=1^T.

1. Determining those Boolean functions whose restrictions to affine spaces are plateaued (common work with Darrion Thornburgh) Quadratic Boolean functions (that is, Boolean functions of algebraic degree at most 2), bent Boolean functions (i.e. maximally nonlinear Boolean functions in even numbers of variables) and, as we shall show, partially-bent Boolean functions (i.e. affine extensions of bent functions to linear super-spaces), share a strong property: all their restrictions to affine hyperplanes are plateaued (i.e. have a Walsh transform valued in a set of the form {0, ±λ}, where λ is a positive integer called the amplitude). We determine for any n and k < n the class Cⁿ_k of those n-variable Boolean functions whose restrictions to all k-dimensional affine subspaces of 𝔽₂ⁿ are plateaued (of any amplitude). We characterize partially-bent (resp., quadratic) Boolean functions as those functions that are plateaued on any affine hyperplane (resp., any affine subspace of dimension k, where 3 ≤ k ≤ n−2, while these are all Boolean functions for 0 ≤ k ≤ 2). This provides a new characterization of partially-bent functions and a hierarchy among n-variable Boolean functions by six nested classes, each of which happens to be, for any n ≥ 5, strictly included in the next one: quadratic functions, partially-bent functions, the restrictions of (n+1)-variable partially-bent functions to 𝔽₂ⁿ, plateaued functions, the restrictions of (n+1)-variable plateaued functions to 𝔽₂ⁿ, and all Boolean functions. We leave open the two problems of determining exactly what are the third and fifth of these classes, but we begin the study of the first of these two classes by characterizing the situation where a plateaued function g has a restriction f to an affine hyperplane H that is plateaued. We also characterize when g is partially-bent. Our characterization of partially-bent (resp., quadratic) functions extends to strongly plateaued vectorial functions. We state an open question on vectorial functions that happens to be related to an important one on crooked functions. 2. A notion on S-boxes for a partial resistance to some integral attacks Recently, the notion of kth-order sum-freedom of a vectorial function F: 𝔽₂ⁿ → 𝔽₂^m has been introduced, generalizing that of almost perfect nonlinearity (which corresponds to k = 2) and having some relation to resistance against integral attacks on block ciphers, by preventing the propagation of the division property of k-dimensional affine spaces. We shall show that this notion, which is rarely satisfied by vectorial functions, can be weakened while retaining the same behavior with respect to the division property. This leads us to the notion of kth-order t-degree-sum-freedom, whose strength decreases as t increases, and which coincides with kth-order sum-freedom when t = 1: for every k-dimensional affine space A, there exists a non-negative integer j of 2-weight at most t such that ∑_{x ∈ A} (F(x))^j ≠ 0, where F(x) is viewed in the field 𝔽₂^m. We show that t can always be taken smaller than or equal to min(k, m) under some ``reasonable'' condition on F (satisfied in particular by all injective functions). This makes the new notion more interesting theoretically and practically than sum-freedom (which is an all-or-nothing notion and which in practice disqualifies almost all functions). The parameter t in the new notion quantifies more precisely the behavior of any ``reasonable'' function. A quality of this parameter is its simplicity. We also show that t is greater than or equal to k / deg(F), where deg(F) is the algebraic degree of F, and we derive two other lower bounds. We study power functions, for which we prove upper bounds. Among them, we study the multiplicative inverse function (used as an S-box in the AES), for which we characterize the kth-order t-degree-sum-freedom by the coefficients of the subspace polynomials of k-dimensional vector subspaces (deducing the exact minimal value of t when k divides n) and we prove that its kth-order t-degree-sum-freedom is equivalent to its (n−k)th-order t-degree-sum-freedom.

In an authenticated encryption scheme, a signer signs a message for a particular verifier using signer's own private key and the public key of the verifier. The verifier recovers the original message from the signcrypted message using the signer's public key and the verifier's own private key. Significant work is done in this direction by the authors Zheng and others. In this presentation, I will first describe an authenticated encryption scheme for signing messages of fixed block length, based on a variant of the ElGamal encryption scheme. I will then discuss a variant of the ElGamal signature scheme over large prime moduli. Finally, I will present another authenticated encryption scheme that can be adapted to generate signatures for messages of arbitrary length.

Crypto agility depends on separating the functionality required by a protocol from the cryptographic primitives used to provide it. Threshold homomorphic encryption has traditionally been designed in a tightly coupled manner: a homomorphic encryption scheme is combined directly with secret sharing, and improvements in efficiency often introduce restrictions on the message space, threshold choice, or availability of participants. This talk presents a modular design approach to resolve this efficiency-utility dilemma. The approach introduces two modular interfaces. The message-space adapter (MeSA) separates message-space compatibility from threshold encryption, while approximate secret sharing (ApproxSS) captures the noisy recovery required by threshold FHE. Instantiating these interfaces with lattice-based encryption and encrypted shares yields schemes with low complexity, flexible threshold choices, and dynamic participants. Prototypes tested with up to one thousand parties demonstrate their practical scalability. More broadly, these results show how cryptographic bottlenecks can be isolated behind stable interfaces, allowing individual components to evolve without redesigning the complete protocol.

Currently, Quantum Key Distribution (QKD) networks are being actively deployed by various research groups and commercial companies worldwide. As a result, a fragmented infrastructure is emerging: a multitude of isolated "islands" of quantum communication segments that often overlap geographically but lack technological interoperability. There is an urgent need to transition from local networks to a global Quantum Key Distribution Internetwork. However, integrating heterogeneous networks into a unified ecosystem raises several fundamental security challenges, which are the focus of this report. During the generation and distribution of keys for users connected to different segments, the transmission of sensitive cryptographic material through the nodes of various segments is inevitable. This work examines various architectures and operational scenarios for the Quantum Key Distribution Internetwork, investigating the cryptographic properties of the keys obtained in each case.

We consider true random number generators whose source of randomness is a physical process that can be modeled using renewal process theory. Randomness is extracted by counting renewal events in equal-length time intervals and reducing each count modulo a prescribed integer. For such generators, we derive a bound on the deviation of the output distribution from uniformity. This bound can be used to assess the practical security of cryptographic keys generated by such random number generators.

The report presents an analysis of the GOST 28147-89, Magma, SIMON, and SPECK algorithms using the invariant subspace method. The impact of the ADD, AND, and ROTATE operations on various classes of subspaces is studied. The influence of the choice of S-boxes (for the GOST 28147-89 and Magma algorithms) and round constants (for the SIMON and SPECK algorithms) on the feasibility of the attack is demonstrated.

We present the survey of recent results and advances in post-quantum cryptography and quantum computing. Further, we discuss these results’ impact and effect on symmetric cryptographic schemes and their security in Q1 and Q2 models classes. The present research is a continuation of our work presented at AgileCrypto’25 about quantum cryptographic analysis of several block cipher modes of operation.

Given the growing quantum threat to classical public-key cryptography, it is essential to develop post-quantum alternatives, as well as methods to enhance their long-term security. Regarding lattice-based KEMs, сurrent standardization efforts favor MLWE-type schemes (notably, ML-KEM), while NTRU-like schemes offer their own advantages, including competitive parameter sizes (such as shorter ciphertexts, which is important when channel rates are limited) and a longer history of cryptanalytic study. In this context, we propose Nasturtium (rus. Настурция), an NTRU-like public-key encryption scheme and associated KEM that uses an NTT-compatible (trinomial cyclotomic) ring and some tweaks to accelerate core routines. We outline the design rationale and parameter selection for target security level of 128/256 bits, and show that the scheme achieves comparable (or slightly better) security, speed and bandwidth characteristics than other lattice-based schemes. The construction also offers an extended KEM interface that accepts optional information (e.g., a session transcript) to bind the derived key to that context, which could be useful in certain protocols. To increase flexibility and provide additional security, we further study hybridization of the scheme with a classic ECDH-like mechanism. The basic and hybrid schemes could be tuned to target different security properties (CPA or CCA), enabling higher performance (by omitting hashing in KEM) in scenarios where CPA security suffices (such as ephemeral-keys TLS with mutually authenticated peers) while retaining stronger guarantees when CCA security is required (such as static keys or stronger adversarial models are involved).

We will give an overview of the activities in the IETF/IRTF Crypto Forum Research Group (CFRG) in two focus areas: post-quantum KEMs and KEM combiners.

The construction of Boolean functions with good cryptographic properties over subsets of vectors with fixed Hamming weight is significant for lightweight stream ciphers like FLIP. We will introduce a general construction for a class of Weightwise Almost Perfectly Balanced (WAPB) Boolean functions, based on the action of a cyclic permutation group on F^n_2. This class generalizes the Weightwise Perfectly Balanced (WPB) n = 2^m -variable Boolean function construction by Liu and Mesnager to any n. We derive theoretical bounds on nonlinearity and weightwise nonlinearity, focusing on two permutation groups, ⟨\psi⟩ and ⟨\sigma⟩where \psi is a binary-cycle permutation and \sigma is a rotation. Beyond theoretical analysis of nonlinearity and weightwise nonlinearity, our experimental study for n ≤ 4 ≤ 20 examines nonlinearity, weightwise nonlinearity, algebraic immunity, and weightwise algebraic immunity for these classes of functions. The results confirm that the proposed WAPB functions achieve high values across these important cryptographic parameters, demonstrating their practical relevance for cryptographic designs that require balancedness across fixed-weight slices.

The migration to post-quantum cryptography (PQC) has brought cryptographic agility into sharp focus: secure systems must be able to change the algorithms on which they depend. Unlike earlier transitions centred on a particular algorithm or standard, PQC migration affects cryptographic mechanisms across many protocols and applications. Even identifying where those mechanisms are used can be a substantial undertaking. This talk uses DNSSEC as a case study to show why PQC migration is more than an algorithm replacement. We will examine the challenges of deploying post-quantum signatures in DNSSEC and discuss recent research addressing them, including our own proposals.