International Association
for Cryptologic Research

Event date: 6 March to 7 March 2025

Event date: 19 August to 20 August 2025
Submission deadline: 17 April 2025
Notification: 19 June 2025

Event date: to
Submission deadline: 15 March 2025
Notification: 30 June 2025

Event date: 1 October 2025
Submission deadline: 28 April 2025
Notification: 1 July 2025

Event date: 2 June to 5 June 2025

Event date: 16 March 2025

Your Working Environment

The Chair of Hardware/Software Co-Design at FAU explores methodologies for designing and optimizing computing systems with high demands on availability, performance, and security.

Project Description

Ensuring security in IoT systems, particularly confidentiality and integrity of data and application code, is a major challenge. While hardware security, crypto modules, secure boot, and trusted execution environments offer protection, they often increase costs and energy consumption.

This position focuses on system-level design automation for secure embedded systems-on-chip. The goal is to develop a methodology for design space exploration that generates secure architectures and evaluates countermeasures' impact on security, energy, cost, and performance. Additionally, the research includes high-level synthesis techniques to implement secure design candidates as FPGA-based system-on-chip prototypes.

Your Tasks and Opportunities

• Conduct research in embedded computer architectures and hardware security.
• Explore security-aware hardware/software co-design, system-level design space exploration, and multi-objective optimization.
• Apply high-level synthesis techniques to integrate security mechanisms into SoC designs and prototype them on FPGA platforms.

Your Profile

• Master’s degree in Computer Science, Electrical Engineering, or a related field.
• Skills and interest in computer architecture, hardware security, system-level design automation, object-oriented programming, hardware description languages, SoC design, RISC-V, or FPGA tools.
• Team-oriented, open-minded, and communicative, with an interest in both theoretical and practical aspects of embedded systems.
• High proficiency in English (German is a plus).

Closing date for applications:

Contact: Jürgen Teich ([email protected]), Stefan Wildermann ([email protected])

Event date: 24 June 2025
Submission deadline: 21 March 2025
Notification: 22 April 2025

The Department of Combinatorics and Optimization at the University of Waterloo invites applications from qualified candidates for 2-year postdoctoral fellowship appointments in post-quantum cryptography under the supervision of Prof. David Jao, Prof. Michele Mosca, and Prof. Douglas Stebila.

A Ph.D. degree and evidence of excellence in research are required. Successful applicants are expected to maintain an active program of research, and participate in research activities with academic and industry partners in the grant. The annual salary is 70,000 CAD. In addition, a travel fund of 3,000 CAD per year is provided. The positions are available immediately.

Interested individuals should apply using the MathJobs site (https://www.mathjobs.org/jobs/list/26357/). Applications should include a cover letter describing their interest in the position, a curriculum vitae and research statement and at least three reference letters.

The University of Waterloo acknowledges that much of our work takes place on the traditional territory of the Neutral, Anishinaabeg and Haudenosaunee peoples. Our main campus is situated on the Haldimand Tract, the land granted to the Six Nations that includes six miles on each side of the Grand River. Our active work toward reconciliation takes place across our campuses through research, learning, teaching, and community building, and is centralized within our Indigenous Initiatives Office.

The University regards equity and diversity as an integral part of academic excellence and is committed to accessibility for all employees. We encourage applications from candidates who have been historically disadvantaged and marginalized, including applicants who identify as Indigenous peoples (e.g., First Nations, Métis, Inuit/Inuk), Black, racialized, people with disabilities, women and/or 2SLGBTQ+. If you have any application, interview or workplace accommodation requests, please contact Carol Seely-Morrison ([email protected]).

All qualified candidates are encouraged to apply; however, Canadians and permanent residents will be given priority.

Closing date for applications:

Contact: Douglas Stebila ([email protected])

More information: https://www.mathjobs.org/jobs/list/26357

As part of a collaborative project on data protection, we are recruiting a PhD student to carry out research on advanced cryptography (e.g. homomorphic encryption, multiparty computation). Candidates should have a strong background in cryptography. The thesis must be completed by the end of December 2025.

Closing date for applications:

Contact: Sébastien Canard ([email protected]), Qingju Wang ([email protected])

We are inviting applications for PhD student scholarships in the School of Computer Science, Faculty of Science, Queensland University of Technology (QUT). Students who are interested in cryptographic applications of algebraic curves are encouraged to apply to work on one of the following two areas:

- Isogeny-based post-quantum cryptography
- Constructive and computational aspects of zk-SNARKs

Applicants should have a strong background in mathematics and/or computer science and be highly motivated for research work with a demonstrated ability to work independently. Applications (cover letter, CV, transcripts, contacts for references) can be emailed to Craig Costello with "PhD applicant - YOUR NAME" in the subject. Applications will be processed continuously until the positions are filled.

Closing date for applications:

Contact: [email protected]

Since this position requires Swedish citizenship, the below description of the position is available in Swedish only.

Centrum för cyberförsvar och informationssäkerhet (CDIS) vid KTH — som är ett samarbete mellan KTH och Försvarsmakten, samt vissa andra myndigheter — söker doktorander. Det rör sig om en bred utlysning inom cybersäkerhetsområdet. Vi vill här särskilt peka ut en möjlig specialisering inom kryptologiområdet.

Mer specifikt har KTH i samarbete med avdelningen för krypto och IT-säkerhet vid Must pågående spetsforskning som syftar till att möta de utmaningar som följer av kvantdatorutvecklingen. Vi söker nu inom ramen för CDIS utlysning en doktorand som kan bidra till den forskningen.

Doktoranden kommer att handledas av Johan Håstad och/eller Douglas Wikström. Forskningssatsningen omfattar även Martin Ekerå och Joel Gärtner. Vid intresse, sök en av de av CDIS utlysta doktorandtjänsterna.

Tjänsten kommer att omfatta 80% doktorandstudier vid KTH och 20% placering vid Must där möjlighet ges att arbeta med några av Sveriges främsta kryptologer. Resultatet för doktoranden blir en unik kombination av teori och praktik inom kryptologiområdet.

För ytterligare information, kontakta Johan Håstad ([email protected]) eller Martin Ekerå ([email protected]).

Sista ansökningsdag är den 13 mars 2025. Observera att svenskt medborgarskap är ett krav för tjänsten, och att tjänsten medför krav på säkerhetsprövning.

Closing date for applications:

Contact: For more information about the position, please contact Johan Håstad ([email protected]) or Martin Ekerå ([email protected]).

More information: https://kth.varbi.com/se/what:job/jobID:790985

In this work, we consider the setting where the process of securely evaluating a multi-party functionality is divided into two phases: offline (or preprocessing) and online. The offline phase is independent of the parties’ inputs, whereas the online phase does require the knowledge of the inputs. We consider the problem of minimizing the round of communication required in the online phase and propose a round preserving compiler that can turn a big class of multi-party computation (MPC) protocols into protocols in which only the last two rounds are input-dependent. Our compiler can be applied to a big class of MPC protocols, and in particular to all existing round-optimal MPC protocols. All our results assume no setup and are proven in the dishonest majority setting with black-box simulation. As part of our contribution, we propose a new definition we call Multi-Party Computation with Adaptive-Input Selection, which allows the distinguisher to craft the inputs the honest parties should use during the online phase, adaptively on the offline phase. This new definition is needed to argue that not only are the messages of the offline phase input-independent but also that security holds even in the stronger (and realistic) adversarial setting where the inputs may depend on some of the offline-phase protocol messages. We argue that this is the definition that any protocol should satisfy to be securely used while preprocessing part of the rounds. We are the first to study this definition in a setting where there is no setup, and the majority of the parties can be corrupted. Prior definitions have been presented in the Universal Composable framework, which is unfortunately not well suited for our setting (i.e., no setup and dishonest majority). As a corollary, we obtain the first four-round (which is optimal) MPC protocol, where the first two rounds can be preprocessed, and its security holds against adaptive-input selection.

Blind signatures allow a user to obtain a signature from an issuer in a privacy-preserving way: the issuer neither learns the signed message, nor can link the signature to its issuance. The threshold version of blind signatures further splits the secret key among n issuers, and requires the user to obtain at least t ≤ n of signature shares in order to derive the final signature. Security should then hold as long as at most t − 1 issuers are corrupt. Security for blind signatures is expressed through the notion of one-more unforgeability and demands that an adversary must not be able to produce more signatures than what is considered trivial after its interactions with the honest issuer(s). While one-more unforgeability is well understood for the single-issuer setting, the situation is much less clear in the threshold case: due to the blind issuance, counting which interactions can yield a trivial signature is a challenging task. Existing works bypass that challenge by using simplified models that do not fully capture the expectations of the threshold setting. In this work, we study the security of threshold blind signatures, and propose a framework of one-more unforgeability notions where the adversary can corrupt c < t issuers. Our model is generic enough to capture both interactive and non-interactive protocols, and it provides a set of natural properties with increasingly stronger guarantees, giving the issuers gradually more control over how their shares can be combined. As a point of comparison, we reconsider the existing threshold blind signature models and show that their security guarantees are weaker and less clearly comprehensible than they seem. We then re-assess the security of existing threshold blind signature schemes – BLS-based and Snowblind – in our framework, and show how to lift them to provide stronger security.

Non-interactive zero-knowledge (NIZK) arguments allow a prover to convince a verifier about the truthfulness of an NP-statement by sending just one message, without disclosing any additional information. In several practical scenarios, the Fiat-Shamir transform is used to convert an efficient constant-round public-coin honest-verifier zero-knowledge proof system into an efficient NIZK argument system. This approach is provably secure in the random oracle model, crucially requires the programmability of the random oracle and extraction works through rewinds. The works of Lindell [TCC 2015] and Ciampi et al. [TCC 2016] proposed efficient NIZK arguments with non-programmable random oracles along with a programmable common reference string. In this work we show an efficient NIZK argument with straight-line simulation and extraction that relies on features that alone are insufficient to construct NIZK arguments (regardless of efficiency). More specifically we consider the notion of quasi-polynomial time simulation proposed by Pass in [EUROCRYPT 2003] and combine it with simulation and extraction with non-programmable random oracles thus obtaining a NIZK argument of knowledge where neither the zero-knowledge simulator, nor the argument of knowledge extractor needs to program the random oracle. Still, both the simulator and the extractor are straight-line. Our construction uses as a building block a modification of the Fischlin’s transform [CRYPTO 2005] and combines it with the concept of dense puzzles introduced by Baldimtsi et al. [ASIACRYPT 2016]. We also argue that our NIZK argument system inherits the efficiency features of Fischlin’s transform, which represents the main advantage of Fischlin’s protocol over existing schemes.

Falcon is one of post-quantum signature schemes selected by NIST for standardization. With the deployment underway, its implementation security is of great importance. In this work, we focus on the side-channel security of Falcon and our contributions are threefold.

First, by exploiting the symplecticity of NTRU and a recent decoding technique, we dramatically improve the key recovery using power leakages within Falcon Gaussian samplers. Compared to the state of the art (Zhang, Lin, Yu and Wang, EUROCRYPT 2023), the amount of traces required by our attack for a full key recovery is reduced by at least 85%.

Secondly, we present a complete power analysis for two exposed power leakages within Falcon’s integer Gaussian sampler. We identify new sources of these leakages, which have not been identified by previous works, and conduct detailed security evaluations within the reference implementation of Falcon on Chipwhisperer.

Thirdly, we propose effective and easy-to-implement countermeasures against both two leakages to protect the whole Falcon’s integer Gaussian sampler. Configured with our countermeasures, we provide security evaluations on Chipwhisperer and report performance of protected implementation. Experimental results highlight that our countermeasures admit a practical trade-off between effciency and side-channel security.

There is a heavy preference towards instantiating BGV and BFV homomorphic encryption schemes where the cyclotomic order $m$ is a power of two, as this admits highly efficient fast Fourier transformations. Field Instruction Multiple Data (FIMD) was introduced to increase packing capacity in the case of small primes and improve amortised performance, using reverse multiplication-friendly embeddings (RMFEs) to encode more data into each SIMD slot. However, FIMD currently does not admit bootstrapping.

In this work, we achieve bootstrapping for RMFE-packed ciphertexts with low capacity loss. We first adapt the digit extraction algorithm to work over RMFE-packed ciphertexts, by applying the recode map after every evaluation of the lifting polynomial. This allows us to follow the blueprint of thin bootstrapping, performing digit extraction on a single ciphertext. To achieve the low capacity loss, we introduce correction maps to the Halevi-Shoup digit extraction algorithm, to remove all but the final recode of RMFE digit extraction.

We implement several workflows for bootstrapping RMFE-packed ciphertexts in HElib, and benchmark them against thin bootstrapping for $m=32768$. Our experiments show that the basic strategy of recoding multiple times in digit extraction yield better data packing, but result in very low remaining capacity and latencies of up to hundreds of seconds. On the other hand, using correction maps gives up to $6$ additional multiplicative depth and brings latencies often below $10$ seconds, at the cost of lower packing capacity.

We study efficient public randomness generation protocols in the PASSO (PArties Speak Sequentially Once) model for multi-party computation (MPC). PASSO is a variation of traditional MPC where $n$ parties are executed in sequence and each party ``speaks'' only once, broadcasting and sending secret messages only to parties further down the line. Prior results in this setting include information-theoretic protocols in which the computational complexity scales exponentially with the number of corruptions $t$ (CRYPTO 2022), as well as more efficient computationally-secure protocols either assuming a trusted setup phase or DDH (FC 2024). Moreover, these works only consider security against static adversaries.

In this work, we focus on computational security against adaptive adversaries and from minimal assumptions, and improve on the works mentioned above in several ways:

- Assuming the existence of non-interactive perfectly binding commitments, we design protocols with $n=3t+1$ or $n=4t$ parties that are efficient and secure whenever $t$ is small compared to the security parameter $\lambda$ (e.g., $t$ is constant). This improves the resiliency of all previous protocols, even those requiring a trusted setup. It also shows that $n=4$ parties are necessary and sufficient for $t=1$ corruptions in the computational setting, while $n=5$ parties are required for information-theoretic security.

- Under the same assumption, we design protocols with $n=4t+2$ or $n=5t+2$ parties (depending on the adversarial network model) which are efficient whenever $t=poly(\lambda)$. This improves on the existing DDH-based protocol both in terms of resiliency and the underlying assumptions. - We design efficient protocols with $n=5t+3$ or $n=6t+3$ parties (depending on the adversarial network model) assuming the existence of one-way functions.

We complement these results by studying lower bounds for randomness generation protocols in the computational setting.

Existing secret management techniques demand users memorize complex passwords, store convoluted recovery phrases, or place their trust in a specific service or hardware provider. We have designed a novel protocol that combines existing cryptographic techniques to eliminate these complications and reduce user complexity to recalling a short PIN. Our protocol specifically focuses on a distributed approach to secret storage that leverages Oblivious Pseudorandom Functions (OPRFs) and a Secret-Sharing Scheme (SSS) combined with self-destructing secrets to minimize the trust placed in any singular server. Additionally, our approach allows for servers distributed across organizations, eliminating the need to trust a singular service operator. We have built an open-source implementation of the client and server sides of this new protocol, the latter of which has variants for running on commodity hardware and secure hardware.

With the growing emphasis on data privacy, secure multi-party computation has garnered significant attention for its strong security guarantees in developing privacy-preserving machine learning (PPML) schemes. However, only a few works address scenarios with a large number of participants. The state of the art by Liu et al. (LXY24, USENIX Security'24) first achieves a practical PPML protocol for up to 63 parties but is constrained to semi-honest security. Although naive extensions to the malicious setting are possible, they would introduce significant overhead. In this paper, we propose Helix, a scalable framework for maliciously secure PPML in the honest majority setting, aiming to enhance both the scalability and practicality of maliciously secure protocols. In particular, we report a privacy leakage issue in LXY24 during prefix OR operations and introduce a round-optimized alternative based on a single-round vectorized three-layer multiplication protocol. Additionally, by exploiting reusability properties within the computation process, we propose lightweight compression protocols that substantially improve the efficiency of multiplication verification. We also develop a batch check protocol to reduce the computational complexity of revealing operations in the malicious setting. For 63-party neural network inference, compared to the semi-honest LXY24, Helix is only 1.9$\times$ (1.1$\times$) slower in the online phase and 1.2$\times$ (1.1$\times$) slower in preprocessing under LAN (WAN) in the best case.