International Association for Cryptologic Research

ePrint Report: Preprocessed Private Function Evaluation: Achieving Sublinear Online Complexity for Lookup Tables Tanping Zhou, Xiaoyi Wang, Yi Qu, Wenchao Liu, Long Chen, Zhenfeng Zhang Private Function Evaluation (PFE) facilitates the secure computation of private functions on private inputs in an oblivious manner, ensuring that both the function and the inputs remain confidential throughout the entire computational process. PFE has garnered significant attention due to its critical applications in various domains, such as privacy-preserving healthcare systems and privacy-preserving credit checks, where safeguarding the confidentiality of the function itself is of paramount importance. However, despite its broad applicability, existing PFE schemes often exhibit inefficiencies, even in relatively straightforward scenarios such as the evaluation of lookup tables. To mitigate these limitations, we propose a novel variant of PFE, termed Preprocessed Private Function Evaluation (PPFE), which leverages preprocessing techniques to significantly enhance the efficiency of online computations. Within this framework, we introduce a specialized construction tailored specifically for lookup table operations, achieving sublinear complexity during the online computation phase. The efficacy of the proposed approach is demonstrated through experimental evaluations. For a lookup table of size $2^{24}$, the online computation time required to process a single query is about 3 milliseconds, representing a performance improvement of more than an order of magnitude compared to existing results. Furthermore, the proposed scheme exhibits strong scalability, effectively handling thousands of adaptive queries within the same framework.

ePrint Report: Quasipolynomial Cryptanalysis of the McEliece Cryptosystem (or: PIR Meets McEliece) Ashrujit Ghoshal, Yuval Ishai, Aayush Jain, Nuozhou Sun The McEliece code-based cryptosystem, utilizing binary Goppa codes, is the earliest public-key encryption scheme that is still considered post-quantum secure. We present a simple, classical quasipolynomial-time distinguisher for Goppa–McEliece in the asymptotic “Classic McEliece” regime: for code length $n$, extension degree $m=\Theta(\log n)$, Goppa degree $t=\Theta(n/\log n)$, and public-code dimension $k=\Theta(n)$, the algorithm runs in time $n^{{\mathcal O}(\log n)}$ and distinguishes the McEliece public key from the uniform distribution over $\mathbb F_2^{k\times n}$ with advantage $1-o(1)$. The distinguisher is not merely asymptotic: it applies to all Classic McEliece parameter sets considered in the NIST process and yields improved (though not yet practical) concrete attack estimates. Our distinguishing attack originated from a failed attempt to construct doubly efficient private information retrieval (PIR) protocols from algebraic locally decodable codes, and can be intuitively explained from the PIR perspective. We extend this provable algorithm to a heuristic $n^{{\mathcal O}(\log n)}$-time ciphertext-decryption attack that recovers the message from a noisy codeword.

ePrint Report: Adaptive-Input-Secure Updatable Private Set Union Seongbong Choi, Jiseung Kim, Hyung Tae Lee In multi-epoch deployments, private set union~(PSU) operates in an adaptive-input loop: after observing the union at epoch $t$, the receiver may choose its next input for epoch $t+1$. Liu et al.~(EUROCRYPT 2026) formalized this multi-epoch adaptive-input setting for updatable private set intersection and provided an instantiation, but their framework does not extend to PSU. Meanwhile, existing PSU protocols are analyzed only in the single-shot setting. We present the first semi-honest, adaptive-input-secure updatable PSU protocol supporting two-sided add/delete updates in the multi-epoch adaptive-input setting of Liu et al. Our construction is built around a new primitive, the updatable oblivious key-value store (uOKVS). Its defining rule, distributional erasure, requires each refresh to be distributed identically to a fresh static encoding of the current key set, rather than merely indistinguishably. We realize uOKVS by combining the Band-OKVS of Bienstock et al. with a PRF under a persistent key. The resulting refresh reuses a cached factorization, so its per-epoch encoding cost scales linearly rather than quadratically in the band width $w$. Building on this layer, we obtain a multi-epoch PSU protocol whose leakage is limited to set and update cardinalities, even against adaptive-input adversaries. We implement the protocol and benchmark it in a single-threaded setting. At $n = 2^{20}$ with per-epoch updates $\Delta = 55$ over $10$ epochs, the online per-epoch wall-clock time is $1.41$ s on LAN, yielding a $30.9\times$–$98.9\times$ speedup over prior static PSU protocols re-executed from scratch at each epoch.

ePrint Report: Adaptively Secure Threshold Decryption from LWE with Polynomial Modulus Yunxin Zhang, Yunxiao Zhou, Shuai Han, Shengli Liu, Xinyi Huang Threshold Decyption (TD) enables a set of decryptors, each holding a secret key share, to collaboratively decrypt ciphertexts. Lots of TD schemes consider only CPA security under static corruptions, but a stronger and more reasonable security notion in practice is CCA security under adaptive corruptions, which enhances the ability of adversaries to obtain partial decryptions of chosen ciphertexts and adaptively corrupt decryptors during the protocol. There are many works on TD from lattices, seeking for post-quantum security. However, none of these TD schemes achieves both adaptive security (i.e., security under adaptive corruptions) and polynomially-bounded modulus in lattices. Given the fact that polynomial modulus provides more post-quantum confidence than super-poly modulus, Devevey et al. [PKC 2021] left constructing an adaptively secure TD with polynomial modulus from lattices as an open problem. In this paper, we resolve the above open problem by proposing three adaptively secure (t,N)-TD schemes based on the LWE assumption, all with polynomial modulus under appropriate settings. – TD0: an adaptively CPA-secure scheme in the asynchronous setting in the standard model, whose modulus is polynomial for small number of users N. – TD1: an adaptively CCA-secure scheme in the asynchronous setting in the standard model, whose modulus is polynomial for small N and bounded decryption queries. – TD2: an adaptively CCA-secure scheme in the synchronous setting in the random oracle (RO) model, whose modulus is polynomial for bounded decryption queries. The main technical challenge is to limit the leakage of secret key shares arising from decryption queries, while keeping the modulus a polynomial. To overcome this barrier, we develop a refined polynomial noise flooding technique based on a detailed min-entropy analysis of secret shares conditioned on linear matrix hints, leveraging recent advances on Matrix-Hint LWE. Based on our new technique, we build TD1 using the replicated secret sharing (RSS) scheme, hence supporting only small N. To enable larger N, we design TD2 using the Shamir secret sharing scheme, in which we further integrate our new technique with the zero-sum masking technique [Katsumata et al., CRYPTO 2024] to restrict the secret key leakage. To the best of our knowledge, our TD1 and TD2 are the first non-interactive lattice-based threshold decryption schemes achieving adaptive CCA security and polynomial modulus, simultaneously. Moreover, they achieve the strongest notion of adaptive CCA security among those compared in [Brzuska et al., PKC 2026]. We further establish robustness for both TD0 and TD1 via publicly verifiable partial decryptions, ensuring that the combination either outputs the correct plaintext or aborts.

ePrint Report: Lattice-based Signature Schemes for Bitcoin Dmytro Zakharov, Mikhail Kudinov, Viktoria Balatska, Yaroslava Chopa Lattice-based cryptography offers a promising direction for transitioning Bitcoin toward post-quantum security, serving as a secure replacement for currently deployed discrete logarithm signatures. The primary advantages of lattice-based signature schemes include the compact combined size of signatures and public keys (e.g., in some cases below 1.6 KB), the robustness of underlying security assumptions, and an algebraic structure that, while not yet yielding practical constructions, holds potential for advanced functionality such as threshold and multi-signatures, compared to hash-based constructions. In this paper, we present a self-contained review of three lattice-based signature schemes, with Bitcoin’s post-quantum transition as the motivating application: Dilithium, Falcon, and Hawk. The latter was recently withdrawn from NIST standardization following a key-recovery attack; we retain it because its design paradigm remains of independent interest. For each protocol, we detail the high-level intuition, the necessary technical preliminaries, low-level mechanics, performance, and security analysis. We then assess the deployment aspects relevant to Bitcoin: the on-chain footprint, determined by the combined public-key and signature size and compared against hash-based alternatives; the target security level for outputs that may remain unspent for decades; implementation constraints, such as Falcon’s floating-point signing; and wallet key derivation. No prior exposure to lattice-based cryptography is assumed: all the required background is developed within the document.

ePrint Report: When Does Being Selfish Pay Off? Temporal Composability and Profitability in Selfish Mining Colin Finkbeiner, Connor Shaw, Ghada Almashaqbeh Selfish mining undermines incentive compatibility of proof-of-work blockchains, letting a miner earn disproportionate rewards at a hashrate lower than the majority threshold. A decade of work has asked whether a strategy is profitable, however, far less is understood about when it becomes profitable. Timing is critical since selfish mining operates at a loss before it turns a profit, typically requiring tens of weeks to break even in the classic case. In this paper, we present a holistic study of the time-to-profitability (TTP) of existing selfish mining strategies structured around four contributions. First, in the single-attacker setting, we characterize TTP across the full strategy space and find that TTP-minimizing and profit-maximizing strategies frequently diverge, making attack horizon a critical metric. In particular, under realistic fee dynamics, the use of incentive transactions to recruit honest-but-rational miners enable incentivized strategies to reach profitability up to $15\times$ faster than classic selfish mining at the same hash rate. Second, we explore TTP for the first time in the multi-attacker setting, showing that the difference in strategies between opposing attackers has a dramatic impact on joint-profitability lag. Third, we generalize intermittent selfish mining by exploring temporal composition over the full strategy space and show that its purported benefits are largely overstated. That is, alternating strategies rarely outperform the best static strategy in terms of either TTP or long-term profits. Finally, and building off our earlier findings, we explore adaptive, state-conditioned strategy selection at the difficulty adjustment period (DAP) level. We compare a general-purpose LLM agent against a fixed decision-tree selector, both implementing the same selection criteria. We find that both selectors reliably identify profit-maximizing strategies from observed network conditions, at a low operating cost, lowering the expertise barrier to exploiting adaptive selfish mining.

Event Calendar: LID7: Leuven Isogeny Days 7 Leuven, Belgium, 16 September – 18 September 2026 Event date: 16 September to 18 September 2026

Event Calendar: PQConf: Post-Quantum Conference Seattle, USA, 6 May – 7 May 2027 Event date: 6 May to 7 May 2027 Submission deadline: 30 November 2026 Notification: 11 January 2027

Job Posting: PhD Student (Foundations of Cryptography) Chalmers University of Technology We are looking for a PhD student to join the Crypto Team and Security Group at Chalmers with Christoph Egger as main supervisor. The position is fully funded for 5 years and comes with 20% teaching duties in the department. The Crypto Team currently has 2 faculty members, one Post-Doc and 4 PhD students and is embedded in the security group that captures a wide range of topics. Depending on the interests of the applicant, possible research topics include fine-grained and bounded space cryptography, realization of idealized models, relationship between cryptographic notions, and similar topics in foundational cryptography. Alternatively, a focus on formal methods for Cryptography is possible. One or two extended research visits are encouraged during the doctoral study. Applicants should have a strong interest in the mathematical analysis of algorithms in general and cryptography in particular. A master’s degree in mathematics, computer science, or a related discipline is required. The working language in the department is English, and applicants are expected to be fluent both in written and spoken English. Swedish courses are available for interested students. Applications are due August 14 (or until filled) Closing date for applications: Contact: Christoph Egger: eggerc@chalmers.se More information: https://www.chalmers.se/om-chalmers/arbeta-hos-oss/lediga-tjanster/?rmpage=apply&rmjob=15017

Job Posting: Senior Blockchain Architect Luxium AG Zug Switzerland Luxium AG in Zug, Switzerland is building a new Layer 1 blockchain from first principles, with a post quantum cryptographic core rather than a retrofit of classical primitives. We seek a full time Chief Blockchain Architect to own the protocol design and its long term technical direction. The work opens with an architecture phase: set the protocol foundations and write the specification the engineering team builds against then lead the technical organization, working directly with the founders. Two main elements are specific to this system, an on chain price formation mechanism inside the protocol, and Luxium Nation, a global network with governance and payment layers on the same token. Scope Design the core architecture: consensus, validator model, network layer, state model and execution environment. Select and justify the cryptographic primitives, including signatures, hashes, commitments and key management, with attention to quantum resistance and migration paths. State and defend the security model: adversary and network assumptions, safety and liveness arguments, and the trade offs between scalability, security and decentralization. Produce rigorous specifications and identify technical risk. We want depth in distributed systems, consensus and their cryptography, the ability to architect from first principles rather than assemble components, and strong technical writing. Valued: prior Layer 1 design or production consensus work; publications in cryptology or distributed computing; open source contributions; post quantum constructions; systems level implementation (Rust, Go, C++ or comparable). Relocation to Zug is required and fully supported. If that is not possible for you, say so and we will discuss it. Compensation is negotiated individually and may combine salary, incentives, equity and token participation. Aprox range 210,000chf – 310,000chf Apply to info@luxium.global with a CV and links to relevant work, publications or repositories and feel free to ask any questions . Closing date for applications: Contact: Daniel Gagnidze More information: https://www.jobs.ch/en/vacancies/detail/f7defdb8-bc1e-4fe0-9c00-d1b2d358e4e8/

Job Posting: Fully Funded PhD Positions in Cryptography Department of Computing, The Hong Kong Polytechnic University; Hong Kong SAR The Department of Computing at The Hong Kong Polytechnic University (PolyU) is offering multiple fully funded PhD positions in the broad area of cryptography and cybersecurity. Successful candidates will work with Dr. Yu Shen (https://shenyu-official.icu/) and conduct research in areas including, but not limited to: Blockchain security and privacy Distributed computing and consensus Secure multi-party computation, cryptographic protocols, and game theory Quantum cryptography The PhD positions are fully funded for 3–4 years, with a competitive monthly stipend. Detailed information on scholarships and tuition fees is available at: https://www.polyu.edu.hk/cee/prospective-students/research-postgraduate-programme/scholarships-and-tuition-fee/ Eligibility Requirements Applicants should have: A strong background in cryptography, cybersecurity, theoretical computer science, or related areas; and Fulfilled the general PhD admission requirements of PolyU:
https://www.polyu.edu.hk/study/pg/research-postgraduate Application Procedure Interested candidates are invited to send the following materials to Dr. Yu Shen at shenyu.tcv@gmail.com: Curriculum vitae (CV) Academic transcripts A brief statement describing research interests and relevant experience Applications will be reviewed on a rolling basis until the positions are filled. We welcome highly motivated candidates with a strong interest in advancing the foundations and applications of modern cryptography to apply. Closing date for applications: Contact: Yu Shen (shenyu.tcv@gmail.com)

Job Posting: PhD and Postdoctoral Positions at INSAIT Institute for Computer Science, Artificial Intelligence and Technology; Sofia, Bulgaria We are looking for outstanding PhD students and postdoctoral researchers to join the cryptography group led by Dr. Michael Reichle at INSAIT in Sofia, Bulgaria. INSAIT is already a top research institute in AI and Theory and you have the opportunity to help shape INSAIT into a world-class research institute for Cryptography and Security. Sofia offers great gastronomy, an affordable cost of living and quick access to nature, with many parks and Vitosha Mountain just outside the city. Topics. Research areas include post-quantum cryptography, protocols for signatures and encryption, and zero-knowledge proofs. Applicants with interests in related areas of cryptography are also encouraged to apply. PhD applicants. You should hold (or be close to completing) a Master’s degree and have a strong background in cryptography, theoretical computer science, mathematics, or a related field. You will be co-supervised by Mariana Raykova under the Google PhD fellowship program. Postdoctoral applicants. You should hold (or be close to completing) a PhD in a related field. A strong research record, ideally including publications at IACR conferences or leading security venues, is preferred. The positions are well funded and come with no teaching obligations. The start date is flexible, with positions available from October 2026 onward. Applications will be considered on a rolling basis until the positions are filled. Closing date for applications: Contact: Please apply via https://insait.ai/information-security-and-cryptography. For questions, please contact Michael Reichle (michael.reichle@insait.ai). More information: https://insait.ai/information-security-and-cryptography

Job Posting: PhD position Hasso Plattner Institute, University of Potsdam (Germany) HPI is recognized as one of the leading university institutes for computer science (www.hpi.de). Our goal is to strengthen Europe’s digital sovereignty with excellent research and practice-oriented teaching in computer science. At HPI, we are convinced that excellence is created when knowledge from different disciplines is collaboratively combined to create responsible and pioneering solutions for the future. In our research clusters “Systems,” “Data and AI,” “Foundations,” “Digital Health,” “Security,” and “Business and Society” researchers from various disciplines work together on topics relevant to solving the challenges facing society. The Digital Engineering Faculty of the University of Potsdam and HPI offers a computer science engineering degree program that is unique in Germany. In the course of its strong growth, the Hasso Plattner Institute is offering a PhD position in the research group Cybersecurity – High-Assurance Systems, led by Prof. Dr. Chitchanok Chuengsatiansup, which investigates mechanisms to safeguard our digital information with the focus on cryptographic engineering, side-channel analysis, implementation optimization, and post-quantum cryptography. The application deadline is 20 September 2026. For further information and how to apply, please visit: https://jobs.plattnerfoundation.org/HPI/job/Potsdam-PhD-position-%28fmx%29-High-Assurance-Systems-14482/1362941055/ Closing date for applications: Contact: Chitchanok Chuengsatiansup More information: https://jobs.plattnerfoundation.org/HPI/job/Potsdam-PhD-position-%28fmx%29-High-Assurance-Systems-14482/1362941055/

ePrint Report: AES-Based Grinding for MPC-in-the-Head Signatures Matthieu Rivain Grinding is a technique which introduces a proof of work into the Fiat-Shamir transform: by constraining the challenge to satisfy a $w$-bit condition, forging a proof requires about $2^w/\varepsilon$ evaluations of the hash function instead of $1/\varepsilon$, where $\varepsilon$ is the soundness error of the underlying protocol. This allows one to select reduced parameters, yielding shorter proofs and signatures. Grinding is used in FAEST, MQOM and SDitH, the three MPC-in-the-Head schemes selected for the third round of the NIST additional post-quantum signature standardization process, where it is instantiated with Keccak. In this short paper, we investigate grinding schemes in which the proof of work is expressed in terms of block cipher computations, specifically AES, which is significantly faster than Keccak on modern CPUs, is already a building block of these schemes, and underlies the very definition of the NIST security categories. We formalize the notion of grinding scheme together with a protocol-agnostic security notion, we propose a construction performing two cipher calls per iteration, and we prove, in the ideal cipher and random oracle models, that an adversary making $Q_E$ cipher queries breaks it with probability at most $\frac{4}{3} \cdot \varepsilon\, Q_E / 2^w$, up to negligible terms. We further generalize the scheme to use more cipher calls per iteration, which makes the constant $\frac43$ tend to $1$.

ePrint Report: Formal Security Analysis of the Olvid Messenger Noemi Terzo, Cas Cremers, Ruben Gonzalez, Peter Schwabe, Yuval Yarom, Zhiyuan Zhang We perform the first formal security analysis of the cryptographic core of Olvid, an end-to-end encrypted messaging app notably used by French government officials, including ministers. Despite its deployment in sensitive contexts and its role in critical communications infrastructure, Olvid’s cryptographic security has received little independent analysis. To address this gap, we develop detailed models of Olvid’s authenticated key exchange and continuous key agreement protocols. We formally verify that our protocol models achieve security properties such as mutual authentication, session-key secrecy, forward secrecy, and replay protection, under an active Dolev-Yao network adversary model that can compromise parties. While we constructively prove that the protocol design meets core security guarantees, our analysis also reveals that, contrary to its claims, the protocol does not meet strong modern security properties that are met by other state-of-the-art secure-messaging protocols, such as Signal. For example, we show in our formal analysis that Olvid is not secure in modern security models such as eCK. Along the way, we uncover a potential timing leakage, and discuss Olvid’s anonymity claims.

ePrint Report: Triple Cryptanalysis of Isogeny-Based VRFs from Asiacrypt 2025 Yi-Fu Lai, Yu Yu, Xiaogang Zhou Levin and Pedersen proposed at Asiacrypt2025 a new verifiable random function (VRF) based on a CGL-analogue hash function constructed from radical isogenies. Their construction applies the same secret radical-CGL walk to a public starting curve and a message-dependent curve, and uses an R1CS proof relation to show that the two walks use the same secret key. We present a two-stage attack on this construction. The first stage concerns the unspecified representation of the public key. The reported key size indicates that the public curve is stored as a \(j\)-invariant, whereas both the specified radical-CGL computation use two coefficients to represent a curve. By exploiting this form we can produce two different VRF outputs under the same public key and message, breaking the unique provability. Hence, the output of the radical-CGL computation must follow the specification. In the second stage, we exploit these coefficients to recover the VRF secret key. With \(1536\) queries, our implementation recovers the complete \(256\)-bit secret in 30 minutes, thereby breaking residual pseudorandomness. Interestingly, we also observe that the using public key alone without queries can sometimes reveal one or two bits of the secret walk. Besides, we extend Lai’s observation to obtain a one-query attack on the group-action-based VRF proposed in the same paper with advantage closed to 1/2. Together, these constitute three attacks on their work.

ePrint Report: Code Generation of Faster Formally Verified NTT with Plantard Reduction Donnie Y. Xu, Rajeev Gore, Amin Sakzad, Ron Steinfeld, Raymond K. Zhao We present a formally verified implementation of the ML-KEM Number-Theoretic Transform (NTT) based on Plantard arithmetic, produced via a code generator that targets ML-KEM, ML-DSA, and FN-DSA from a single parameter triple. The generator embeds a static bound analyzer that places modular reductions at code-generation time without runtime branching, eliminating per-scheme manual tuning while preserving constant-time guarantees. Each generation produces structurally identical implementations in two backends: portable C, and Jasmin for formal verification. To establish end-to-end correctness, we contribute a parametric formalization of Plantard arithmetic in \textsc{EasyCrypt} and a layer-by-layer program-equivalence proof connecting the extracted Jasmin ML-KEM NTT to the abstract specification of formosa-mlkem; the existing algebraic chain is reused unchanged to extend correctness down to the mathematical NTT definition. Benchmarks across three schemes show that the generated code outperforms reference C by $1.5\times$–$1.8\times$ on the forward NTT and $1.7\times$–$2.5\times$ on the inverse, and outperforms the formally verified formosa-mlkem Jasmin baseline by $1.26\times$ and $2.19\times$ on ML-KEM. We believe our techniques generalize to other lattice-arithmetic primitives requiring both performance and formal verification.

ePrint Report: Extending the Applicability of Algebraic Key Recovery Attacks on the UOV Signature Scheme Yasuhiko Ikematsu, Hiroki Furue The Unbalanced Oil and Vinegar (UOV) scheme was proposed by Kipnis et al. in 1999 as a multivariate signature scheme. Owing to its small signature size and its resistance to various attacks over more than two decades, UOV has become one of the leading candidates in multivariate public key cryptography. In 2025, Ran proposed a novel algebraic key recovery attack exploiting the algebraic structure of UOV, which reduced the security of several parameter sets of UOV and its variants submitted to the second round of the NIST PQC standardization process for additional signatures. This attack was improved by Jin et al., and Furue and Ikematsu, forming a line of attacks that has significantly advanced the cryptanalysis of UOV. However, Ran’s attack is applicable only when $v<2m$, where $v$ denotes the number of vinegar variables and $m$ the number of public polynomials. In fact, when $v\ge 2m$, an additional kernel element of the ideal generated by the public polynomials appears, preventing the attack from recovering the oil subspace. A similar issue arises in the improvements by Jin et al., and Furue and Ikematsu. In this paper, we propose a method that overcomes this issue, extending the applicability of this line of attacks to the case where such an additional kernel element appears. Applying our method to SNOVA via the lifting technique of Nakamura et al., we show that the claimed security levels of some parameter sets of SNOVA in the second round of NIST PQC standardization process for additional signatures are reduced. In particular, for the parameter set $(v,o,q,l)=(37,17,16,2)$ of NIST security level I, although Ran’s attack is not applicable, our method reduces the estimated security to $2^{103}$ gate operations, which matches the complexity of the attack by Bros et al. in 2026.

ePrint Report: Z-SCAPE: Zero-Knowledge Self-Custodial Credential Operation for Privacy-Preserving Asset Protection under Entropy-Source Failure Mehmet Sabir Kiraz, Suleyman Kardas Motivated by the 2026 COLDCARD incident, this paper studies cryptographic asset recovery after self-custodial seed-generation failures. Self-custodial hardware wallets depend on secure entropy sources for seed generation. If an RNG implementation or design failure reduces seed entropy, an adversary may reconstruct wallet signing keys through offline search. Such weaknesses may also be discovered long after wallet creation, placing existing self-custodial assets at risk. To prevent large-scale exploitation after such a failure is identified, a hardware manufacturer or security response team may perform a protective sweep of affected assets into a protected recovery treasury. Asset redistribution then creates a fundamental authentication problem: once the signing key can be reconstructed by both the legitimate owner and an adversary, possession of that key no longer uniquely identifies the legitimate controller. We propose Z-SCAPE, a zero-knowledge recovery-credential protocol for privacy-preserving asset recovery after seed-generation failures and protective sweeps. Before compromise, the user commits to a recovery credential consisting of an independently generated 256-bit recovery secret $r$ and an RNG-independent personal record $P$. After an incident, the prover proves knowledge of $(P,r)$ in zero knowledge while binding the proof to the incident, a fresh verifier nonce, an expiry value and a fresh destination address. The protocol enables recovery claims without revealing $P$, $r$ or the compromised wallet private keys, while preventing replay and destination substitution. Z-SCAPE provides concrete integration mechanisms for Bitcoin and Ethereum and enables protected assets to be returned only to the fresh destination bound to an accepted recovery proof.

ePrint Report: Relect: Single Secret Leader Election via FHE with Reduced Computation and Communication and Transparent Setup Haofei Liang, Zeyu Liu, Yunhao Wang, Xiang Xie, Yu Yu, Fan Zhang In a single secret leader election (SSLE) protocol, all parties collectively and obliviously elect one leader. Parties other than the selected leader should not be able to learn the identity of the leader unless it is revealed by the leader itself. The problem is first formalized by Boneh \textit{et al.} (AFT 2020), and the first concretely feasible lattice-based SSLE with proof-of-concept implementations, $\mathsf{Qelect}$, was recently introduced by Wang and Zhang (USENIX 2025). In this work, we present $\mathsf{Relect}$, an efficient SSLE protocol, based on the Ring Learning with Error assumption. We build it by leveraging the algebraic structure of the underlying threshold Fully Homomorphic Encryption (FHE) and by designing tailored homomorphic circuits. Compared to prior works, $\mathsf{Relect}$ (1) achieves substantially higher efficiency and (2) removes the strong environment assumption in $\mathsf{Qelect}$ (a trusted setup), and thereby also allows dynamic leader selection for each round. Concretely, for $32$ — $2048$ parties, our local FHE computation runtime (a major efficiency bottleneck for SSLE) achieves $7.15$ — $42.4\times$ faster than $\mathsf{Qelect}$ for a single thread and $7.10$ — $48\times$ faster for 16 threads. Furthermore, we show that for the same parameters, our communication cost is also $1.14$ — $2\times$ smaller. As mentioned, this is achieved while removing the trusted setup. In terms of end-to-end runtime, following $\mathsf{Qelect}$, we tested $2$ — $128$ parties. We show that under the LAN setting, $\mathsf{Relect}$ is $2.77$ — $345\times$ faster than $\mathsf{Qelect}$ per round. Under the WAN setting, $\mathsf{Relect}$ is $1.94$ to $17.2\times$ faster than $\mathsf{Qelect}$. Note that these performance gains are all achieved while removing the trusted assumption and achieving dynamic leader selection for each round.