Headlines pulled automatically from NIST, IACR, and trusted security news outlets, refreshed every few hours. Titles and excerpts only — click through to read the full story at the original source.
mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack that reportedly exposed an encrypted customer database. [...]
The new YubiID service bridges identity verification with credential enrollment and recovery across existing identity platforms, closing a phishing-resistant authentication gap. Plus: post-quantum YubiKey beta.
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement
Cryptanalytic extraction can expose proprietary neural network parameters, but unknown architectures and large parameter counts complicate recovery under hard-label access. Local class-pair rules offer a narrower target by making class-switching conditions explicit and predicting nearby labels under a specified sampling law. Distillation methods mainly return substitute models rather than explici…
Cryptanalytic extraction (CEA) of piecewise-linear neural networks recovers hidden signatures and parameters by locating critical points or hard-label dual points that expose off-manifold geometry. Proposed mitigation methods include query monitoring, output perturbation, ownership verification, and extraction-aware training. Train to Defend (TTD) directly addresses CEA through extraction-aware t…
Many privacy-preserving applications such as iterative machine learning training require executing ongoing computations over a secret state for long periods of time. While MPC enables secure computation, long-lived secret state is vulnerable to adaptive corruptions, requiring periodic share refreshes and committee rotation. In many settings, it is desirable for external parties to be able to veri…
Unique signatures are digital signature schemes, where each message has exactly one valid signature. The uniqueness property typically comes at a price: Most unique signature schemes are known to have a security loss at least linear in the number of signature queries when aiming for existential unforgeability under chosen message attacks (EUF-CMA) security, which was shown to be inherent in the s…
S-boxes serve as essential nonlinear building blocks in symmetric-key cryptography, where their cryptographic properties and hardware implementation costs jointly dictate the security and efficiency of lightweight primitives. This paper studies the construction and classification of minimum-latency 5-bit APN (Almost Perfect Nonlinear) permutations under a prescribed gate-delay model, using exact …
Accountable tracing signatures (ATS), introduced by Kohlweiss and Miers (PoPETs 2015), classify each group member (user) as either traceable or non-traceable. A traceable user corresponds to one in conventional group signature schemes whose identity can be revealed by the opener from a signature, whereas a non-traceable user cannot be identified from any signature they produce. The opener, who is…
We give a method to publish data on Bitcoin and to verify properties of that data on Bitcoin itself, against a publisher who may lie. The data is a FlatMerkle file – a structured byte string whose ordinary SHA-256 supports logarithmic inclusion proofs and logarithmic proofs of malformation – placed in a transaction's annex or, at four times the cost but relayable by Bitcoin Core, in an output. We…
We present an experimental cryptanalysis of the RLCE cryptosystem at the heretofore secure $w=n-k$ parameter regime. Our attack relies crucially on the recent Ghoshal--Ishai--Jain--Sun (GIJS) distinguisher The attack shortens the public key at random positions, runs the GIJS distinguisher with \emph{every} column as hold-out, and uses this distinguisher to identify twin pairs based on how they ap…
Leakage-resilient compilers transform any computation so that physical leakage from its implementation reveals nothing beyond its input-output behaviour. In this work, we investigate this question in the well-motivated continual memory leakage (CML) model, that captures a variety of relevant real-world side-channel attacks and subsumes several other well studied models in the leakage domain. In t…
Zero-knowledge membership accumulators are conventionally tailored for slowly growing sets with frequent proof generation, creating severe efficiency bottlenecks for modern compliance architectures. Governance-driven applications like FATF customer due diligence, eIDAS 2.0 wallet issuance, and MiCA VASP authorization invert this structure. In this regime, rosters are ingested at an enterprise sca…
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is
For $A,B\in\text{GL}(\mathbb{F}_p)$, a Cayley hash $\text{HM}(w)$ maps a bit string $w \in \{0,1\}$ to the corresponding product of $A$ and $B$. We construct collisions by finding two palindromes whose matrix products commute. A symmetric form shared by the two generators places the hash of every palindrome in a three-dimensional subspace containing the identity. Two such hashes commute when thei…
We present a new concrete unified distance analysis of three accumulate-type error-correcting codes over any finite field, specifically the Repeat-Accumulate (RA), Repeat-Accumulate-Accumulate (RAA), and Expand-Accumulate (EA) codes. For message length $k$, codeword length $n$, finite field size $q>2$, and target relative minimum distance $\delta$, we give new upper bounds on the probability that…
We give provable randomized algorithms for the exact shortest vector problem (SVP) and the $5/3$-approximate closest vector problem (CVP) in the Euclidean norm on random $q$-ary lattices $\Lambda=\{\boldsymbol x\in\mathbb{Z}^n:\mathbf H\boldsymbol x\equiv\boldsymbol 0_m\pmod q\}$, where $\mathbf H\in(\mathbb{Z}/q\mathbb{Z})^{m\times n}$ is uniformly random, for every integer modulus $q\ge2$. For …
Masked-code encryption hides an efficiently decodable code behind a transformation meant to make it look random. We study the two masks proposed as compact alternatives to Goppa codes---Wang's RLCE (insert $w$ random columns, mix coordinate pairs) and the $(U\,|\,U{+}V)$ construction of UVW-KEM---over every decodable hidden code they have been or could be applied to, and find that none yields a c…
Privacy-preserving smart contracts face a scalability problem. In account-balance-vector designs, hiding which accounts changed requires that every transaction perform an indistinguishable update over the global state, so validators pay work linear in the number of accounts for every private transfer. UTXO systems avoid this by validating local spends, but do not provide the same account-style pr…
The Fiat-Shamir transform converts public-coin interactive arguments into non-interactive arguments (NARGs). Its security is typically analyzed in the random-oracle model, while implementations instantiate the random oracle with structured hash constructions. Standard indifferentiability is the natural abstraction for justifying this replacement. Chiesa and Orru (TCC ’25), however, showed that st…
We revisit the basic construction of polynomial evaluation based hash function, which we call Poly, over binary extension fields $GF(2^n)$, where $n=64k$ and $k\geq 2$. Unlike GHASH, the NIST standard polynomial evaluation based hash function for $n=128$, Poly does not perform the unnecessary bit reversals of each $n$-bit block, and consequently is faster than GHASH. Further, Poly differs from Po…
Anamorphic encryption and signatures deliver a hidden message through a normal-looking ciphertext or signature. We move from hidden messages to hidden knowledge claims and introduce anamorphic proofs of knowledge, in which a single proof certifies its normal statement publicly while convincing a designated checker that the prover knows a witness for a separately registered anamorphic statement, s…
Quantum computing threatens public-key cryptography, motivating post-quantum signature standardization. MAYO, a multivariate Round 3 candidate in NIST's additional signature process, offers compact keys and signatures. However, prior GPU implementations do not fully exploit parallelism within each MAYO operation: equation-slice partitioning serializes independent matrix work, while signing requir…
A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.
Card-based cryptography performs secure computation with physical cards, where a bit is usually encoded by two cards but can also be encoded by a single card. We study mixed encoding, in which one player gives a single-card commitment and the other a two-card commitment, for perfectly secure protocols with finite runtime and public actions. Mizuki (Theoretical Computer Science, vol.~622, 2016) pr…
Scalable oversight asks how a weak verifier can check the outputs of computations performed by more powerful AI systems. One proposed approach uses relativizing interactive proofs, in which a weak verifier checks the output of a complex oracle-aided computation by interacting with one or more powerful provers. A prominent example is debate, which is highly efficient but assumes that one of two po…
Byzantine broadcast and Byzantine agreement are fundamental problems in distributed computing and building blocks for secure multiparty computation. In complete synchronous networks of $n$ parties with channels identifying the immediate sender, classical results establish how authentication changes resilience to $t$ Byzantine faults. Without initially authenticated public keys, both tasks are pos…
PRISM is an isogeny-based digital signature whose security relies on the problem of computing large prime degree isogenies from a supersingular elliptic curve of unknown endomorphism ring. In this paper, we design SPIDER, a digital signature that builds on a sigma protocol which when given a supersingular elliptic curve $E$, proves the knowledge of an isogeny $\phi: E\rightarrow E'$ of prime (or …
SM3 is a 256-bit cryptographic hash function specified in the Chinese national standard GB/T 32905-2016 and the international standard ISO/IEC 10118-3:2018. In this paper, we present practical collisions for 22- and 23-step SM3 with the standard initial value. Compared with the 20-step collision result of Mendel et al. (2013), our constructions cover two and three additional steps, respectively. …
Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in
I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.
Registered functional encryption removes the trusted authority bottleneck of standard functional encryption by allowing users to register their own public keys, with a transparent aggregation procedure producing a compact master public key. On the other hand, certified everlasting deletion enables a recipient to produce a classical certificate guaranteeing that a ciphertext has been information-t…
Predicate encryption extends attribute-based encryption by providing fine-grained access control while hiding the attribute associated with a ciphertext beyond what the secret keys held by an adversary necessarily reveal. Batched identity-based encryption enables authorization with respect to a designated collection of identities. We introduce batched threshold predicate encryption (BT-PE), which…
Batched identity-based encryption (BIBE) compresses a bounded set of identities into a succinct public digest, and provides a single secret key for decrypting ciphertexts associated with identities in the set. We introduce batched identity-based encryption with succinct publicly verifiable subset deletion (BIBE-SPVD), which allows a holder of polynomially many quantum ciphertexts to certify delet…
A ratio-based ring oscillator physical unclonable function (ROPUF) provides high reliability and is capable of extracting multiple bits from a single ring oscillator pair. However, the derivation of the response bits from such PUFs and the assessment of their randomness have relied only on empirical statistical tests. This paper introduces a novel, mathematically derived closed-form statistical m…
We study short collisions in salted Merkle-Damg{\aa}rd (MD) and Sponge under the query-bounded preprocessing model introduced by Ghoshal and Tessaro (CRYPTO '23). The adversary makes at most $T_1$ oracle queries before a random salt is revealed and at most $T_2$ queries afterwards, and must output two colliding messages of at most $B$ blocks. Our main result is a separation between the two constr…
We study time-space tradeoffs for finding short collisions in Merkle-Damg{\aa}rd~(MD) hashing in the quantum auxiliary-input quantum random-oracle model~(QAI-QROM). An adversary may preprocess the compression function into $S$ qubits of arbitrary oracle-dependent quantum advice and, after receiving a fresh salt, make $T$ superposition queries to find a collision consisting of at most $B$ blocks. …
We propose Rotom, a family of 128-bit tweakable block ciphers designed for efficient software implementation on 32-bit microcontrollers. The central design idea is to use modular multiplication as a compact and software-efficient source of strong nonlinearity. Rotom instantiates this idea with a fixed 16-bit S-box built from odd constant multiplication modulo $2^{16}$ interleaved with lightweight…
Small moduli support compact polynomial representations in lattice-based key encapsulation mechanisms (KEMs), including BAT (TCHES 2022) and END (ASIACRYPT 2026, to appear). However, compact encodings can be costly to convert, and uniform generation must account for both coefficient-extraction cost and random-bit demand. Incomplete number-theoretic transforms also leave residual polynomial produc…