Gate bootstrapping is a core primitive that enables arbitrary circuit evaluation in fully homomorphic encryption (FHE), where blind rotation remains the dominant performance bottleneck. In this work, we present a sub-millisecond NTRU-based gate bootstrapping scheme that achieves state-of-the-art performance through coordinated algorithmic, software, and hardware-level optimizations.

Abstract Wiretap coding, evolving in parallel with cryptography for nearly 50 years, focuses on secure transmission under the assumption that the wiretap channel is no less noisy than the main channel. Most provably secure schemes rely on information-theoretic security but often achieve limited practical rates. This paper proposes a framework for computationally secure modular wiretap coding. We integrate error correction encoding with the channel transition process to define the wiretap channel function, which consists of an invertible function and a lossy function. Secure encoding is then modeled as a computational entropy extractor. A detailed analysis of the lossy function for symmetric wiretap channels is presented. To leverage this lossiness, we design two computational extractors: the invertible fooling extractor (IFE) and the compressed randomness extractor (CRE). For practical implementation, we demonstrate that a 4-round optimal asymmetric encryption padding serves as an IFE in the random oracle model. Experimental comparisons show that our scheme achieves approximately 3 times and 2.7 times the code rates of the Invert-then-Encode and code-based schemes—classical information-theoretic schemes—under equivalent channel conditions. By instantiating IFE and CRE with hash algorithms such as SHAKE-128/256, we develop a practical wiretap coding scheme that achieves high rates with reasonable computational overhead.

Abstract Fully Homomorphic Encryption (FHE) enables arbitrary computation on encrypted data without decryption, making it a cornerstone of privacy-preserving outsourcing, such as cloud computing. However, homomorphic operations cause ciphertext noise to grow until decryption fails. The efficient solution is bootstrapping, which refreshes the noise in FHE ciphertexts to sustain arbitrary deep homomorphic evaluation. But in practice, bootstrapping consumes over 50% of total execution time, posing a serious obstacle to FHE adoption. This paper presents a systematic survey of FHE bootstrapping algorithms and their optimizations. We organize existing works into three main paradigms: word-wise bootstrapping for BGV, BFV, and CKKS schemes; bit-wise bootstrapping for FHEW and TFHE schemes; and hybrid bootstrapping, which leverages both word-wise schemes and bit-wise schemes. We analyze the evolution of crucial techniques, highlight latest advances in reducing latency, enhancing parallelism, and controlling noise growth, and compare the advantages and limitations of different schemes. Finally, we discuss emerging research trends.

Abstract Transport Layer Cryptography Protocol (TLCP) is a secure communication protocol developed in China, featuring a dual-certificate architecture and incorporating ShangMi cryptographic algorithms. It has been widely deployed in security-critical domains such as finance, government, and energy. Despite its practical significance, TLCP did not undergo comprehensive formal analysis during its standardization process, leaving potential design-level vulnerabilities insufficiently explored. Moreover, the advent of quantum computing poses fundamental challenges to the classical cryptographic primitives employed by TLCP, motivating the need for both systematic security evaluation and post-quantum enhancements. To address these gaps, we first construct the comprehensive formal model of TLCP, covering certificate-based and identity-based cipher suites as well as its distinctive dual-certificate mechanism, under a realistic threat model and security assumptions that capture both classical and quantum adversaries. Based on this model, we conduct an automated security analysis using ProVerif, identifying nine potential attack vectors and deriving five concrete mitigation recommendations. Finally, motivated by the analysis results and the limitations of incremental fixes against quantum threats, we propose KEMTLCP, a post-quantum secure variant of TLCP that leverages key encapsulation mechanisms (KEMs) for both key exchange and authentication while preserving TLCP’s architectural principles through a novel explicit authentication mechanism. We further provide a security proof for the core authentication mechanism, show that KEMTLCP effectively mitigates the majority of identified vulnerabilities through formal analysis, and evaluate its practical performance.

TFHE is a fully homomorphic encryption scheme over the torus that supports fast bootstrapping. Its primary evaluation mechanism is based on gate bootstrapping and programmable bootstrapping (PBS), which computes functions while simultaneously refreshing noise. PBS-based evaluation is user-friendly and efficient for small circuits; however, the number of bootstrapping operations increases exponentially with the circuit depth. To address the challenge of efficiently evaluating large-scale circuits, Chillotti et al. introduced a leveled homomorphic evaluation (LHE) mode at Asiacrypt 2017. This mode decouples circuit evaluation from bootstrapping, resulting in a speedup of hundreds of times over PBS-based methods. However, the remaining circuit bootstrapping (CBS) becomes a performance bottleneck, even though its frequency is linear with the circuit depth.

Verifiable Computation over encrypted data (VCoed) has two popular paradigms: SNARK-FHE (applying SNARKs to prove FHE operations) and FHE-SNARK (homomorphically evaluating SNARK proofs). For the existing works, FHE-SNARK has a much better efficiency compared to SNARK-FHE.

We study the capacity of a general channel under the requirement that the error probability decreases exponentially to zero. A formula of this capacity is established by using information spectrum methods. Specifically, we show that this capacity equals to the supremum, over all input processes, of the input-output inf-information rate under exponential decreasing constraint. We also show that, when the code rate is below the capacity, the probability for a random code not having exponentially decreasing error probability is double exponentially small.

In physical-layer key generation (PLKG), researchers often assess key security using randomness tests or secret key capacity analysis. However, randomness tests can be misleading, as low-entropy inputs may still pass when obscured by hash functions or extractors. While key capacity captures the theoretical upper limit of secret bits from raw channels, it overlooks the impact of practical preprocessing. Recent studies have explored min-entropy as a more practical security metric. However, commonly used min-entropy estimators, such as those in NIST SP 800-90B (90B), may yield inaccurate results for complex sources, even overestimating entropy and thereby undermining security. Their applicability to PLKG also remains unverified. To address the above research gap, this paper focuses on modeling the received signal envelope, a common feature extracted for key generation. Leveraging typical wireless fading scenarios considered in key capacity analysis, we adopt the more general Weibull distribution to characterize the envelope statistics, which generalizes the Rayleigh model and better captures diverse propagation conditions. We first derive an explicit expression for the min-entropy in the absence of preprocessing, and then systematically analyze the impact of typical preprocessing operations on the statistical properties of the observed channel. Building on this foundation, we further establish theoretical upper and lower bounds on the min-entropy under representative preprocessing strategies. We further evaluate all 90B entropy estimators using both simulations and real-world channel measurements, comparing their estimates with our analytical results. While some estimators work well on raw data, they often fail or overestimate entropy after preprocessing, compromising security. In contrast, our conservative lower bound remains robust across all tested scenarios and preprocessing conditions. It offers a reliable fallback when standard estimators break down, providing a stronger theoretical foundation for secure key extraction in PLKG systems.

Abstract The Blum-Kalai-Wasserman (BKW) algorithm is a significant combinatorial algorithm used to tackle the Learning with Errors (LWE) and Learning with Rounding (LWR) problems. In 2015, Duc et al. (in: Oswald and Fischlin (eds) EUROCRYPT 2015, Springer, Berlin, 2015) proposed the first BKW algorithm applied directly to LWR, which consists of the reduction phase and the solving phase. In this paper, we propose an improved LWR-solving BKW algorithm. For the reduction phase, we design a novel coding method with relaxed collision conditions and introduce a post-processing stage and for the solving phase, we switch to a more efficient Fast Fourier Transform (FFT) distinguisher with pruning. Compared to previous LWR-solving BKW algorithms, our new BKW algorithm achieves a time complexity improvement of 4.0–48.5 bits for the instances considered. Additionally, by incorporating a novel heuristic method in the reduction phase, our algorithm further improves the sample complexity by 3.7–48.7 bits.

We propose a new physical-layer public key encryption scheme and establish a trapdoor one-way function through Massive MIMO techniques and precoding designs. Under standard arguments, we show that the eavesdropper's decoding complexity grows exponentially with the number of antennas, while the legitimate receiver's decoding complexity grows only quadratically. The proposed scheme builds a bridge between information-theoretic security and cryptographic security. Compared to the traditional physical-layer security, the proposed scheme is secure when the number of the eavesdropper's antennas is infinite or much larger than the number of transmitter/receiver antennas, provided that the eavesdropper's distance from the legitimate receiver is less than one-half of the wavelength, or that the channel estimation process between the sender-receiver pair is broken by the eavesdropper. Because the scheme is based on lattice, not on channel reciprocity, it can be applied to both time-division duplex and frequency-division duplex channels, and utilizes the simple physical layer characteristics of Massive MIMO to resist the currently known quantum attacks. The proposed scheme is adapted to the future requirements of 6G for the security of communication, and provides a new idea for the post-quantum cryptosystem. The simulation results show that the proposed scheme has a decoding bit error rate (BER) close to 0.5 at the eavesdropper and almost 0 at the legitimate receiver.

Abstract We present eBiBa (enhanced BiBa), a hash-based signature scheme with the smallest possible signature size, while ensuring high feasibility and security in a specific application model. Our scheme is tailored to address the communication requirement of a large-scale public data stream continuously disseminated between two participants while ensuring data source and data integrity authentication. To achieve these goals, firstly, we optimized the classical hash tree mode into a hybrid mode to efficiently perform public key authentication and eliminate the need for an authenticated channel to transmit large amounts of data, unlike the initial BiBa-based broadcast authentication protocol. Secondly, we employed a specific tweakable hash chain function to digest a batch of messages, reducing the required conditions for post-quantum existential unforgeability under adaptive chosen message attack (EUCMA) of eBiBa to a second-pre-image-resistance-like property instead of collision resistance. This results in reduced pre-computation in both key and signature generations. Thirdly, we utilized a forward-secure pseudorandom function to achieve forward-secure of the proposed scheme. Finally, we minimize the signature size through a series of procedures. Firstly, we select BiBa few-time signature as the underlying signature scheme since it is currently the few-time hash-based signature with the smallest signature size that we are aware of; in addition, the hybrid approach we employed can also significantly reduce the signature size compared to using a hash tree solely; for the hash tree structure, we design a specific authentication path in combination with the related communication model to further minimize the signature size; finally, we optimize the authentication approach to achieve the minimum signature size in a single transmission. Our construction minimizes the signature size in the aforementioned model, achieving a compression rate of 0.017 to 0.828 based on distinct values of parameters, as compared to XMSS-256. We also demonstrated that eBiBa can achieve post-quantum forward-secure and EUCMA security.

Abstract The existing physical layer security schemes, which are based on the key generation model and the wire-tap channel model, achieve security by utilizing channel reciprocity entropy and noise entropy, respectively. In contrast, we propose a novel secure transmission framework that combines noise entropy with reciprocity entropy, achieved by inserting reciprocity entropy into the frozen bits of polar codes. Note that in real-world scenarios, when eavesdroppers employ polynomial-time attacks, the bit error rate (BER) increases due to the introduction of computational entropy. To achieve indistinguishability security, we convert the practical physical layer security metric, BER, into the average min-entropy, a widely accepted concept in cryptography. The simulation results demonstrate that the eavesdropper’s BER can be significantly increased without compromising the communication performance of the legitimate receiver. Under concrete parameters we selected, when compared to the joint scheme of physical layer key generation and one time pad, the modular semantically-secure scheme based on the wire-tap channel model, and the simple channel entropy combination scheme, our scheme achieves a message rate approximately 1.2 times, 3.8 times, and 1.4 times better, respectively. Experimental testing validates the feasibility of our scheme.

Abstract Stealth address protocol (SAP) is widely used in blockchain to achieve anonymity. In this paper, we formalize a key derivable signature scheme (KDS) to capture the functionality and security requirements of SAP. We then propose a framework to construct key separation KDS, which follows the key separation principle as all existing SAP solutions to avoid the reuse of the master keys in the derivation and signature component. We also study the joint security in KDS and construct a key reusing KDS framework, which implies the first compact stealth address protocol using a single key pair. Finally, we provide instantiations based on the elliptic curve (widely used in cryptocurrencies) and on the lattice (with quantum resistance), respectively.

Abstract Homomorphic evaluation of hash functions offers a solution to the challenge of data integrity authentication in the context of homomorphic encryption. The earliest attempt to achieve homomorphic evaluation of SHA-256 hash function was proposed by Mella and Susella (in: Cryptography and coding—14th IMA international conference, IMACC 2013. Lecture notes in computer science, vol 8308. Springer, Heidelberg, pp 28–44, 2013. https://doi.org/10.1007/978-3-642-45239-0_3 .) based on the BGV scheme. Unfortunately, their implementation faced significant limitations due to the exceedingly high multiplicative depth, rendering it impractical. Recently, a homomorphic implementation of SHA-256 based on the TFHE scheme (Homomorphic evaluation of SHA-256. https://github.com/zama-ai/tfhe-rs/tree/main/tfhe/examples/sha256_bool ) brings it from theory to reality, however, its current efficiency remains insufficient. In this paper, we revisit the homomorphic evaluation of the SHA-256 hash function in the context of TFHE, further reducing the reliance on gate bootstrapping and enhancing evaluation latency. Specifically, we primarily utilize ternary gates to reduce the number of gate bootstrappings required for logic functions in message expansion and addition of modulo $$2^{32}$$ 2 32 in iterative compression. Furthermore, we demonstrate that our optimization techniques are applicable to the Chinese commercial cryptographic hash SM3. Finally, we give specific comparative implementations based on the TFHE-rs library. Experiments demonstrate that our optimization techniques lead to an improvement of approximately 35–50% compared with the state-of-the-art result under different cores.

AI-as-a-Service has emerged as an important trend for supporting the growth of the digital economy. Digital service providers make use of their vast amount of customer data to train AI models (such as image recognition, financial modelling and pandemic modelling etc) and offer them as a service on the cloud. While there are convincing advantages for using such third-party models, the fact that model users are required to upload their data to the cloud is bound to raise serious privacy concerns, especially in the face of increasingly stringent privacy regulations and legislation. To promote the adoption of AI-as-a-Service while addressing privacy issues, we propose a practical approach for constructing privacy-enhanced neural networks by designing an efficient implementation of fully homomorphic encryption. With this approach, an existing neural network can be converted to process FHE-encrypted data and produce encrypted output which are only accessible by the model users, and more importantly, within an operationally acceptable time (e.g. within 1 second for facial recognition in typical border control systems). Experimental results show that in many practical tasks such as facial recognition, text classification and so on, we obtained the state-of-the-art inference accuracy in less than one second on a 16 cores CPU.

The homomorphic encryption over the torus (TFHE) is a promising fully homomorphic encryption (FHE) scheme that allows arbitrary homomorphic computations with the programmable bootstrapping (PBS) algorithm. However, PBS suffers from prohibitive computation complexity and latency, which hinders the practical applications of TFHE. To address these challenges, we propose ALT, a field-programmable gate array (FPGA) accelerator for PBS that exhibits high area efficiency and low latency. Our approach involves modifying the parameters of the PBS algorithm to strike a balance between the computation complexity and the decryption failure rate (DFR). In addition, we leverage the Chinese residue theorem (CRT) to exploit the inherent parallelism and construct the primes to eliminate the need of CRT process and facilitate fast modular arithmetic. The ALT design comprises several carefully designed computation units, including inverse CRT (ICRT), divide-and-round (DR) operation, and monomial number theoretic transform (MNTT). We employ algorithmic and architectural co-optimization techniques to optimize these units. Notably, ALT features a low-complexity MNTT module, enabling the utilization of the bootstrapping key unrolling (BKU) technique with reduced latency and minimal hardware resources. Furthermore, all submodules of ALT are parameterized and scalable, allowing the entire design to be configurable according to varying requirements across different application scenarios. Experimental results on FPGA demonstrate that ALT significantly outperforms a similar configurable work in terms of latency, throughput, and efficiency. In comparison with the fastest FPGA implementation, ALT can realize lower latency while reducing digital signal processor (DSP) reduction by over$50\%$, leading to enhanced area efficiency and energy efficiency.

We proposed a physical layer secure communication system for massive MIMO systems, utilizing channel entropy as the foundation. Our approach involves extracting a mask key and a flip key from the singular value decomposition (SVD) of the channel matrix. The mask key ensures the protection of the flip key during transmission. By applying a random flip to the constellation diagram of the transmitted message based on the flip key, we introduce a scrambling effect that cannot be deciphered by eavesdroppers. The flip key is securely delivered to the receiver, allowing for the proper demodulation of the message by eliminating the constellation flip. To address the computational burden associated with estimating massive MIMO channels, we employ precoding of the downlink channel guide signal in the system design. This reduces the channel estimation overhead at the terminal. However, it also creates an equivalent channel for the eavesdropper, enabling them to correctly decode the precoded signal and compromise communication security. Our scheme counters this by introducing the constellation diagram flipping, which cannot be extracted by eavesdroppers, thereby preventing correct decoding. Simulation experiments confirm even with a large number of antennas, the eavesdropper is unable to completely counteract the effects of constellation flipping, thus ensuring communication security. In summary, by exploiting the singular value decomposition and employing constellation diagram flipping, our physical layer secure MIMO communication system based on channel entropy achieves secure communication even in the presence of powerful eavesdroppers.

Abstract The Learning With Errors (LWE) problem is widely used in lattice-based cryptography, which is the most promising post-quantum cryptography direction. There are a variety of LWE-solving methods, which can be classified into four groups: lattice methods, algebraic methods, combinatorial methods, and exhaustive searching. The Blum–Kalai–Wasserman (BKW) algorithm is an important variety of combinatorial algorithms, which was first presented for solving the Learning Parity With Noise (LPN) problem and then extended to solve LWE. In this paper, we give an overview of BKW algorithms for solving LWE. We introduce the framework and key techniques of BKW algorithms and make comparisons between different BKW algorithms and also with lattice methods by estimating concrete security of specific LWE instances. We also briefly discuss the current problems and potential future directions of BKW algorithms.

Abstract In this paper, we study the hybrid dual attack over learning with errors (LWE) problems for any secret distribution. Prior to our work, hybrid attacks are only considered for sparse and/or small secrets. A new and interesting result from our analysis shows that for most cryptographic use cases a hybrid dual attack outperforms a standalone dual attack, regardless of the secret distribution. We formulate our results into a framework of predicting the performance of the hybrid dual attacks. We also present a few tricks that further improve our attack. To illustrate the effectiveness of our result, we re-evaluate the security of all LWE related proposals in round 3 of NIST’s post-quantum cryptography process, and improve the state-of-the-art cryptanalysis results by 2-15 bits, under the BKZ-core-SVP model.

Abstract The current development toward quantum attack has shocked our confidence on classical digital signature schemes. As one of the mainstreams of post quantum cryptography primitives, hash-based signature has attracted more and more concern in both cryptographic research and application in recent years. The goal of this paper is to present, classify and discuss different solutions for hash-based signature. Firstly, this paper discusses the research progress in the component of hash-based signature, i.e., one-time signature and few-time signature; then classifies the tree-based public key authentication schemes of hash-based signature into limited number and stateful schemes, unlimited number and stateful schemes and unlimited number and stateless schemes. The above discussion aims to analyze the overall design idea of different categories of hash-based signatures, as well as the construction, security reduction and performance efficiency of specific schemes. Finally, the perspectives and possible development directions of hash-based signature are briefly discussed.

We present a secure backpropagation neural network training model (SecureBP), which allows a neural network to be trained while retaining the confidentiality of the training data, based on the homomorphic encryption scheme. We make two contributions. The first one is to introduce a method to find a more accurate and numerically stable polynomial approximation of functions in a certain interval. The second one is to find a strategy of refreshing ciphertext during training, which keeps the order of magnitude of noise at O˜e33 .

There only exists one deterministic identity-based encryption (DIBE) scheme which is adaptively secure in the auxiliary-input setting, under the learning with errors (LWE) assumption. However, the master public key consists of O(λ) basic matrices. In this paper, we consider to construct adaptively secure DIBE schemes with more compact public parameters from the LWE problem. (i) On the one hand, we gave a generic DIBE construction from lattice-based programmable hash functions with high min-entropy. (ii) On the other hand, when instantiating our generic DIBE construction with four LPHFs with high min-entropy, we can get four adaptively secure DIBE schemes with more compact public parameters. In one of our DIBE schemes, the master public key only consists of ω(log⁡λ) basic matrices.

In this paper, we propose a hierarchical identity-based encryption (HIBE) scheme in the random oracle (RO) model based on the learning with rounding (LWR) problem over small modulus $q$. Compared with the previous HIBE schemes based on the learning with errors (LWE) problem, the ciphertext expansion ratio of our scheme can be decreased to 1/2. Then, we utilize the HIBE scheme to construct a deterministic hierarchical identity-based encryption (D-HIBE) scheme based on the LWR problem over small modulus. Finally, with the technique of binary tree encryption (BTE) we can construct HIBE and D-HIBE schemes in the standard model based on the LWR problem over small modulus.