Cryptography

26 pages, 2464 KB

Open AccessArticle

by Wenwen Xia, Geng Wang and Dawu Gu

Cryptography 2026, 10(4), 57; https://doi.org/10.3390/cryptography10040057 - 13 Aug 2026

The integer factorization problem is a hard problem in classical. Let

N = P Q

, where P and Q are large primes. Pollard’s P-1 Algorithm is an efficient integer factorization algorithm while all the prime factors of

P - 1

are small. [...] Read more.

The integer factorization problem is a hard problem in classical. Let

N = P Q

, where P and Q are large primes. Pollard’s P-1 Algorithm is an efficient integer factorization algorithm while all the prime factors of

P - 1

are small. However, the previous variants of Pollard’s P-1 algorithms require a strict bound on the prime factors, and the running time depends on the bound instead of the actual size of prime factors, which is undesirable. This paper firstly designs a dynamic scaling version of Pollard’s P-1 Algorithm (abbreviate as

DSP

) to solve this problem and also accelerate the algorithm’s efficiency by applying a fast multiplication method to it. Additionally,

DSP

saves the cost in computing the product of prime factors with high enough exponent by repeatedly using product of primes with low exponent. We also give the complexity analysis for our proposed algorithm and the latest published variant of Pollard’s P-1 Algorithm named IPP1 (Kritsanapong Somsuk, Symmetry). Moreover, we give a theoretical comparison between IPP1 and our algorithm. In particular, we show that our algorithm costs less than IPP1 in more than 95% while in IPP1 the bound of prime factors of P-1 is set to at least 64. Additionally, we also test several instances in factoring 1024-bit integers

N = P Q

in experiment. We firstly construct the

P - 1

as a product of several randomly generated 30-bit numbers to ensure its solvability by the Pollard’s P-1 Algorithm, then test four variants of Pollard’s P-1 Algorithm. The experimental result shows that our algorithm is most efficient among them. Its efficiency improvement performs more apparently while the exponent of a prime factor in

P - 1

is large. In factoring 1024-bit integer, our algorithm solves it nearly 23.5 times faster than IPP1, 16.4 times faster than the Original Pollard’s P-1 Algorithm (J. M. Pollard, MPCPS), 35.6 times faster than the trivial Pollard’s P-1 Algorithm (D. Bishop, Introduction to cryptography with Java applets). Full article

(This article belongs to the Topic Trends and Prospects in Security, Encryption and Encoding: 2nd Edition)

17 pages, 384 KB

Open AccessArticle

A Closed-Form Hamming-Weight Variance Formula for Cyclic LCD Codes in Orthogonal Direct Sum Masking

by Guillermo Sosa-Gómez

Cryptography 2026, 10(4), 56; https://doi.org/10.3390/cryptography10040056 - 6 Aug 2026

Viewed by 139

Abstract

Orthogonal direct sum masking (ODSM) protects embedded cryptographic implementations against side-channel attacks by splitting the ambient space into a source code C carrying sensitive data and a complementary masking code D carrying fresh randomness; when

D = C^{⊥}

, C must be [...] Read more.

Orthogonal direct sum masking (ODSM) protects embedded cryptographic implementations against side-channel attacks by splitting the ambient space into a source code C carrying sensitive data and a complementary masking code D carrying fresh randomness; when

D = C^{⊥}

, C must be a linear complementary dual (LCD) code. Much of the literature evaluates the masking code primarily through the minimum distance

d (D^{⊥}) = d (C)

of its dual, treating this parameter as the quantitative summary of leakage resistance under a Hamming-weight leakage model. We show, first computationally and then via a general algebraic theorem, that this one parameter does not determine the variance of the masking code’s Hamming-weight distribution: cyclic codes with identical

d (C)

can differ by close to an order of magnitude in this variance. We prove, for an arbitrary cyclic code

C \subseteq GF {(q)}^{n}

with nonzero dual

D = C^{⊥}

and defining set T (the LCD property is not required for this algebraic result and is invoked only for the ODSM application), a closed-form theorem expressing

{Var}_{c \in D} [wt (c)]

exactly as

(q - 1) n^{2} / (q^{2} L (T))

, where

L (T)

is an intrinsically defined, representative-independent arithmetic invariant of T, computable via a single least-common-multiple of greatest-common-divisors and requiring no exponential-sum or Gauss-period evaluation. We verify the formula, with an explicit worked example, reproducible from the displayed defining sets, and zero discrepancies, against 64 independently constructed LCD cyclic codes spanning two finite fields and three code lengths. We are explicit that this variance is a second-order algebraic descriptor of leakage dispersion under an idealized leakage model, not a complete side-channel security metric; the connection to physical Hamming-weight leakage is direct for

q = 2

; for

q > 2

, the result stands as an exact coding-theoretic characterization whose relevance to physical bit-level leakage depends on an explicit bit-encoding model not developed here. We discuss its role as a design diagnostic for ODSM masking codes. This paper is, at its core, a contribution to the algebraic theory of cyclic codes: the reduction of the variance to a weight-two-codeword count is the classical Pless moment identity, and our closed-form arithmetic characterization of that count via

L (T)

is algebraically equivalent, on its domain, to a 2024 result of Coelho and Brochero Martínez; we extend it to arbitrary cyclic length and arbitrary prime-power base fields, and position it as a complement to, not a replacement for, the more operational dual-distance/kissing-number methodology already used in the code-based masking literature. Full article

21 pages, 8530 KB

Open AccessArticle

Energy Consumption of Post-Quantum Cryptography on Constrained and General-Purpose Architectures

by Olivier Gillot, William J. Buchanan and Madjid G. Tehrani

Cryptography 2026, 10(4), 55; https://doi.org/10.3390/cryptography10040055 - 3 Aug 2026

Viewed by 407

Abstract

With Q-day approaching, the transition to post-quantum cryptography (PQC) has begun, with governments across the US, UK and EU mandating migration to quantum-resistant standards. This paper benchmarks the three NIST-standardised PQC algorithms—FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA)—across key generation, [...] Read more.

With Q-day approaching, the transition to post-quantum cryptography (PQC) has begun, with governments across the US, UK and EU mandating migration to quantum-resistant standards. This paper benchmarks the three NIST-standardised PQC algorithms—FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA)—across key generation, signing and verification operations, measuring both computational performance and energy consumption on a range of constrained IoT-class devices, from the 32-bit Raspberry Pi 1 and Zero to the 64-bit Raspberry Pi 4, as well as commodity laptop hardware. Using the FNIRSI FNB58 USB power meter and OpenSSL 3.5, results show that ML-KEM and ML-DSA achieve energy and speed efficiency comparable to classical elliptic-curve cryptography across all tested architectures. However, SLH-DSA signing is inadvisable on constrained hardware: energy costs for SLH-DSA signing on 32-bit devices were up to 243% higher than on equivalent 64-bit hardware, making it impractical for resource-limited IoT deployments. These findings have direct implications for IoT security practitioners planning PQC migration. Full article

► Show Figures

Figure 1

11 pages, 292 KB

Open AccessArticle

Amortized Σ-Protocol for MLWE Problem

by Qi Li and Shaojun Yang

Cryptography 2026, 10(4), 54; https://doi.org/10.3390/cryptography10040054 - 2 Aug 2026

Viewed by 130

Abstract

MLWE is a fundamental hard problem in post-quantum lattice cryptography. Standard

Σ

-protocols perform poorly for multiple MLWE statements due to high communication and computation costs. This paper presents an amortized

Σ

-protocol for MLWE using a lightweight fold-split-fold technique that decomposes norm-bounded [...] Read more.

MLWE is a fundamental hard problem in post-quantum lattice cryptography. Standard

Σ

-protocols perform poorly for multiple MLWE statements due to high communication and computation costs. This paper presents an amortized

Σ

-protocol for MLWE using a lightweight fold-split-fold technique that decomposes norm-bounded error vectors without relying on NTT, MLE, or sum-check protocols. The protocol achieves completeness, special soundness, and non-abort SHVZK with constant-round interaction and lightweight verification. The construction avoids complex tools and provides an efficient batch proof mechanism, offering a simple and practical solution for post-quantum cryptographic applications. Full article

41 pages, 6723 KB

Open AccessReview

Architecting Quantum-Resilient Blockchains: A Systems Framework for Post-Quantum Security, Governance, and Migration

by Hamed Taherdoost

Cryptography 2026, 10(4), 53; https://doi.org/10.3390/cryptography10040053 - 1 Aug 2026

Viewed by 325

Abstract

Quantum computing poses a significant threat to blockchain systems that rely on elliptic curve cryptography and other classical security mechanisms. Algorithms such as Shor’s and Grover’s can weaken or completely break the cryptographic foundations of current blockchain networks, exposing them to risks including [...] Read more.

Quantum computing poses a significant threat to blockchain systems that rely on elliptic curve cryptography and other classical security mechanisms. Algorithms such as Shor’s and Grover’s can weaken or completely break the cryptographic foundations of current blockchain networks, exposing them to risks including private key recovery, transaction forgery, consensus manipulation, and harvest-now-decrypt-later attacks. This paper presents a systems framework for designing quantum-resilient blockchains by integrating post-quantum cryptographic standards, threat modeling, architectural redesign, governance mechanisms, and migration planning. The study evaluates major post-quantum cryptographic primitives, assesses their suitability for blockchain environments, and proposes a layered architecture grounded in crypto-agility, defense-in-depth, and forward secrecy. A structured migration strategy is also introduced to support the transition of existing blockchain networks toward post-quantum security while maintaining operational continuity and stakeholder trust. The framework provides practical guidance for researchers, developers, and policymakers preparing blockchain ecosystems for the post-quantum era. Full article

(This article belongs to the Special Issue Advances in Post-Quantum Cryptography)

► Show Figures

Figure 1

36 pages, 624 KB

Open AccessArticle

Dipper: A Lightweight Hybrid SPN–ARX Block Cipher

by Ali Huseynli, Yadigar Imamverdiyev and Jalal Alizadeh

Cryptography 2026, 10(4), 52; https://doi.org/10.3390/cryptography10040052 - 21 Jul 2026

Viewed by 418

Abstract

We present Dipper, a lightweight 64-bit block cipher with 96-bit and 128-bit key variants, built on a 28-round hybrid SPN–ARX structure. Each round applies a full-state key addition, sixteen parallel 4-bit GIFT S-boxes, four word-wise rotations, two 16-bit modular additions over half of [...] Read more.

We present Dipper, a lightweight 64-bit block cipher with 96-bit and 128-bit key variants, built on a 28-round hybrid SPN–ARX structure. Each round applies a full-state key addition, sixteen parallel 4-bit GIFT S-boxes, four word-wise rotations, two 16-bit modular additions over half of the state, and the GIFT-64 bit permutation, combining the compact substitution layer of GIFT-style designs with the diffusion efficiency of ARX operations. We evaluate Dipper from both hardware and cryptanalytic perspectives under a single, fully open-source methodology. Round-based Verilog implementations were synthesized alongside PRESENT, GIFT, and SIMON variants using an identical Yosys + ABC + Nangate45 flow. Under this flow, Dipper-64/96 and Dipper-64/128 require 2498 and 2824 gate equivalents (GE), respectively, both falling between GIFT-64-128 (2191 GE) and PRESENT-128 (2963 GE); notably, Dipper-64/128 is more compact than PRESENT-128 at the same key size, despite incorporating an additional ARX diffusion layer. A broader comparison re-implements eleven established lightweight ciphers under the same flow, and post-place-and-route FPGA results on Lattice ECP5, measured software timings, and Cortex-M memory footprints support deployment across RFID, sensor-node, and edge-gateway scenarios. For differential resistance, we develop a mixed-integer linear programming (MILP) model that couples the exact GIFT differential distribution table with a Lipmaa–Moriai encoding of modular addition. Predicted and empirical differential probabilities agree tightly for reduced-round variants, while five-round trails reveal differential clustering. The security evaluation further includes proven-optimal linear trail bounds up to ten rounds, an exhaustive impossible-differential search bounding the longest distinguisher at five rounds, and experimental integral distinguishers of at most five rounds, leaving the 28-round cipher a margin close to 3× against the longest identified distinguisher. All RTL, synthesis scripts, reference implementations, and MILP models are released for full reproducibility. Full article

► Show Figures

Figure 1

27 pages, 1443 KB

Open AccessArticle

A No-Degradation Framework for Augmenting Operating-System Randomness with Publicly Observable Dynamic Data Sources

by Mohammad Dashti

Cryptography 2026, 10(4), 51; https://doi.org/10.3390/cryptography10040051 - 18 Jul 2026

Viewed by 308

Abstract

Modern cryptography depends on the quality of the operating-system entropy pool, and historic failures of that pool have shown that randomness, not algorithm strength, is often the weakest link of a deployed cryptosystem. Hardware True-Random Number Generators (TRNGs) mitigate this risk but are [...] Read more.

Modern cryptography depends on the quality of the operating-system entropy pool, and historic failures of that pool have shown that randomness, not algorithm strength, is often the weakest link of a deployed cryptosystem. Hardware True-Random Number Generators (TRNGs) mitigate this risk but are not universally available or trusted. This paper develops a unified four-stage construction, extract → condition → mix → derive, that admits heterogeneous publicly observable dynamic data sources as auxiliary inputs to the operating-system randomness pipeline. The construction’s central claim is a no-degradation defence-in-depth property, formalised as Theorem 1: under a pseudorandom-function assumption on the conditioning function, the composed output is computationally indistinguishable from the operating-system output alone, even when an adversary fully controls the public source. The framework does not claim that public sources supply secret entropy against an adversary who also observes them; it claims only that mixing them in cannot weaken the baseline, and that any uncompromised source supplies residual unpredictability under operating-system-generator compromise. We instantiate the framework in three pipelines—aircraft state vectors from a public sensor network, webcam frame-differencing of a wall of lava lamps, and computer-vision tracking of vehicles on a public traffic-camera feed—and argue soundness by combining the theorem with published evaluations of each source. On a 381 kbit corpus of framework-derived keys, every applicable NIST SP 800-22 test and SP 800-90B entropy estimator finds the framework output statistically indistinguishable from an os.urandom baseline; this is consistent with no-degradation but not in itself evidence of marginal entropy gain, and per-pipeline raw-input measurements and source-ablation runs are deferred to empirical follow-up. Off-the-shelf computer-vision tooling is sufficient to operationalise the framework on commodity hardware. Full article

► Show Figures

Figure 1

32 pages, 545 KB

Open AccessArticle

A Secure and Ultra-Lightweight Authentication Protocol for RFID Systems Using Epoch-Based Pseudonym Indexing

by Pierre E. Abi-Char, Mehdi Al Housseini and Mohammed Al-Husseini

Cryptography 2026, 10(4), 50; https://doi.org/10.3390/cryptography10040050 - 13 Jul 2026

Viewed by 336

Abstract

Mobile Radio Frequency Identification (RFID) systems are emerging as a fundamental part of modern smart environments, enabling automatic identification, tracking, and data exchange among different mobile platforms. While these systems are increasingly being adopted, they have a major drawback: an RFID tag has [...] Read more.

Mobile Radio Frequency Identification (RFID) systems are emerging as a fundamental part of modern smart environments, enabling automatic identification, tracking, and data exchange among different mobile platforms. While these systems are increasingly being adopted, they have a major drawback: an RFID tag has very little computational power, and the wireless communication channels can be attacked by adversaries. Several authentication and key management mechanisms to protect data and provide secure access have been proposed to solve these problems. In this study, we propose a new scheme that improves system security through explicit three-party mutual authentication, epoch-based pseudonym indexing for

O (1)

server lookup, and comprehensive resiliency against replay, impersonation, and man-in-the-middle attacks. An in-depth security analysis, along with performance evaluation, substantiates that the proposed protocol improves privacy and resilience without losing compatibility with low-cost RFID tags equipped only to perform lightweight cryptographic functions. This protocol also provides epoch-based unlinkability and is well suited for large-scale deployments, as found in healthcare, logistics, and Internet of Things (IoT) applications. Full article

(This article belongs to the Section Hardware Security)

► Show Figures

Figure 1

34 pages, 6962 KB

Open AccessReview

A Brief Survey on Hardware Implementation of Fully Homomorphic Encryption

by Yang Su, Kaixuan Zhou, Weidong Zhong, Jianfei Wang, Jia Hou and Chen Yang

Cryptography 2026, 10(4), 49; https://doi.org/10.3390/cryptography10040049 - 13 Jul 2026

Viewed by 638

Abstract

Leveraging the favorable properties of cryptographic computation, FHE effectively ensures data availability without visibility, thereby holding broad application prospects in cloud computing security and data privacy protection. However, computational efficiency remains a critical bottleneck that constrains its practical deployment and further development. Consequently, [...] Read more.

Leveraging the favorable properties of cryptographic computation, FHE effectively ensures data availability without visibility, thereby holding broad application prospects in cloud computing security and data privacy protection. However, computational efficiency remains a critical bottleneck that constrains its practical deployment and further development. Consequently, research on hardware implementations of FHE has become a major direction in the cryptographic community. This paper first systematically reviews the research progress of FHE schemes, summarizing and analyzing the characteristics of representative FHE schemes. Subsequently, we survey and analyze hardware research progress and optimization techniques from the perspectives of overall accelerator architecture design, polynomial multiplier design, and integer modular multiplier design, highlighting the main advantages, disadvantages, and common features of different hardware structures. Finally, based on an analysis of existing hardware implementation architectures for FHE, this paper presents the potential deficiencies, summarizes and outlines future research directions and development prospects, aiming to further improve the operational performance of FHE hardware implementations. Full article

(This article belongs to the Topic Trends and Prospects in Security, Encryption and Encoding: 2nd Edition)

► Show Figures

Figure 1

27 pages, 397 KB

Open AccessArticle

An Extended Coppersmith-Based Attack on RSA

by Mohammed Rahmani, Abderrahmane Nitaj and Mhammed Ziane

Cryptography 2026, 10(4), 48; https://doi.org/10.3390/cryptography10040048 - 11 Jul 2026

Viewed by 289

Abstract

Lattice-based cryptanalysis has become one of the most powerful tools for evaluating the security of the RSA cryptosystem. Most existing attacks rely on the classical key equation

e d - k φ (N) = 1

and are effective mainly when the [...] Read more.

Lattice-based cryptanalysis has become one of the most powerful tools for evaluating the security of the RSA cryptosystem. Most existing attacks rely on the classical key equation

e d - k φ (N) = 1

and are effective mainly when the decryption exponent is sufficiently small or when significant information about the RSA prime factors is available. However, the dependence on this classical equation restricts the applicability of existing attacks and limits the range of weak exponents that can be targeted. In this paper, we propose a generalized lattice-based technique for solving the extended key equation

e r - x φ (N) = s

when an approximation of one of the RSA primes is known and the parameters r, x, and s are suitably small. By transforming this relation into an appropriate modular equation and applying Coppersmith’s method, we derive conditions under which the RSA modulus can be factored in polynomial time, even when the corresponding private exponent is large. Our analysis encompasses several well-known attacks as special cases and significantly enlarges the class of vulnerable RSA exponents. Consequently, the proposed framework remains effective in settings where classical lattice-based approaches are no longer applicable. Full article

18 pages, 1546 KB

Open AccessArticle

ML-KEM (CRYSTALS-Kyber) on FPGA Using the Residue Number System

by Abdullah Alhassani and Mohammed Benaissa

Cryptography 2026, 10(4), 47; https://doi.org/10.3390/cryptography10040047 - 10 Jul 2026

Viewed by 492

Abstract

The NIST standardisation process for Post-Quantum Cryptography (PQC) has nominated the CRYSTALS-Kyber Key-Encapsulation Mechanism (KEM) scheme as the primary key establishment method. The algorithm was renamed as the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). This work proposes an efficient design for ML-KEM on FPGA with [...] Read more.

The NIST standardisation process for Post-Quantum Cryptography (PQC) has nominated the CRYSTALS-Kyber Key-Encapsulation Mechanism (KEM) scheme as the primary key establishment method. The algorithm was renamed as the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). This work proposes an efficient design for ML-KEM on FPGA with built-in side-channel attack (SCA) protection. The design is based on combining two methodologies: the Residue Number System (RNS) arithmetic and the look-up tables implementation. At the arithmetic level in the number-theoretic transform (NTT) computation of the polynomial multiplication, the operations are spread across the RNS channels, and these computations are implemented using look-up tables. The use of look-up tables resulted in low-latency RNS implementation and higher performance. The proposed design, implemented on Xilinx Artix-7 FPGA, shows higher performance with a reasonable increase in area, whilst the experimental TVLA results demonstrate the design’s SCA protection advantages. Full article

► Show Figures

Figure 1

24 pages, 621 KB

Open AccessArticle

Efficient Verifiable Computation for Support Vector Machine Training over Secret-Shared Data

by Shimao Yu, Liang Su and Hanlin Zhang

Cryptography 2026, 10(4), 46; https://doi.org/10.3390/cryptography10040046 - 3 Jul 2026

Viewed by 1190

Abstract

The outsourcing of machine learning tasks, such as Support Vector Machine (SVM) training, to cloud platforms poses significant security challenges, primarily concerning the confidentiality of sensitive training data and the integrity of computation results returned by potentially malicious servers. To address these challenges, [...] Read more.

The outsourcing of machine learning tasks, such as Support Vector Machine (SVM) training, to cloud platforms poses significant security challenges, primarily concerning the confidentiality of sensitive training data and the integrity of computation results returned by potentially malicious servers. To address these challenges, this paper proposes a lightweight, privacy-preserving, and verifiable SVM training scheme designed for resource-constrained clients. Our scheme leverages a replicated secret sharing protocol to securely distribute training data and model parameters across multiple non-colluding servers, executing the entire collaborative training process in the share domain without leaking plaintext information. Furthermore, to guarantee computational correctness, we introduce a novel interval-based index point storage strategy combined with a bilinear mapping-based parameter label consistency check. This verifiable mechanism enables clients to perform sampled, lightweight audits of the cloud’s intermediate training states and final outputs. Experimental evaluations on multiple typical datasets demonstrate that the proposed scheme maintains stable classification performance while achieving an order-of-magnitude decrease in training runtime compared with existing ciphertext-based methods, offering a highly configurable trade-off among verification coverage, computational overhead, and storage cost. Full article

(This article belongs to the Special Issue Advanced Information Security Solutions for Future and Efficient IoT, Wireless, and Localization Systems)

► Show Figures

Figure 1

20 pages, 2416 KB

Open AccessArticle

A Lightweight Accelerator for the LESS Digital Signature Scheme

by Giuseppe Cutrera, Alessandra Dolmeta, Valeria Piscopo, Maurizio Martina and Guido Masera

Cryptography 2026, 10(4), 45; https://doi.org/10.3390/cryptography10040045 - 3 Jul 2026

Viewed by 543

Abstract

The Linear Equivalence Signature Scheme (LESS) is a code-based post-quantum candidate in the National Institute of Standards and Technology’s (NIST) standardization process for additional digital signatures. In this paper, we present an area-efficient FPGA accelerator for the Reduced Row Echelon Form (RREF) kernel [...] Read more.

The Linear Equivalence Signature Scheme (LESS) is a code-based post-quantum candidate in the National Institute of Standards and Technology’s (NIST) standardization process for additional digital signatures. In this paper, we present an area-efficient FPGA accelerator for the Reduced Row Echelon Form (RREF) kernel of LESS, designed for embedded RISC-V SoCs where resource overhead is the primary constraint. Our architecture targets the scheme’s primary computational bottleneck: the linear-algebra core responsible for RREF processing. By implementing an optimized pivot-reuse workflow, our design significantly reduces redundant row-reduction operations across related computations. The accelerator features a matrix-oriented execution engine paired with a streaming control interface to minimize synchronization overhead. Implementation on a Xilinx Artix-7 FPGA shows that despite its compact footprint, the accelerator achieves up to 21× speedup over the embedded software RREF baseline. By prioritizing a minimalist footprint, our design requires only 1.38 to 8.7 KeSlice, depending on the targeted security level. By covering all LESS security levels and providing comparisons with existing post-quantum cryptographic hardware, this work establishes a performance baseline for a signature scheme that has remained largely unexplored in the hardware domain. Full article

(This article belongs to the Special Issue Advances in Post-Quantum Cryptography)

► Show Figures

Figure 1

28 pages, 3857 KB

Open AccessArticle

CipherAPR: Accelerating RNS-CKKS Encrypted Inference via Importance-Guided and Level-Aware Mixed-Degree Polynomial Design

by Junping Wan, Yucen Liao, Yinglong Liao, Zejiu Tan, Jinming Xu, Zoe L. Jiang and Binxing Fang

Cryptography 2026, 10(4), 44; https://doi.org/10.3390/cryptography10040044 - 2 Jul 2026

Viewed by 393

Abstract

Fully Homomorphic Encryption (FHE) enables Machine Learning as a Service (MLaaS) providers to perform inference over encrypted data, preserving user privacy. In the RNS-CKKS FHE scheme, however, ReLU activations must be replaced with polynomials. High-degree polynomial approximations preserve accuracy but consume more ciphertext [...] Read more.

Fully Homomorphic Encryption (FHE) enables Machine Learning as a Service (MLaaS) providers to perform inference over encrypted data, preserving user privacy. In the RNS-CKKS FHE scheme, however, ReLU activations must be replaced with polynomials. High-degree polynomial approximations preserve accuracy but consume more ciphertext levels, triggering costly bootstrapping operations. Existing mixed-degree methods reduce the bootstrapping count by assigning different polynomial degrees across layers. However, recent FHE compiler research shows that reducing the bootstrapping count alone is insufficient to fully accelerate inference, because bootstrapping placement and the level budget restored after each operation also significantly affect performance. Incorporating such execution-side factors into mixed-degree design substantially enlarges the search space, making straightforward extensions of existing methods computationally infeasible. We propose CipherAPR, an importance-guided framework for level-aware mixed-degree polynomial design. CipherAPR introduces the Low-Magnitude Activation Ratio (LMAR) to prioritize degree updates on accuracy-sensitive layers, combines Domain-Adaptive Approximation (DAAP) with Multi-Objective Coefficient Tuning (MOCT) to produce reusable polynomial approximations that consume fewer ciphertext levels, and applies ciphertext-level utilization (CLU) to filter configurations with poor restored-level utilization. Lightweight latency and accuracy estimators further accelerate offline candidate screening. Experiments on ResNet and VGG show that CipherAPR achieves a 1.09×–1.39× speedup over AutoFHE with comparable accuracy. Full article

► Show Figures

Figure 1

11 pages, 301 KB

Open AccessArticle

Near-Bent Boolean Functions Are Insufficient for Correlation-Robust Hashing: A Spectral Obstruction and an Information-Theoretic Frontier

by Guillermo Sosa-Gómez

Cryptography 2026, 10(4), 43; https://doi.org/10.3390/cryptography10040043 - 26 Jun 2026

Viewed by 293

Abstract

Oblivious Transfer (OT) extension, in particular, the construction of Ishai, Kilian, Nissim, and Petrank (CRYPTO 2003) requires a hash function H that is correlation-robust(CR). All practical instantiations model H as a random oracle or an ideal cipher, leaving CR with no quantifiable reduction [...] Read more.

Oblivious Transfer (OT) extension, in particular, the construction of Ishai, Kilian, Nissim, and Petrank (CRYPTO 2003) requires a hash function H that is correlation-robust(CR). All practical instantiations model H as a random oracle or an ideal cipher, leaving CR with no quantifiable reduction to a structural property of the deployed hash. It is natural to ask whether the most nonlinear balanced Boolean functions available on an odd number of variables, the near-bent functions of the Maiorana–McFarland (MM) class, furnish an algebraic, standard-model CR candidate. We prove that they do not, and we identify precisely why. First, we keep a correct spectral fact: a balanced

H : {0, 1}^{n} \to {0, 1}

is

ε

-CR if and only if

\max_{Δ \neq 0} | A_{f} (Δ) | \leq 4 ε \cdot 2^{n}

, reducing CR to an autocorrelation bound. Against this criterion we establish three obstructions: (i) The MM-doubling family

{NB}_{k}

on

n = 2 k + 1

variables has autocorrelation supported only on the directions

(a, 0, 1)

, where it equals

2^{k + 1} W_{a}

with

\sum_{a \neq 0} W_{a}^{2} = 2^{2 k}

; hence

ε \geq \frac{1}{4} {(2^{k} - 1)}^{- 1 / 2}

, a factor

\geq 2^{k / 2}

above the value one would need, and an exhaustive search over all balanced members for

k \leq 2

returns the maximal

ε = \frac{1}{4}

in every case. (ii) Near-bentness controls the Walsh maximum (nonlinearity), not autocorrelation: every near-bent function satisfies

\sum_{Δ \neq 0} A_{f} {(Δ)}^{2} = 2^{2 n}

, so

\max_{Δ \neq 0} | A_{f} (Δ) | \geq 2^{n} {(2^{n} - 1)}^{- 1 / 2}

and no near-bent function is even approximately CR. (iii) A deterministic

H : {0, 1}^{κ} \to {0, 1}^{ℓ}

admits the support bound

SD ((H (x), H (x \oplus Δ)), (U_{ℓ}, U_{ℓ})) \geq 1 - 2^{κ - 2 ℓ}

, so statistical multi-output CR is impossible for

ℓ > κ / 2

and in particular at the IKNP regime

ℓ \approx κ

. Together, these results close the near-bent route to standard-model CR and clarify which design objective (low absolute indicator, not high nonlinearity) and which parameter regime (

ℓ \leq κ / 2

) a viable algebraic candidate would have to target. Full article

Journal Menu

Journal Browser

Cryptography, Volume 10, Issue 4 (August 2026) – 15 articles

Further Information

Guidelines

MDPI Initiatives

Follow MDPI