Cryptography doi: 10.3390/cryptography10040057

Authors: Wenwen Xia Geng Wang Dawu Gu

The integer factorization problem is a hard problem in classical. Let N=PQ, where P and Q are large primes. Pollard’s P-1 Algorithm is an efficient integer factorization algorithm while all the prime factors of P−1 are small. However, the previous variants of Pollard’s P-1 algorithms require a strict bound on the prime factors, and the running time depends on the bound instead of the actual size of prime factors, which is undesirable. This paper firstly designs a dynamic scaling version of Pollard’s P-1 Algorithm (abbreviate as DSP) to solve this problem and also accelerate the algorithm’s efficiency by applying a fast multiplication method to it. Additionally, DSP saves the cost in computing the product of prime factors with high enough exponent by repeatedly using product of primes with low exponent. We also give the complexity analysis for our proposed algorithm and the latest published variant of Pollard’s P-1 Algorithm named IPP1 (Kritsanapong Somsuk, Symmetry). Moreover, we give a theoretical comparison between IPP1 and our algorithm. In particular, we show that our algorithm costs less than IPP1 in more than 95% while in IPP1 the bound of prime factors of P-1 is set to at least 64. Additionally, we also test several instances in factoring 1024-bit integers N=PQ in experiment. We firstly construct the P−1 as a product of several randomly generated 30-bit numbers to ensure its solvability by the Pollard’s P-1 Algorithm, then test four variants of Pollard’s P-1 Algorithm. The experimental result shows that our algorithm is most efficient among them. Its efficiency improvement performs more apparently while the exponent of a prime factor in P−1 is large. In factoring 1024-bit integer, our algorithm solves it nearly 23.5 times faster than IPP1, 16.4 times faster than the Original Pollard’s P-1 Algorithm (J. M. Pollard, MPCPS), 35.6 times faster than the trivial Pollard’s P-1 Algorithm (D. Bishop, Introduction to cryptography with Java applets).

Cryptography doi: 10.3390/cryptography10040056

Authors: Guillermo Sosa-Gómez

Orthogonal direct sum masking (ODSM) protects embedded cryptographic implementations against side-channel attacks by splitting the ambient space into a source code C carrying sensitive data and a complementary masking code D carrying fresh randomness; when D=C⊥, C must be a linear complementary dual (LCD) code. Much of the literature evaluates the masking code primarily through the minimum distance d(D⊥)=d(C) of its dual, treating this parameter as the quantitative summary of leakage resistance under a Hamming-weight leakage model. We show, first computationally and then via a general algebraic theorem, that this one parameter does not determine the variance of the masking code’s Hamming-weight distribution: cyclic codes with identical d(C) can differ by close to an order of magnitude in this variance. We prove, for an arbitrary cyclic code C⊆GF(q)n with nonzero dual D=C⊥ and defining set T (the LCD property is not required for this algebraic result and is invoked only for the ODSM application), a closed-form theorem expressing Varc∈D[wt(c)] exactly as (q−1)n2/(q2L(T)), where L(T) is an intrinsically defined, representative-independent arithmetic invariant of T, computable via a single least-common-multiple of greatest-common-divisors and requiring no exponential-sum or Gauss-period evaluation. We verify the formula, with an explicit worked example, reproducible from the displayed defining sets, and zero discrepancies, against 64 independently constructed LCD cyclic codes spanning two finite fields and three code lengths. We are explicit that this variance is a second-order algebraic descriptor of leakage dispersion under an idealized leakage model, not a complete side-channel security metric; the connection to physical Hamming-weight leakage is direct for q=2; for q>2, the result stands as an exact coding-theoretic characterization whose relevance to physical bit-level leakage depends on an explicit bit-encoding model not developed here. We discuss its role as a design diagnostic for ODSM masking codes. This paper is, at its core, a contribution to the algebraic theory of cyclic codes: the reduction of the variance to a weight-two-codeword count is the classical Pless moment identity, and our closed-form arithmetic characterization of that count via L(T) is algebraically equivalent, on its domain, to a 2024 result of Coelho and Brochero Martínez; we extend it to arbitrary cyclic length and arbitrary prime-power base fields, and position it as a complement to, not a replacement for, the more operational dual-distance/kissing-number methodology already used in the code-based masking literature.

Cryptography doi: 10.3390/cryptography10040055

Authors: Olivier Gillot William J. Buchanan Madjid G. Tehrani

With Q-day approaching, the transition to post-quantum cryptography (PQC) has begun, with governments across the US, UK and EU mandating migration to quantum-resistant standards. This paper benchmarks the three NIST-standardised PQC algorithms—FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA)—across key generation, signing and verification operations, measuring both computational performance and energy consumption on a range of constrained IoT-class devices, from the 32-bit Raspberry Pi 1 and Zero to the 64-bit Raspberry Pi 4, as well as commodity laptop hardware. Using the FNIRSI FNB58 USB power meter and OpenSSL 3.5, results show that ML-KEM and ML-DSA achieve energy and speed efficiency comparable to classical elliptic-curve cryptography across all tested architectures. However, SLH-DSA signing is inadvisable on constrained hardware: energy costs for SLH-DSA signing on 32-bit devices were up to 243% higher than on equivalent 64-bit hardware, making it impractical for resource-limited IoT deployments. These findings have direct implications for IoT security practitioners planning PQC migration.

Cryptography doi: 10.3390/cryptography10040054

Authors: Qi Li Shaojun Yang

MLWE is a fundamental hard problem in post-quantum lattice cryptography. Standard Σ-protocols perform poorly for multiple MLWE statements due to high communication and computation costs. This paper presents an amortized Σ-protocol for MLWE using a lightweight fold-split-fold technique that decomposes norm-bounded error vectors without relying on NTT, MLE, or sum-check protocols. The protocol achieves completeness, special soundness, and non-abort SHVZK with constant-round interaction and lightweight verification. The construction avoids complex tools and provides an efficient batch proof mechanism, offering a simple and practical solution for post-quantum cryptographic applications.

Cryptography doi: 10.3390/cryptography10040053

Authors: Hamed Taherdoost

Quantum computing poses a significant threat to blockchain systems that rely on elliptic curve cryptography and other classical security mechanisms. Algorithms such as Shor’s and Grover’s can weaken or completely break the cryptographic foundations of current blockchain networks, exposing them to risks including private key recovery, transaction forgery, consensus manipulation, and harvest-now-decrypt-later attacks. This paper presents a systems framework for designing quantum-resilient blockchains by integrating post-quantum cryptographic standards, threat modeling, architectural redesign, governance mechanisms, and migration planning. The study evaluates major post-quantum cryptographic primitives, assesses their suitability for blockchain environments, and proposes a layered architecture grounded in crypto-agility, defense-in-depth, and forward secrecy. A structured migration strategy is also introduced to support the transition of existing blockchain networks toward post-quantum security while maintaining operational continuity and stakeholder trust. The framework provides practical guidance for researchers, developers, and policymakers preparing blockchain ecosystems for the post-quantum era.

Cryptography doi: 10.3390/cryptography10040052

Authors: Ali Huseynli Yadigar Imamverdiyev Jalal Alizadeh

We present Dipper, a lightweight 64-bit block cipher with 96-bit and 128-bit key variants, built on a 28-round hybrid SPN–ARX structure. Each round applies a full-state key addition, sixteen parallel 4-bit GIFT S-boxes, four word-wise rotations, two 16-bit modular additions over half of the state, and the GIFT-64 bit permutation, combining the compact substitution layer of GIFT-style designs with the diffusion efficiency of ARX operations. We evaluate Dipper from both hardware and cryptanalytic perspectives under a single, fully open-source methodology. Round-based Verilog implementations were synthesized alongside PRESENT, GIFT, and SIMON variants using an identical Yosys + ABC + Nangate45 flow. Under this flow, Dipper-64/96 and Dipper-64/128 require 2498 and 2824 gate equivalents (GE), respectively, both falling between GIFT-64-128 (2191 GE) and PRESENT-128 (2963 GE); notably, Dipper-64/128 is more compact than PRESENT-128 at the same key size, despite incorporating an additional ARX diffusion layer. A broader comparison re-implements eleven established lightweight ciphers under the same flow, and post-place-and-route FPGA results on Lattice ECP5, measured software timings, and Cortex-M memory footprints support deployment across RFID, sensor-node, and edge-gateway scenarios. For differential resistance, we develop a mixed-integer linear programming (MILP) model that couples the exact GIFT differential distribution table with a Lipmaa–Moriai encoding of modular addition. Predicted and empirical differential probabilities agree tightly for reduced-round variants, while five-round trails reveal differential clustering. The security evaluation further includes proven-optimal linear trail bounds up to ten rounds, an exhaustive impossible-differential search bounding the longest distinguisher at five rounds, and experimental integral distinguishers of at most five rounds, leaving the 28-round cipher a margin close to 3× against the longest identified distinguisher. All RTL, synthesis scripts, reference implementations, and MILP models are released for full reproducibility.

Cryptography doi: 10.3390/cryptography10040051

Authors: Mohammad Dashti

Modern cryptography depends on the quality of the operating-system entropy pool, and historic failures of that pool have shown that randomness, not algorithm strength, is often the weakest link of a deployed cryptosystem. Hardware True-Random Number Generators (TRNGs) mitigate this risk but are not universally available or trusted. This paper develops a unified four-stage construction, extract → condition → mix → derive, that admits heterogeneous publicly observable dynamic data sources as auxiliary inputs to the operating-system randomness pipeline. The construction’s central claim is a no-degradation defence-in-depth property, formalised as Theorem 1: under a pseudorandom-function assumption on the conditioning function, the composed output is computationally indistinguishable from the operating-system output alone, even when an adversary fully controls the public source. The framework does not claim that public sources supply secret entropy against an adversary who also observes them; it claims only that mixing them in cannot weaken the baseline, and that any uncompromised source supplies residual unpredictability under operating-system-generator compromise. We instantiate the framework in three pipelines—aircraft state vectors from a public sensor network, webcam frame-differencing of a wall of lava lamps, and computer-vision tracking of vehicles on a public traffic-camera feed—and argue soundness by combining the theorem with published evaluations of each source. On a 381 kbit corpus of framework-derived keys, every applicable NIST SP 800-22 test and SP 800-90B entropy estimator finds the framework output statistically indistinguishable from an os.urandom baseline; this is consistent with no-degradation but not in itself evidence of marginal entropy gain, and per-pipeline raw-input measurements and source-ablation runs are deferred to empirical follow-up. Off-the-shelf computer-vision tooling is sufficient to operationalise the framework on commodity hardware.

Cryptography doi: 10.3390/cryptography10040050

Authors: Pierre E. Abi-Char Mehdi Al Housseini Mohammed Al-Husseini

Mobile Radio Frequency Identification (RFID) systems are emerging as a fundamental part of modern smart environments, enabling automatic identification, tracking, and data exchange among different mobile platforms. While these systems are increasingly being adopted, they have a major drawback: an RFID tag has very little computational power, and the wireless communication channels can be attacked by adversaries. Several authentication and key management mechanisms to protect data and provide secure access have been proposed to solve these problems. In this study, we propose a new scheme that improves system security through explicit three-party mutual authentication, epoch-based pseudonym indexing for O(1) server lookup, and comprehensive resiliency against replay, impersonation, and man-in-the-middle attacks. An in-depth security analysis, along with performance evaluation, substantiates that the proposed protocol improves privacy and resilience without losing compatibility with low-cost RFID tags equipped only to perform lightweight cryptographic functions. This protocol also provides epoch-based unlinkability and is well suited for large-scale deployments, as found in healthcare, logistics, and Internet of Things (IoT) applications.

Cryptography doi: 10.3390/cryptography10040049

Authors: Yang Su Kaixuan Zhou Weidong Zhong Jianfei Wang Jia Hou Chen Yang

Leveraging the favorable properties of cryptographic computation, FHE effectively ensures data availability without visibility, thereby holding broad application prospects in cloud computing security and data privacy protection. However, computational efficiency remains a critical bottleneck that constrains its practical deployment and further development. Consequently, research on hardware implementations of FHE has become a major direction in the cryptographic community. This paper first systematically reviews the research progress of FHE schemes, summarizing and analyzing the characteristics of representative FHE schemes. Subsequently, we survey and analyze hardware research progress and optimization techniques from the perspectives of overall accelerator architecture design, polynomial multiplier design, and integer modular multiplier design, highlighting the main advantages, disadvantages, and common features of different hardware structures. Finally, based on an analysis of existing hardware implementation architectures for FHE, this paper presents the potential deficiencies, summarizes and outlines future research directions and development prospects, aiming to further improve the operational performance of FHE hardware implementations.

Cryptography doi: 10.3390/cryptography10040048

Authors: Mohammed Rahmani Abderrahmane Nitaj Mhammed Ziane

Lattice-based cryptanalysis has become one of the most powerful tools for evaluating the security of the RSA cryptosystem. Most existing attacks rely on the classical key equation ed−kφ(N)=1 and are effective mainly when the decryption exponent is sufficiently small or when significant information about the RSA prime factors is available. However, the dependence on this classical equation restricts the applicability of existing attacks and limits the range of weak exponents that can be targeted. In this paper, we propose a generalized lattice-based technique for solving the extended key equation er−xφ(N)=s when an approximation of one of the RSA primes is known and the parameters r, x, and s are suitably small. By transforming this relation into an appropriate modular equation and applying Coppersmith’s method, we derive conditions under which the RSA modulus can be factored in polynomial time, even when the corresponding private exponent is large. Our analysis encompasses several well-known attacks as special cases and significantly enlarges the class of vulnerable RSA exponents. Consequently, the proposed framework remains effective in settings where classical lattice-based approaches are no longer applicable.

Cryptography doi: 10.3390/cryptography10040047

Authors: Abdullah Alhassani Mohammed Benaissa

The NIST standardisation process for Post-Quantum Cryptography (PQC) has nominated the CRYSTALS-Kyber Key-Encapsulation Mechanism (KEM) scheme as the primary key establishment method. The algorithm was renamed as the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). This work proposes an efficient design for ML-KEM on FPGA with built-in side-channel attack (SCA) protection. The design is based on combining two methodologies: the Residue Number System (RNS) arithmetic and the look-up tables implementation. At the arithmetic level in the number-theoretic transform (NTT) computation of the polynomial multiplication, the operations are spread across the RNS channels, and these computations are implemented using look-up tables. The use of look-up tables resulted in low-latency RNS implementation and higher performance. The proposed design, implemented on Xilinx Artix-7 FPGA, shows higher performance with a reasonable increase in area, whilst the experimental TVLA results demonstrate the design’s SCA protection advantages.

Cryptography doi: 10.3390/cryptography10040046

Authors: Shimao Yu Liang Su Hanlin Zhang

The outsourcing of machine learning tasks, such as Support Vector Machine (SVM) training, to cloud platforms poses significant security challenges, primarily concerning the confidentiality of sensitive training data and the integrity of computation results returned by potentially malicious servers. To address these challenges, this paper proposes a lightweight, privacy-preserving, and verifiable SVM training scheme designed for resource-constrained clients. Our scheme leverages a replicated secret sharing protocol to securely distribute training data and model parameters across multiple non-colluding servers, executing the entire collaborative training process in the share domain without leaking plaintext information. Furthermore, to guarantee computational correctness, we introduce a novel interval-based index point storage strategy combined with a bilinear mapping-based parameter label consistency check. This verifiable mechanism enables clients to perform sampled, lightweight audits of the cloud’s intermediate training states and final outputs. Experimental evaluations on multiple typical datasets demonstrate that the proposed scheme maintains stable classification performance while achieving an order-of-magnitude decrease in training runtime compared with existing ciphertext-based methods, offering a highly configurable trade-off among verification coverage, computational overhead, and storage cost.

Cryptography doi: 10.3390/cryptography10040045

Authors: Giuseppe Cutrera Alessandra Dolmeta Valeria Piscopo Maurizio Martina Guido Masera

The Linear Equivalence Signature Scheme (LESS) is a code-based post-quantum candidate in the National Institute of Standards and Technology’s (NIST) standardization process for additional digital signatures. In this paper, we present an area-efficient FPGA accelerator for the Reduced Row Echelon Form (RREF) kernel of LESS, designed for embedded RISC-V SoCs where resource overhead is the primary constraint. Our architecture targets the scheme’s primary computational bottleneck: the linear-algebra core responsible for RREF processing. By implementing an optimized pivot-reuse workflow, our design significantly reduces redundant row-reduction operations across related computations. The accelerator features a matrix-oriented execution engine paired with a streaming control interface to minimize synchronization overhead. Implementation on a Xilinx Artix-7 FPGA shows that despite its compact footprint, the accelerator achieves up to 21× speedup over the embedded software RREF baseline. By prioritizing a minimalist footprint, our design requires only 1.38 to 8.7 KeSlice, depending on the targeted security level. By covering all LESS security levels and providing comparisons with existing post-quantum cryptographic hardware, this work establishes a performance baseline for a signature scheme that has remained largely unexplored in the hardware domain.

Cryptography doi: 10.3390/cryptography10040044

Authors: Junping Wan Yucen Liao Yinglong Liao Zejiu Tan Jinming Xu Zoe L. Jiang Binxing Fang

Fully Homomorphic Encryption (FHE) enables Machine Learning as a Service (MLaaS) providers to perform inference over encrypted data, preserving user privacy. In the RNS-CKKS FHE scheme, however, ReLU activations must be replaced with polynomials. High-degree polynomial approximations preserve accuracy but consume more ciphertext levels, triggering costly bootstrapping operations. Existing mixed-degree methods reduce the bootstrapping count by assigning different polynomial degrees across layers. However, recent FHE compiler research shows that reducing the bootstrapping count alone is insufficient to fully accelerate inference, because bootstrapping placement and the level budget restored after each operation also significantly affect performance. Incorporating such execution-side factors into mixed-degree design substantially enlarges the search space, making straightforward extensions of existing methods computationally infeasible. We propose CipherAPR, an importance-guided framework for level-aware mixed-degree polynomial design. CipherAPR introduces the Low-Magnitude Activation Ratio (LMAR) to prioritize degree updates on accuracy-sensitive layers, combines Domain-Adaptive Approximation (DAAP) with Multi-Objective Coefficient Tuning (MOCT) to produce reusable polynomial approximations that consume fewer ciphertext levels, and applies ciphertext-level utilization (CLU) to filter configurations with poor restored-level utilization. Lightweight latency and accuracy estimators further accelerate offline candidate screening. Experiments on ResNet and VGG show that CipherAPR achieves a 1.09×–1.39× speedup over AutoFHE with comparable accuracy.

Cryptography doi: 10.3390/cryptography10040043

Authors: Guillermo Sosa-Gómez

Oblivious Transfer (OT) extension, in particular, the construction of Ishai, Kilian, Nissim, and Petrank (CRYPTO 2003) requires a hash function H that is correlation-robust(CR). All practical instantiations model H as a random oracle or an ideal cipher, leaving CR with no quantifiable reduction to a structural property of the deployed hash. It is natural to ask whether the most nonlinear balanced Boolean functions available on an odd number of variables, the near-bent functions of the Maiorana–McFarland (MM) class, furnish an algebraic, standard-model CR candidate. We prove that they do not, and we identify precisely why. First, we keep a correct spectral fact: a balanced H:{0,1}n→{0,1} is ε-CR if and only if maxΔ≠0|Af(Δ)|≤4ε·2n, reducing CR to an autocorrelation bound. Against this criterion we establish three obstructions: (i) The MM-doubling family NBk on n=2k+1 variables has autocorrelation supported only on the directions (a,0,1), where it equals 2k+1Wa with ∑a≠0Wa2=22k; hence ε≥14(2k−1)−1/2, a factor ≥2k/2 above the value one would need, and an exhaustive search over all balanced members for k≤2 returns the maximal ε=14 in every case. (ii) Near-bentness controls the Walsh maximum (nonlinearity), not autocorrelation: every near-bent function satisfies ∑Δ≠0Af(Δ)2=22n, so maxΔ≠0|Af(Δ)|≥2n(2n−1)−1/2 and no near-bent function is even approximately CR. (iii) A deterministic H:{0,1}κ→{0,1}ℓ admits the support bound SD(H(x),H(x⊕Δ)),(Uℓ,Uℓ)≥1−2κ−2ℓ, so statistical multi-output CR is impossible for ℓ>κ/2 and in particular at the IKNP regime ℓ≈κ. Together, these results close the near-bent route to standard-model CR and clarify which design objective (low absolute indicator, not high nonlinearity) and which parameter regime (ℓ≤κ/2) a viable algebraic candidate would have to target.

Cryptography doi: 10.3390/cryptography10030042

Authors: Hongjuan Kang Bing Guo Yufang Sun Mingjie Zhao Xin Chen Kui Ye

In the past decade, the high computational overhead of asymmetric cryptography has remained a central challenge in end-to-end secure communication systems. To mitigate the performance bottlenecks inherent in the full SM2 encryption and decryption workflow, this paper introduces ParaSM2, a parallel restructuring optimization framework tailored for SM2-based cryptographic operations. ParaSM2 exploits the observed 2:1 processing ratio between KDF and HASH to perform cross-component parallel restructuring and applies fixed-prefix reuse together with dynamic task parallelism to eliminate 39.7% of redundant KDF computations. Furthermore, a vectorized reconstruction of the HASH message extension is incorporated to leverage SIMD parallel acceleration, thereby substantially enhancing throughput. Experimental evaluations against SM4-GCM and SM4-CBC on data blocks larger than 64 KB demonstrate that ParaSM2 achieves up to a 5.1× performance improvement on both x86 and ARM architectures, effectively reducing end-to-end latency and providing a scalable pathway for algorithmic optimization in cryptography across heterogeneous platforms.

Cryptography doi: 10.3390/cryptography10030041

Authors: Robert Campbell

Post-Quantum Cryptography (PQC) migration to National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) 203, 204, and 205 under the National Security Agency (NSA) Commercial National Security Algorithm Suite (CNSA) 2.0 is a multi-year, multi-domain transformation across cloud, enterprise, embedded, operational technology (OT), tactical, and national-security systems. Anthropic’s Claude Mythos Preview (April 2026) introduces artificial intelligence (AI)-accelerated cybersecurity capabilities that intersect this migration directly, performing autonomous reasoning against previously unknown vulnerabilities in production software—a qualitative departure from signature-based and static and dynamic application security testing (SAST/DAST) tooling. Drawing on federal guidance from NIST, NSA, the Office of Management and Budget (OMB), and the Cybersecurity and Infrastructure Security Agency (CISA), and on independent analyses from the Centre for Emerging Technology and Security (CETaS) and the UK AI Security Institute, we present a lifecycle and architecture analysis of how Mythos-class models alter PQC migration timelines, risk surfaces, lifecycle dependencies, and architectural constraints. Modeling Mythos as both accelerator and destabilizer, we derive an analytic projection of a compressed two-to-four-year migration window for highest-exposure systems, against traditional baselines of five-to-ten years for small organizations and twelve-to-fifteen-plus years for large enterprises. The compression collapses human-labor bottlenecks in discovery, planning, and code modification, not cryptography itself. We propose a lifecycle-aligned migration model, an updated cost model, and governance requirements for frontier-model access. The binding constraint shifts domain-conditionally: defender capacity at adversary tempo governs software-analytical phases, while non-compressible external cadence governs embedded and regulated domains.

Cryptography doi: 10.3390/cryptography10030040

Authors: Mengce Zheng Yansong Feng Abderrahmane Nitaj Yanbin Pan

In this study, we propose a hybrid cryptanalytic technique targeting the RSA cryptosystem when instantiated with small private exponents. By integrating the continued fraction approach with Coppersmith’s lattice-based technique, we formulate a novel vulnerability framework. Utilizing an innovative relationship extracted from continued fraction convergents, we deduce an improved upper bound for the secret key: d<N1−α/3−γ/2. In this context, α:=logNe and γ:=logN|p+q−S|, where S serves as a known approximation of the prime sum p+q. As an extension of our preliminary conference proceedings, this paper supplies comprehensive proofs for all theoretical propositions, performs a comprehensive parameter sensitivity evaluation, and provides bounds for partial prime exposure scenarios. Empirical evaluations confirm the theoretical mechanics of our framework, demonstrating that it offers improved bounds in specific partial leakage scenarios compared to traditional lattice-only baselines.

Cryptography doi: 10.3390/cryptography10030039

Authors: Nedal Y. Al-Tamimi Mahmoud AlJamal Mohammad Q. Al-Jamal Ayoub Alsarhan Sami Aziz Alshammari Nayef H. Alshammari Khalid Hamad Alnafisah Mohammed Kamel Aleinzi

UAV-based remote sensing systems are increasingly deployed in smart surveillance, disaster response, environmental monitoring, and critical infrastructure inspection. In these applications, aerial sensing platforms must transmit telemetry, control commands, and observation data securely and reliably under strict latency, energy, and computational constraints. However, existing security approaches often fail to jointly provide lightweight payload confidentiality, quantum-resilient key establishment, and adaptive communication protection suitable for dynamic and resource-constrained aerial sensing environments. To address this challenge, this paper proposes an energy-aware post-quantum hybrid cryptographic framework for secure and low-latency UAV remote sensing communications in UAV–IoT mission networks. The proposed framework integrates Ascon-based authenticated encryption for low-overhead protection of remote sensing payloads and mission telemetry, ML-KEM-based post-quantum session-key establishment for long-term resilience against quantum-era threats, and an AI-driven adaptive rekeying mechanism that dynamically adjusts key-refresh decisions according to threat level, residual energy, mobility state, channel stability, anomaly density, traffic sensitivity, link type, and mission progression. Accordingly, rekeying is treated not as a static maintenance process but as an intelligent and context-aware cryptographic control function that adapts communication security to evolving mission and sensing conditions. The framework is evaluated across twenty progressively demanding scenarios involving different UAV counts, sensor densities, payload sizes, communication modes, and adversarial settings relevant to real-time remote sensing operations. Experimental results demonstrate a secure delivery rate of 99.2%, attack detection and mitigation effectiveness of 98.9%, end-to-end encryption latency of 8.7 ms, throughput of 5.03 Mbps, energy overhead of 11.6 mJ/session, rekeying overhead of 2.9 mJ/event, session resilience of 96.4%, and integrity verification success of 99.1%. These findings show that the proposed framework provides a practical and scalable contribution to post-quantum secure UAV remote sensing by unifying lightweight authenticated encryption, ML-KEM-based quantum-resilient key establishment, and AI-driven adaptive rekeying within a resilient aerial–terrestrial communication architecture.

Cryptography doi: 10.3390/cryptography10030038

Authors: Yuqi Jia Leyou Zhang

Multi-party private set union (MPSU) allows multiple parties to compute a union without disclosing private inputs, but most existing protocols focus on balanced settings with comparable input sizes. In large-repository update scenarios, a leader maintains a massive base set while contributors submit small update sets; directly using balanced MPSU makes the online cost scale with the leader’s repository size. We propose AegisUnion, an asymmetric MPSU protocol tailored to large-repository updates. AegisUnion separates repository-dependent computation from online update processing through an offline oblivious key-value store (OKVS) encoding phase. In the online phase, contributors perform private membership determination, cross-contributor private deduplication, conditional payload sharing, and secret-shared shuffling, without revealing raw inputs, repository-overlap relations, inter-contributor duplicates, or the source of each output element. Under the semi-honest model, AegisUnion tolerates any coalition of corrupted parties as long as at least one party remains honest, without non-collusion assumptions. Experiments show that, as the repository grows from 214 to 218, the online time remains stable at 663–715 ms. At repository size 218 and contributor update bound 210, AegisUnion achieves about 455× and 454× lower online time than symmetric-key-based MPSU and public-key-based MPSU baselines, respectively, and about 271× and 575× lower online communication.

Cryptography doi: 10.3390/cryptography10030037

Authors: Guanglu Wei Tiecheng Bai Zehua Fan Gang Wu Wenxu Chen Peng Qin Kai Fan

In 2021, the SM9 identity-based cryptographic algorithm became an ISO/IEC international standard, marking a significant advancement in China’s commercial cryptography technology and international standardization capabilities. The SM9 key exchange protocol, a component of the SM9 algorithm suite, provides secure communication by establishing a shared symmetric key between two parties. However, in a group of n users, directly applying this key exchange protocol requires each user to perform O(n) encryption operations and transmit an O(n)-sized ciphertext to ensure confidentiality, which becomes highly inefficient for large groups. To enable efficient secure group communication, we first develop a batch multi-signature algorithm based on SM9, and then we propose a dynamic asymmetric group key agreement (SMDAGKA) protocol based on this method. Our protocol reduces the required encryption operations and ciphertext size to O(1), significantly improving efficiency. Security proofs demonstrate that our scheme achieves a high level of security, and performance analysis shows that it incurs relatively lower computational overhead than related protocols.

Cryptography doi: 10.3390/cryptography10030036

Authors: Biswaranjan Senapati Lalit Narayan Mishra Awad Bin Naeem Amit J. Rangari

Private cloud object stores provide infrastructure isolation but leave application-layer data exposed to insider threats and compromised credentials. This paper presents an engineering integration of an Add-Rotate-XOR (ARX) block cipher and multi-bit Least Significant Bit (LSB) steganography into an end-to-end pipeline for private MinIO object storage. The cipher, KREA v2, is a SPECK-64/128 derived ARX construction with three application-driven choices: CRC32 key whitening, byte-aligned rotations (α=7, β=2), and deterministic CTR-mode nonces. Mixed Integer Linear Programming (MILP) trail analysis matches SPECK-64/128’s minimum-trail weights through rounds 1–4. KREA v2 ciphertext meets standard keystream-quality preconditions (NIST SP 800-22 battery, 49.98% mean avalanche, Shannon entropy 7.9992–7.9998 bits/byte across realistic XML, JSON, video, and HTTP/2 payloads). Modified LSB (MLSB) embeds 3 bits per RGB channel with an XOR watermark at 37–38 dB Peak Signal-to-Noise Ratio (PSNR), providing 3× standard-LSB capacity. Steganalysis uses chi-square and RS detectors plus a Convolutional Neural Network (CNN) detector (Yedroudj-Net) trained on 8000 BOSSBase-1.01 cover/stego pairs; CNN area under the ROC curve is ≥0.999 against the watermarked variant. The MinIO pipeline runs at 355.1 ms (68.6% network I/O) with 100% message fidelity. The XOR watermark increases RS detectability above 75% capacity; a 200-image ablation cuts median RS detection (0.289 to 0.000) and mean (0.342 to 0.130) in a sparse-keystream variant, prioritised for follow-on full-scale evaluation. The architecture is offered as a documented engineering integration with explicit security caveats and threat-model boundaries, not as a production-hardened cryptographic primitive.

Cryptography doi: 10.3390/cryptography10030035

Authors: Xueyi Tang Kexin Qiao Qinghao Wu Licheng Wang

Quantum computing poses significant challenges to traditional zero-knowledge proof schemes based on number-theoretic assumptions. As a result, code-based cryptography has attracted increasing attention for its resistance against quantum computing. In this paper, we study the Rank Syndrome Decoding problem (RSD) and investigate its ZK proof formulation within the MPC-in-the-Head framework. To prove the possession of a secret witness, we reformulate the secret witness as a mixed-field matrix multiplication preserving the rank constraint, and then obtain a representation that aligns naturally with the local-view paradigm of MPC-in-the-Head. Utilizing this value-to-calculation technique, we introduce the RSD relation into a ZKBoo-style (2, 3)-secret-sharing MPC-in-the-Head framework and obtain an RSD-based zero-knowledge proof scheme via mixed-field secret sharing. The resulting scheme reduces the proof size relative to generic formulations while preserving completeness, soundness, and zero-knowledge for the interactive protocol. The Fiat–Shamir non-interactive extension is analyzed only in the classical random oracle model; we do not claim QROM security for this variant.

Cryptography doi: 10.3390/cryptography10030034

Authors: Tolegen Aidynov Dina Satybaldina Gulsipat Abisheva Eldor Egamberdiyev

Electronic voting requires the simultaneous admission of only legitimate participants, ballot uniqueness, vote confidentiality, storage integrity, and result verifiability. Blockchain alone does not solve these problems, since ledger immutability does not guarantee anonymity, ballot correctness, or reduced trust concentration. The purpose of this work is to develop a parameterizable research framework for electronic voting scenarios with enhanced cryptographic protection, allowing the security level to be varied according to the requirements of a voting scenario. The main contribution of the work is a parameterizable research architecture for composing and experimentally comparing electronic voting configurations with different security and computational profiles. The cryptographic and audit mechanisms integrated into this architecture include blind-signature-based anonymous authorization, encrypted ballot submission, blockchain-style audit, receipt verification, homomorphic tally publication, and threshold-supported tally artifacts. These mechanisms are not proposed as new cryptographic primitives; rather, they are integrated into a reproducible prototype to study how their combination affects verifiability, privacy support, auditability, and computational cost. Compared with basic blockchain-based voting prototypes, this architecture explicitly separates security, privacy, and verifiability profiles and makes their computational cost observable. The implemented prototype is used as an experimental platform for analyzing supported security properties, threat modeling, and computational cost estimation. The results show that authentication, anonymous token issuance, and receipt verification maintain an almost constant cost at the studied scale, while the main cryptographic burden is associated with encrypted ballot submission and threshold-supported tally publication. The scientific novelty of the work lies in constructing a parameterizable architecture that integrates several cryptographic mechanisms and a blockchain audit layer into one reproducible research prototype. At the same time, the proposed approach retains prototype-level limitations associated with the absence of a full zero-knowledge proof stack, independently deployed threshold authorities, and coercion-resistance mechanisms.

Cryptography doi: 10.3390/cryptography10030033

Authors: Yuteng Wang Ruoyu Ding Tianrun Yu Zhen Han Jian Weng Jiasi Weng

Proxy signatures enable the secure delegation of signing authority, which is particularly useful in resource-constrained Internet of Things (IoT) environments. However, most existing schemes rely on classical hardness assumptions and therefore cannot resist quantum attacks. To address the challenge, we propose a post-quantum proxy signature scheme based on Dilithium for IoT scenarios. We first propose an asynchronous remote key generation (ARKG) scheme based on CRYSTALS-Kyber, enabling the delegator and proxy signer to generate proxy keys of Dilithium without real-time interaction. We further integrate ARKG with the Dilithium signature scheme to construct a proxy signature scheme called DPS while ensuring the unlinkability of proxy signatures. Additionally, our proposed DPS achieves post-quantum security and provides unforgeability, distinguishability, verifiability, and undeniability with formal proofs. Experimental performance evaluation shows that our scheme yields significant efficiency gains over existing quantum-safe proxy signature solutions, with 10× speedup for both the delegation and proxy signing phases, as well as a 2.4× improvement in the verification phase.

Cryptography doi: 10.3390/cryptography10030032

Authors: Riley Vaughn Mike Borowczak

A cryptographic hash function should dissipate patterns, such that highly related inputs are transformed into unrelated outputs. This property, known as diffusion, has been effectively measured on SHA-256 via the Strict Avalanche Criterion (SAC) throughout the 64 rounds of compression. Additionally, variants of SHA-256 with individual sub-functions removed have previously been tested. In this study, the previous work is expanded; all combinations of the seven SHA-256 sub-functions are tested for SAC, throughout the 64 rounds of compression. The threshold as to whether a variant passes the SAC is calculated with the Bonferroni Method, which results in a relaxed threshold as compared to previous measures. The SAC of each sub-function variant is compared with the SAC of variants with shared sub-functions. The sub-functions Σ1, Integer Addition, Choose, and Message Scheduler are found to consistently contribute to SAC at the earliest rounds, throughout all combinations.

Cryptography doi: 10.3390/cryptography10030031

Authors: Shouvik Paul Garima Bajwa

Electroencephalography (EEG)-based brain–computer interface (BCI) systems pose significant privacy risks, as EEG data remain vulnerable to inference and reconstruction attacks. Conventional privacy-preserving techniques, including data anonymization, encryption, and perturbation, frequently compromise data utility or prove ineffective against advanced adversaries. To address these limitations and balance utility and privacy, we propose a quantum-inspired, differential privacy-based generative adversarial network (Q-DP-GAN). Unlike classical GANs, which lack adaptive privacy mechanisms during training, our method uses quantum-inspired stochasticity to dynamically calibrate noise and the privacy budget. The experimental results demonstrate that Q-DP-GAN is more robust to membership inference and reconstruction attacks than existing approaches. Evaluation on the widely used BCI Competition IV Datasets 2A and 2B indicates that our framework produces high-quality synthetic EEG data while maintaining utility and data confidentiality for BCI classification tasks.

Cryptography doi: 10.3390/cryptography10030030

Authors: Elmin Marevac Esad Kadušić Nataša Živić Sanela Nesimović Christoph Ruland

Deploying post-quantum cryptography on highly constrained devices remains challenging due to the large key sizes and substantial storage and memory-traffic demands of leading lattice-based schemes. Although constructions such as Kyber, Dilithium, and NTRU offer strong resistance against quantum adversaries, their multi-kilobyte public keys and intensive memory access patterns limit practical adoption in microcontrollers, smart cards, and low-power edge environments. This work proposes a hybrid key-encapsulation mechanism that integrates a compact, seed-generated Module-LWE structure with a quantum-secure hash-based authentication layer. The design employs a small public seed to instantiate lattice matrices on demand via a lightweight pseudorandom generator and incorporates a Merkle-tree commitment to represent compressed auxiliary error information. Additional design considerations—including sparsity-aware secret keys, SIMD-friendly polynomial operations, and cache-efficient decryption paths—are intended to reduce runtime memory usage and computational overhead. The security of the proposed construction is analysed under both Module-LWE and hash-based one-way assumptions, with further consideration of constant-time execution and cache-line alignment to mitigate side-channel risks. This hybrid approach outlines a design pathway toward post-quantum key-encapsulation mechanisms suitable for deployment on memory-limited and energy-constrained platforms.

Cryptography doi: 10.3390/cryptography10030029

Authors: Eckhard Pfluegel Razi Arshad Mark Jones

Secret sharing schemes distribute a secret among participants so that only authorised subsets can reconstruct it. In this paper, we focus on space-efficient secret sharing and show that matrix normal forms can significantly reduce share sizes while achieving computational security properties. Our scheme is implemented within an online secret sharing architecture, where authenticated public data P is maintained and shares of private data Q are issued over a secure channel. We study an existing probabilistic matrix-based approach to share size reduction and prove that the expected number of iterations of the underlying cyclic vector algorithm is small, yielding an expected polynomial runtime. We then design a novel deterministic method based on the Frobenius canonical normal form, avoiding reliance on cyclic vector techniques, and derive its runtime complexity. This yields a space-efficient secret sharing scheme that is computationally secure under a suitably defined adversary model. We have implemented our algorithm in the computer algebra system Maple as an Open Source project and provide an evaluation of its performance. Our results demonstrate that matrix normal forms can provide a suitable mathematical framework for secure and practical secret sharing.

Cryptography doi: 10.3390/cryptography10030028

Authors: Alfonso F. De Abiega-L’Eglisse Kevin A. Delgado-Vargas Humberto A. Ortega Alcocer Gina Gallegos-García Eliseo Sarmiento-Rosales

Modern instant messaging systems require end-to-end (E2E) security guarantees while operating over server-mediated infrastructures that cannot be fully trusted. At the same time, the impending transition to post-quantum cryptography raises nontrivial challenges for the design of secure messaging protocols that preserve these guarantees. In this work, we present the design of a post-quantum end-to-end secure protocol for instant messaging applications under an untrusted relay model. The proposed construction relies on lattice-based primitives standardized by NIST, namely ML-KEM for key establishment and ML-DSA for authentication, and follows a Double-KEM pattern combined with explicit context binding to derive an E2E session key known only to the communicating clients. The server acts solely as an authenticated relay and never gains access to plaintext messages or session keys. In addition to the protocol design, we complement the protocol description with an automated symbolic verification using ProVerif, establishing injective mutual authentication and session-key secrecy under a Dolev–Yao adversary model. Finally, we characterize the computational cost of different authentication and verification policies and evaluate the performance of the handshake on heterogeneous cloud-based architectures. The results provide practical insight into the feasibility of deploying post-quantum end-to-end secure protocols within existing instant messaging infrastructures.

Cryptography doi: 10.3390/cryptography10020027

Authors: Maksim Iavich Tamari Kuchukhidze Razvan Bocu

Polynomial commitment schemes (PCS) enable a prover to commit to a polynomial and later reveal evaluations with succinct, verifiable proofs. As critical components of modern cryptographic systems like Verkle trees and zk-SNARKs, these methods are experiencing a significant transition from classical to post-quantum designs. This comprehensive research systematically compares the major scheme families to examine this progression, from pairing-based KZG and transparent Bulletproofs to lattice-based and hash-based post-quantum alternatives. We present a unified taxonomy that maps the classical-to-post-quantum transition across trust models, security assumptions, and efficiency measures after conducting a PRISMA-guided systematic review of 77 works. Our analysis reveals a fundamental trade-off between efficiency and security: classical schemes, which rely on quantum-vulnerable assumptions, provide optimal performance with constant-sized proofs, while post-quantum alternatives offer quantum resistance at the cost of larger proofs and higher computational overhead. By combining research works, we highlight recurrent problems with adaptive security, verification efficiency, and proof conciseness. We offer a specific research roadmap with prioritized short-, medium-, and long-term directions to close the performance gap between quantum-resistant and classical architectures based on our quantitative analysis. This study offers a technical reference and a strategic roadmap for constructing practical post-quantum polynomial commitments.

Cryptography doi: 10.3390/cryptography10020026

Authors: Alessandro Caniglia Felice Franchini Stefano Galantucci Giuseppe Pirlo Gianfranco Semeraro

Classical approaches to cryptography exhibit several limitations when applied to scenarios involving more than two users. The One-Time User Key (OTUK) meta-cryptographic model addresses these limitations by enabling multi-user encryption that is flexible, applicable to any cryptographic algorithm, and designed for systematic deployment without compromising system security. Each user possesses an individual key from which One-Time keys are derived; these keys feed a secret-sharing function (ω) that establishes the multi-user encrypted channel. In this paper, we present a polynomial-based implementation of the ω function under a (1,n) threshold model. The generated polynomial has roots at points corresponding to valid user keys and is mapped to the real encryption key. We provide a formal threat model, pseudocode for the complete protocol, and a detailed computational analysis across the numerical domains N, Z, and R. Furthermore, we present experimental benchmarks measuring encryption/decryption speed, scalability up to 30 users, parameter sensitivity, and a comparative evaluation against Shamir’s Secret Sharing scheme. A systematic security analysis examines partial-information attacks, derivative-root distance margins, and brute-force resistance, demonstrating that the effective security margin remains above 245 bits for configurations of up to 30 users with 256-bit keys. The proposed method offers a concrete, efficient, and secure foundation for multi-user encrypted communication in domains such as IoT, public administration, and e-health.

Cryptography doi: 10.3390/cryptography10020025

Authors: Antonio Francesco Gentile Maria Cilione

While general network dynamics have been extensively modeled using stochastic methods, the emergence of dense Internet of Things (IoT) ecosystems demands a more specialized analytical framework. IoT environments are characterized by extreme non-linearity and sensitivity to initial conditions, where traditional models often fail to account for chaotic latency and packet loss. This paper introduces a specialized approach that integrates Chaos Theory with the innovative paradigm of Vibe Coding—an AI-assisted development and analysis methodology that allows for the ‘encoding’ and interpretation of the dynamic ‘vibe’ or signature of network fluctuations in real-time. By categorizing network behavior into four distinct scenarios (quiescent, perturbed, attacked, and perturbed–Attacked), the proposed framework utilizes deep learning to transform chaotic signals into actionable intelligence. Our findings demonstrate that this specialized synergy between chaos analysis and Vibe Coding provides superior classification of adversarial threats, such as DoS and injection attacks, fostering intelligent native security for next-generation IoT infrastructures.

Cryptography doi: 10.3390/cryptography10020024

Authors: Dušan Čatloch Peter Pekarčík Eva Chovancová

Post-quantum cryptography represents one of the most promising areas of modern cryptography. The development in this discipline significantly accelerated after it became of interest to the National Institute of Standards and Technology (NIST). One of the important research directions in this area is the practical deployment of post-quantum cryptographic algorithms on resource-constrained devices. In this article, we investigate the possibility of deploying post-quantum cryptography on small processors with limited random access memory (RAM) capacity. These processors are commonly used in Internet of Things (IoT) devices, where the practical deployment of post-quantum algorithms remains challenging due to computational and memory constraints. We select a suitable algorithm and perform several implementation modifications that enable its execution on microcontrollers with limited memory resources.

Cryptography doi: 10.3390/cryptography10020023

Authors: Zhen Li Kexin Qiang Yiming Yang Zongyue Wang An Wang

In side-channel analysis, simple power analysis (SPA) is a widely used technique for recovering secret information by exploiting differences between operations in traces. However, in realistic measurement environments, SPA is often hindered by noise, temporal misalignment, and weak or transient leakage, which obscure secret-dependent features in single or very few power traces. In this paper, we provide a systematic analysis of moving-skewness-based trace preprocessing for enhancing asymmetric leakage characteristics relevant to SPA. The method computes local skewness within a moving window along the trace, transforming the original signal into a skewness trace that emphasizes distributional asymmetry while suppressing noise. Unlike conventional smoothing-based preprocessing techniques, the proposed approach preserves and can even amplify subtle leakage patterns and spike-like transient events that are often attenuated by low-pass filtering or moving-average methods. To further improve applicability under different leakage conditions, we introduce feature-driven window-selection strategies that align preprocessing parameters with various leakage characteristics. Both simulated datasets and real measurement traces collected from multiple cryptographic platforms are used to evaluate the effectiveness of the approach. The experimental results indicate that moving-skewness preprocessing improves leakage visibility and achieves higher SPA success rates compared to commonly used preprocessing methods.

Cryptography doi: 10.3390/cryptography10020022

Authors: Minghui Zheng Anqi Xiao Shicheng Huang Deju Kong

With the advancement in quantum computing technology, the number theory-based hard problems underlying traditional searchable encryption algorithms are now vulnerable to efficient quantum attacks. To address this challenge, this paper proposes Dilithium-PAEKS (Dilithium-Public Authenticated Encryption with Keyword Search), a searchable encryption scheme based on the post-quantum cryptographic algorithm CRYSTALS-Dilithium. By transforming the verification relationship of digital signatures into a matching relationship between trapdoors and ciphertexts, the scheme not only meets the functional requirements of searchable encryption but also demonstrates quantum resistance. The implementation enhances algorithm efficiency through keyword-based signatures and dynamic matching testing mechanisms. The security of the scheme is defined by the MLWE and MSIS hard problems, with proofs of keyword ciphertext indistinguishability and trapdoor indistinguishability under the random oracle model. Additionally, the scheme provides strong resistance against both outside and insider keyword guessing attacks through sender–receiver binding mechanisms and trapdoor indistinguishability properties. Experimental results show that, compared to the post-quantum schemes CP-Absel and LB-FSSE, the proposed scheme demonstrates superior overall computational efficiency while maintaining stronger quantum resistance than the traditional scheme SM9-PAEKS.

Cryptography doi: 10.3390/cryptography10020021

Authors: Yuqun Lin Yi Huang Xiaomeng Tang Jingjing Fan Qifei Xu Zoe-Lin Jiang Xiaosong Zhang Junbin Fang

Fully homomorphic encryption (FHE) offers a promising solution for privacy-preserving machine learning by enabling arbitrary computations on encrypted data. However, the efficient evaluation of non-linear functions—such as the ReLU activation function over large integers—remains a major obstacle in practical deployments, primarily due to high bootstrapping overhead and limited precision support in existing schemes. In this paper, we propose LargeIntReLU, a novel framework that enables efficient homomorphic ReLU evaluation over large integers (7–11 bits) via full-domain bootstrapping. Central to our approach is a signed digit decomposition algorithm, SignedDecomp, that partitions a large integer ciphertext into signed 6-bit segments using three new low-level primitives: LeftShift, HomMod, and CipherClean. This decomposition preserves arithmetic consistency, avoids cross-segment carry propagation, and allows parallelized bootstrapping. By segmenting the large integer and processing each chunk independently with optimized small-integer bootstrapping, we achieve homomorphic ReLU with full-domain bootstrapping, which significantly reduces the total number of sequential bootstrapping operations required. The security of our scheme is guaranteed by TFHE. Experimental results demonstrate that the proposed method reduces the bootstrapping cost by an average of 28.58% compared to state-of-the-art approaches while maintaining 95.2% accuracy. With execution times ranging from 1.16 s to 1.62 s across 7–11 bit integers, our work bridges a critical gap toward a scalable and efficient homomorphic ReLU function, which is useful in privacy-preserving machine learning. Furthermore, an end-to-end encrypted inference test on a CNN model with the MNIST dataset confirms its practicality, achieving 88.85% accuracy and demonstrating a complete pipeline for privacy-preserving neural network evaluation.

Cryptography doi: 10.3390/cryptography10020020

Authors: Paul Rochford William J. Buchanan Rich Macfarlane Madjid Tehrani

The decentralisation of autonomous Unmanned Aircraft Systems (UASs) introduces significant challenges in terms of establishing secure communication and consensus in contested, resource-constrained environments. This research addresses these challenges by conducting a comprehensive performance evaluation of two cryptographic technologies: Messaging Layer Security (MLS) for group key exchange, and threshold signatures (FROST and BLS) for decentralised consensus. Seven leading open-source libraries were methodically assessed through a series of static, network-simulated, and novel bulk-signing benchmarks to measure their computational efficiency and practical resilience. This paper confirms that MLS is a viable solution, capable of supporting the group sizes and throughput requirements of a UAS swarm. It corroborates prior work by identifying the Cisco MLSpp library as unsuitable for dynamic environments due to poorly scaling group management functions, while demonstrating that OpenMLS is a highly performant and scalable alternative. Furthermore, the findings show that operating MLS in a ‘key management’ mode offers a dramatic increase in performance and resilience, a critical trade-off for UAS operations. For consensus, the benchmarks reveal a range of compromises for developers to consider, while identifying the Zcash FROST implementation as the most effective all-around performer for sustained, high-volume use cases due to its balance of security features and efficient verification.

Cryptography doi: 10.3390/cryptography10020019

Authors: Luthando Mletshe Mnoneleli Nogwina Colin Chibaya

Organizations have been moving on-premises data functionalities to cloud storage environments. The need for advanced hybrid cryptography is deemed a promising solution for securing data on cloud storage. This scoping review explores the application of hybrid cryptographic systems for data hiding in cloud storage. It focuses on identifying global research trends, technological approaches, and contextual gaps in implementation. The review systematically examines the literature from major scholarly databases to identify existing models that combine traditional and modern cryptographic techniques to enhance data confidentiality, integrity, and authenticity against cloud-based security threats. Out of the 8250 eligible papers, 24 were included in the review. The findings reveal that the majority of scholarly contributions originate from Asia, averaging 87.5%, as reflected in the distribution of included articles by continent. Particularly, India and China dominate in the space, with a complete absence of studies from Africa, including South Africa. This geographical disparity underscores a significant research gap in the contextualization of hybrid cryptographic frameworks suited to Africa’s unique infrastructural and regulatory environments. The review further reveals a limited focus on the development of lightweight, scalable, and adaptable hybrid cryptographic schemes. Such approaches are essential for addressing challenges related to bandwidth limitations, computational efficiency, and regulatory compliance in developing regions. Consequently, this study contributes by establishing a comprehensive knowledge map of hybrid cryptography for cloud security, emphasizing the necessity for region-specific, context-aware frameworks. The findings provide a foundation for future investigations aimed at developing robust efficient hybrid cryptographic models that can strengthen data security in African cloud infrastructures.

Cryptography doi: 10.3390/cryptography10020018

Authors: Konstantinos Limniotis

Pseudonymisation constitutes an essential technical and organisational measure for implementing personal data-protection safeguards. Its main goal is to hide identities of individuals, thus reducing data protection and privacy risks through facilitating the fulfilment of several principles such as data minimisation and security. However, selecting and deploying appropriate pseudonymisation mechanisms in a risk-based approach, tailored to the specific data processing context, remains a non-trivial task. This survey paper aims to present especially how cryptography can be used at the service of pseudonymisation, putting emphasis not only on traditional approaches but also on advanced cryptographic techniques that have been proposed to address special pseudonymisation challenges. To this end, we systematically classify existing approaches according to a taxonomy that captures key design dimensions that are relevant to specific data-protection challenges. Finally, since the notion of pseudonymisation adopted in this work is grounded in European data-protection law, we also discuss recent legal developments, in particular the CJEU’s latest judgment, which refined the interpretation of pseudonymous data.

Cryptography doi: 10.3390/cryptography10020017

Authors: Tongchen Shen Xiangxue Li

The rapid advancement of quantum computing poses a severe threat to traditional public key cryptosystems. Lattice-based cryptography has emerged as a core candidate for post-quantum cryptography due to its presumed quantum resistance, robust security foundations, and functional versatility, with its concrete security relying on the computational hardness of lattice problems. Existing lattice-based cryptography surveys mainly focus on cryptosystem design, scheme comparisons, and post-quantum cryptography standardization progress, with only cursory coverage of classical lattice algorithms that underpin the concrete security of lattice-based cryptography. We present the first systematic survey of classical lattice algorithms, focusing on two core categories of algorithms for solving lattice problems: approximate algorithms and exact algorithms. The approximate algorithms cover mainstream lattice basis reduction methods such as Lenstra–Lenstra–Lovász (LLL), Block Korkine–Zolotarev (BKZ), and General Sieve Kernel (G6K) algorithms, as well as alternative frameworks. The exact algorithms encompass dominant techniques like enumeration and sieving algorithms, along with alternative strategies. We systematically trace the evolutionary trajectory and inherent logical connections of various algorithms, clarify their core mechanisms, and identify promising future research directions. This survey not only serves as an introductory guide for beginners but also provides a valuable reference for seasoned researchers, facilitating the concrete security evaluation of lattice-based cryptosystems and the design of novel lattice algorithms.

Cryptography doi: 10.3390/cryptography10020016

Authors: Sahara A. S. Almola Hameed A. Younis Raidah S. Khudeyer

This article presents a novel framework for encrypting color images to enhance digital data security using deep learning and artificial intelligence techniques. The system employs a two-model neural architecture: the first, a Convolutional Neural Network (CNN), verifies sender authenticity during user authentication, while the second extracts unique fingerprint features. These features are converted into high-entropy encryption keys using Particle Swarm Optimization (PSO), minimizing key similarity and ensuring that no key is reused or transmitted. Keys are generated in real time simultaneously at both the sender and receiver ends, preventing interception or leakage and providing maximum confidentiality. Encrypted images are secured using the Advanced Encryption Standard (AES-256) with keys uniquely bound to each user’s biometric identity, ensuring personalized privacy. Evaluation using security and encryption metrics yielded strong results: entropy of 7.9991, correlation coefficient below 0.00001, NPCR of 99.66%, UACI of 33.9069%, and key space of 2256. Although the final encryption employs an AES-256 key (key space of 2256), this key is derived from a much larger deep-key space of 28192 generated by multi-layer neural feature extraction and optimized via PSO, thereby significantly enhancing the overall cryptographic strength. The system also demonstrated robustness against common attacks, including noise and cropping, while maintaining recoverable original content. Furthermore, the neural models achieved classification accuracy exceeding 99.83% with an error rate below 0.05%, confirming the framework’s reliability and practical applicability. This approach provides a secure, dynamic, and efficient image encryption paradigm, combining biometric authentication and AI-based feature extraction for advanced cybersecurity applications.

Cryptography doi: 10.3390/cryptography10020015

Authors: Mohammad Alkhatib

Deepfake technology can produce highly realistic manipulated media which pose as significant cybersecurity threats, including fraud, misinformation, and privacy violations. This research proposes a deepfake prevention approach based on symmetric and asymmetric ciphers. Post-quantum asymmetric ciphers were utilized to perform digital signature operations, which offer essential security services, including integrity, authentication, and non-repudiation. Symmetric ciphers were also employed to provide confidentiality and authentication. Unlike classical ciphers that are vulnerable to quantum attacks, this study adopts quantum-resilient ciphers to offer long-term security. The proposed approach enables entities to digitally sign media content before public release on other platforms. End users can subsequently verify the authenticity of content using the public keys of the media creators. To identify the most efficient ciphers to perform cryptography operations required for deepfake prevention, the study explores the implementation of quantum-resilient symmetric and asymmetric ciphers standardized by NIST, including Dilithium, Falcon, SPHINCS+, and Ascon-80pq. Additionally, this research provides comprehensive comparisons between the various classical and post-quantum ciphers in both categories: symmetric and asymmetric. Experimental results revealed that Dilithium-5 and Falcon-512 algorithms outperform other post-quantum ciphers, with a time delay of 2.50 and 251 ms, respectively, for digital signature operations. The Falcon-512 algorithm also demonstrates superior resource efficiency, making it a cost-effective choice for digital signature operations. With respect to symmetric ciphers, Ascon-80pq achieved the lowest time consumption, taking just 0.015 ms to perform encryption and decryption operations. Also, it is a significant option for constrained devices, since it consumes fewer resources compared to standard symmetric ciphers, such as AES. Through comprehensive evaluations and comparisons of various symmetric and asymmetric ciphers, this study serves as a blueprint to identify the most efficient ciphers to perform the cryptography operations necessary for deepfake prevention.

Cryptography doi: 10.3390/cryptography10010014

Authors: Magdalena Bertram Benjamin Zengin Nicolas Buchmann Marian Margraf

In the context of digital certification systems, the demand for privacy-preserving authentication is increasingly vital, particularly for critical applications that involve sensitive personal data. Traditional digital signatures provide a robust means of implementing such systems. However, they raise significant privacy concerns due to their public verifiability, which allows verifiers to prove the authenticity of the received sensitive data to third parties. Universal designated verifier signature (UDVS) schemes address these privacy risks by offering non-transferability, ensuring that only the specified verifier can confirm the validity of the designated verifier signature (DVS). However, despite their advantages, existing UDVS models exhibit vulnerabilities that may allow tracking of the user’s authentications among cooperating verifiers and enable third parties to be convinced of the authenticity of sensitive user data by retrieving DVSs from different, non-cooperating verifiers. This paper presents a strategy to achieve strong non-transferability, which effectively addresses these vulnerabilities, by being the first to extend the concept of randomizability to UDVS schemes and their security properties. Our findings demonstrate that a randomizable UDVS scheme can serve as a solid foundation for constructing strong non-transferable UDVS schemes. Finally, we propose an efficient, strong, non-transferable UDVS scheme as an instantiation of our strategy, utilizing state-of-the-art Type 3 pairings, significantly improving upon previous constructions.

Cryptography doi: 10.3390/cryptography10010013

Authors: Valli Kumari Vatsavayi Dinesh Reddy Bommireddy

Communication is defined as the process of transferring data and exchanging information between interconnected systems. Due to the increasing reliance on digital infrastructures by the military, financial, and healthcare sectors, it is important to ensure the confidential, authentication, and tamper-proof nature of communications. In addition, the increasing need for secure communications in the fields of network security and cryptography have led to the development of numerous systems. The basic requirement of these systems is that under the same key, identical plaintexts do not result in identical ciphertexts. The most significant contribution to this requirement has came from block cipher modes. There are many traditional modes of operation such as the Electronic Code Book (ECB) compromises between simplicity and security. Probabilistic Modes such as the Cipher Block Chaining Mode (CBC) provide a method to randomize data so that the potential for pattern analysis is eliminated, while Deterministic Modes such as ECB enable potential access to the patterns within the plaintexts. Conversely, since the randomization is in the Probabilistic Mode, there is no access to the patterns; however, the sequentiality of the blocks creates dependence and increases the computing overhead. To address these issues, a novel block cipher mode that provides the highest level of security and the most effective method for performing encryption and decryption will be proposed in this paper. It is anticipated that the improved security features and efficient encryption and decryption procedures will significantly improve confidentiality. The methods proposed will utilize compact key structures, parallel processing, a header generation based on multiple random values, and a Key-derived S Box. The experimental results show that SEBCM is more effective than CBC with respect to speed in both encryption and decryption.

Cryptography doi: 10.3390/cryptography10010012

Authors: Sang-Yoon Chang Qaiser Khan

Post-quantum cryptography (PQC) provides the essential cryptographic algorithms needed to secure digital networking systems against future adversaries equipped with quantum computing. This paper reviews the PQC research landscape and identifies open challenges and future directions for the critical transition to PQC in digital networking systems. Building on the NIST standardization process which has hardened the PQC cipher algorithm security, this paper analyzes and describes the recent research on PQC implementations and integrations into scalable and standardized networking systems (Internet, web and cellular networks). We review research on the security, side-channel threats, performances, overheads, and compatibility of PQC ciphers. We also study the research incorporating PQC into the standardized web and cellular networking protocols, ranging from testing the PQC feasibility to proposing protocol solutions and mechanisms to enable PQC. Our study highlights the PQC challenge of large parameter sizes, common across the PQC cipher algorithms, and the research proposing protocol- and system-level mechanisms to address them. Informed by the survey, this paper identifies and highlights the research gaps and future directions to facilitate further research and development for PQC and to secure next-generation digital networking systems.

Cryptography doi: 10.3390/cryptography10010011

Authors: Maya Thabet Antonia Tsili Konstantinos Krilakis Dimitris Syvridis

Post-quantum cryptography (PQC) is, and should be, currently dominating the field of cybersecurity, with many works designing and evaluating the transition of communications security to quantum-safe solutions. As the security level and implementations of post-quantum algorithms become more mature, the research on their application to realistic conditions changes accordingly, especially their application to widely adopted network architectures and corresponding protocols such as the Public Key Infrastructure (PKI). In this survey, we identified articles presenting ways of integrating PQC algorithms to PKI and classified related work according to the employed methods and benchmarking choices. The main results from many evaluations converge to similar conclusions on the performance of the most popular PC digital signature algorithms; however, modeling choices concerning architecture variants, hardware and measurement metrics vary. The diversity of the results and experimental setups makes comparison difficult and arrival at an objective conclusion regarding PKI requirements almost impossible. Ultimately, this review reveals a fragmented landscape of benchmarking practices for post-quantum PKI systems. The absence of standardized evaluation frameworks and common test environments limits the comparability and reproducibility of the findings. We aim to provide reference implementations, which are essential to guide the transition of PKI infrastructures toward robust, scalable, and quantum-resistant deployments.

Cryptography doi: 10.3390/cryptography10010010

Authors: Chuanming Zong

In 1994, P. Shor discovered quantum algorithms that can break both the RSA cryptosystem and the ElGamal cryptosystem. In 2007, D-Wave demonstrated the first quantum computer. These events and further developments have brought a crisis to secret communication. In 2016, the National Institute of Standards and Technology (NIST) launched a global project to solicit and select a handful of encryption algorithms with the ability to resist quantum computer attacks. In 2022, it announced four candidates, CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, and Sphincs+, for post-quantum cryptography standards. The first three are based on lattice theory and the last on a hash function. The security of lattice-based cryptosystems relies on the computational complexity of the shortest vector problem (SVP), the closest vector problem (CVP), and their generalizations. As we will explain, the SVP is a ball-packing problem, and the CVP is a ball-covering problem. Furthermore, both the SVP and CVP are equivalent to arithmetic problems for positive definite quadratic forms. This paper will briefly describe the mathematical problems on which lattice-based cryptography is built so that cryptographers can extend their views and learn something useful.

Cryptography doi: 10.3390/cryptography10010009

Authors: Jimmy Dani Kalyan Nakka Nitesh Saxena

Indistinguishability is a fundamental principle of cryptographic security, crucial for securing data transmitted between Internet of Things (IoT) devices. This principle ensures that an attacker cannot distinguish between the encrypted data, also known as ciphertext, and random data or the ciphertexts of two messages encrypted with the same key. This research investigates the ability of machine learning (ML) to assess the indistinguishability property in encryption systems, with a focus on lightweight ciphers. As our first case study, we consider the SPECK32/64 and SIMON32/64 lightweight block ciphers, designed for IoT devices operating under significant energy constraints. In this research, we introduce MIND-Crypt (a Machine-learning-based framework for assessing the INDistinguishability of Cryptographic algorithms), a novel ML-based framework designed to assess the cryptographic indistinguishability of lightweight block ciphers, specifically the SPECK32/64 and SIMON32/64 encryption algorithms in CBC, CFB, OFB, and CTR modes, under Known Plaintext Attacks (KPAs). Our approach involves training ML models using ciphertexts from two plaintext messages encrypted with the same key to determine whether ML algorithms can identify meaningful cryptographic patterns or leakage. Our experiments show that modern ML techniques consistently achieve accuracy equivalent to random guessing, indicating that no statistically exploitable patterns exist in the ciphertexts generated by the considered lightweight block ciphers. Although some models exhibit mode-dependent bias (e.g., collapsing to a single-class prediction in CBC and CFB), their overall accuracy remains at random guessing levels, reinforcing that no meaningful distinguishing patterns are learned. Furthermore, we demonstrate that, when ML algorithms are trained on all possible combinations of ciphertexts for given plaintext messages, their behavior reflects memorization rather than generalization to unseen ciphertexts. Collectively, these findings suggest that existing block ciphers have secure cryptographic designs against ML-based indistinguishability assessments, reinforcing their security even under round-reduced conditions.

Cryptography doi: 10.3390/cryptography10010008

Authors: Adrian Donatien-Charon Mijail Borges-Quintana Miguel A. Borges-Trenard Omar Rojas Guillermo Sosa-Gómez

This article presents general methodologies for plaintext attacks on block ciphers using the Tabu Search algorithm. These methods treat the cipher as a black box, with the objective of finding the session key. The primary innovation of our approach is the division of the key space into subsets based on a divisor, enabling the attack to focus on a specific portion of the total space. The following investigation demonstrates the successful application of these methods to a member of a block cipher family that includes the Advanced Encryption Standard (AES) cipher. One of the proposed methodologies, the subregions path attack, enables navigation of the key session space by applying specific predetermined strategies within these subregions.

Cryptography doi: 10.3390/cryptography10010007

Authors: Daniel Alarcón-Narváez Luis Adrián Lizama-Pérez Fausto Abraham Jacques-García

We present an algebraic framework for constructing challenge–response authentication protocols based on powers of non-diagonalizable matrices over finite fields. The construction relies on upper triangular Toeplitz matrices with a single Jordan block and on their structured power expansions, which induce nonlinear relations between matrix parameters and exponents through an autopotency phenomenon. The protocol is built from a cyclic family of matrix products derived from secret matrices (Ai)i=1n⊂GLk(Fp): for each index i, a product Pi=AiAi+1…Ai+n−1 is formed (indices modulo n), and its power Pi(x) is published for a secret exponent x. The resulting family of powered products is linked by conjugation via the unknown factors Ai, enabling an interactive authentication mechanism in which the prover demonstrates the knowledge of selected factors by satisfying explicit conjugacy relations. We formalize the underlying algebraic problems in terms of factor recovery and conjugacy identification from powered products, and analyze how the enforced non-diagonalizable structure and Toeplitz constraints lead to coupled multivariate polynomial systems. These systems arise naturally from the algebraic design of the construction and do not admit immediate reductions to classical discrete logarithm settings. The framework illustrates how non-diagonalizable matrix structures and structured conjugacy relations can be used to define concrete authentication primitives in noncommutative algebraic settings, and provides a basis for further cryptanalytic and cryptographic investigation.

Cryptography doi: 10.3390/cryptography10010006

Authors: Asmaa Kassimi Abdullah Aljuffri Christian Larmann Said Hamdioui Mottaqiallah Taouil

Instruction Set Architecture (ISA) extensions, particularly scalar cryptography extensions (Zk), combine the performance advantages of hardware with the adaptability of software, enabling the direct and efficient execution of cryptographic functions within the processor pipeline. This integration eliminates the need to communicate with external cores, substantially reducing latency, power consumption, and hardware overhead, making it especially suitable for embedded systems with constrained resources. However, current scalar cryptography extension implementations remain vulnerable to physical threats, notably power side-channel attacks (PSCAs). These attacks allow adversaries to extract confidential information, such as secret keys, by analyzing the power consumption patterns of the hardware during operation. This paper presents an optimized and secure implementation of the RISC-V scalar Advanced Encryption Standard (AES) extension (Zkne/Zknd) using Domain-Oriented Masking (DOM) to mitigate first-order PSCAs. Our approach features optimized assembly implementations for partial rounds and key scheduling alongside pipeline-aware microarchitecture optimizations. We evaluated the security and performance of the proposed design using the Xilinx Artix7 FPGA platform. The results indicate that our design is side-channel-resistant while adding a very low area overhead of 0.39% to the full 32-bit CV32E40S RISC-V processor. Moreover, the performance overhead is zero when the extension-related instructions are properly scheduled.

Cryptography doi: 10.3390/cryptography10010005

Authors: Tongchen Shen Xiangxue Li Licheng Wang

Lattice-based cryptography stands as one of the most pivotal candidates in post-quantum cryptography. To configure the parameters of lattice-based cryptographic schemes, a thorough comprehension of their concrete security is indispensable. Lattice sieving algorithms represent among the most critical tools for conducting concrete security analysis. Currently, the state-of-the-art BDGL-sieve (SODA 2016) achieves a time complexity of 20.292n+o(n), and Kirshanova and Laarhoven (CRYPTO 2021) have proven that the BDGL-sieve attains the lower bound under the technical paradigm of the Nearest Neighbor Search (NNS) problem. A natural question emerges: whether overlattice-based sieving algorithms (ANTS 2014) can outperform the BDGL-sieve within an alternative technical framework. This work provides an almost negative response to this question. Specifically, we propose a generalized overlattice tower model, which facilitates the proof of the lower bound for the overlattice-based method. Our findings indicate that the original Overlattice-sieve has already reached this lower bound. Consequently, the BDGL-sieve will maintain its status as the sieving algorithm with optimal time complexity, unless a revolutionary technical optimization is developed in the future.

Cryptography doi: 10.3390/cryptography10010004

Authors: Bashar Suhail Khassawneh Issa AL-Aiash Mahmoud AlJamal Omar Aljamal Latifa Abdullah Almusfar Bashair Faisal AlThani Waad Aldossary

In the digital era, protecting the integrity and ownership of digital content is increasingly crucial, particularly against unauthorized copying and tampering. Traditional watermarking techniques often struggle to remain robust under various image manipulations, leading to a need for more resilient methods. To address this challenge, we propose a novel watermarking technique that integrates the Discrete Wavelet Transform (DWT), Singular Value Decomposition (SVD), and Schur matrix factorization to embed a QR code as a watermark into digital images. Our method was rigorously tested across a range of common image attacks, including histogram equalization, salt-and-pepper noise, ripple distortions, smoothing, and extensive cropping. The results demonstrate that our approach significantly outperforms existing methods, achieving high normalized correlation (NC) values such as 0.9949 for histogram equalization, 0.9846 for salt-and-pepper noise (2%), 0.96063 for ripple distortion, 0.9670 for smoothing, and up to 0.9995 under 50% cropping. The watermark consistently maintained its integrity and scannability under all tested conditions, making our method a reliable solution for enhancing digital copyright protection.

Cryptography doi: 10.3390/cryptography10010003

Authors: Xinyao Li Akhilesh Tyagi

Side-channel attacks leveraging microarchitectural components such as caches and translation lookaside buffers (TLBs) pose increasing risks to cryptographic and machine-learning workloads. This paper presents a comparative study of performance and side-channel leakage under two page-size configurations—standard 4 KB pages and 2 MB huge pages—using paired attacker–victim experiments instrumented with both Performance Monitoring Unit (PMU) counters and precise per-access timing using rdtscp(). The victim executes repeated, key-dependent memory accesses across eight cryptographic modes (AES, ChaCha20, RSA, and ECC variants) while the attacker records eight PMU features per access (cpu-cycles, instructions, cache-references, cache-misses, etc.) and precise rdtscp() timing. The resulting traces are analyzed using a multilayer perceptron classifier to quantify key-dependent leakage. Results show that the 2 MB huge-page configuration achieves a comparable key-classification accuracy (mean 0.79 vs. 0.77 for 4 KB) while reducing average CPU cycles by approximately 11%. Page-index identification remains near random chance (3.6–3.7% for PMU side-channels and 1.5% for timing side-channel), indicating no increase in measurable leakage at the page level. These findings suggest that huge-page mappings can improve runtime efficiency without amplifying observable side-channel vulnerabilities, offering a practical configuration for balancing performance and security in user-space cryptographic workloads.

Cryptography doi: 10.3390/cryptography10010002

Authors: Zhaoxiong Meng Rukui Zhang Bin Cao Meng Zhang Yajun Li Huhu Xue Meimei Yang

This study presents a novel framework for digital copyright management that integrates AI-enhanced perceptual hashing, blockchain technology, and digital watermarking to address critical challenges in content protection and verification. Traditional watermarking approaches typically employ content-independent metadata and rely on centralized authorities, introducing risks of tampering and operational inefficiencies. The proposed system utilizes a pre-trained convolutional neural network (CNN) to generate a robust, content-based perceptual hash value, which serves as an unforgeable watermark intrinsically linked to the image content. This hash is embedded as a QR code in the frequency domain and registered on a blockchain, ensuring tamper-proof timestamping and comprehensive traceability. The blockchain infrastructure further enables verification of multiple watermark sequences, thereby clarifying authorship attribution and modification history. Experimental results demonstrate high robustness against common image modifications, strong discriminative capabilities, and effective watermark recovery, supported by decentralized storage via the InterPlanetary File System (IPFS). The framework provides a transparent, secure, and efficient solution for digital rights management, with potential future enhancements including post-quantum cryptography integration.

Cryptography doi: 10.3390/cryptography10010001

Authors: Yijia Dai Yitong Li Ye Yuan Xianwei Gao Cong Bian Meici Liu

The integration of operational technology (OT) and information technology (IT) within the Industrial Internet of Things (IIoT) has posed prominent security challenges for resource-constrained devices. Existing authentication architectures often suffer from critical vulnerabilities: one is their reliance on centralized trusted third parties, which creates single points of failure; the other is their use of static credentials like biometrics, which pose severe privacy risks if compromised. To address these limitations, this paper proposes DLR-Auth, which combines chaotic synchronization of semiconductor superlattice physically unclonable functions (SSL-PUFs) with Shamir’s secret sharing (SSS) to enable decentralized registration and revocable templates. Notably, DLR-Auth is a two-party authentication framework that removes the need for a separate online registration authority that operates directly between a user device (UDi) and a server (S). In our setting, the server S still acts as the central relying party and hardware authority embedding the matched SSL-PUF module. The protocol also includes an efficient multi-access mechanism optimized for high-frequency interactions. Formal security analysis with the Real-or-Random (ROR) model proves the semantic security of the session key, while performance evaluations demonstrate that DLR-Auth has significant advantages in computational and communication efficiency. DLR-Auth thus offers a robust, scalable, lightweight solution for next-generation secure IIoT systems.

Cryptography doi: 10.3390/cryptography9040080

Authors: Yixuan He Yuta Kodera Yasuyuki Nogami Samsul Huda

Proactive secret sharing (PSS), an extension of secret-sharing schemes, safeguards sensitive data in dynamic distributed networks by periodically refreshing shares to counter adversarial attacks. In our previous work, we constructed a non-interactive proactive secret scheme by integrating threshold homomorphic encryption (ThHE) while reducing the communication complexity to O(n). Not only is refreshing shares important but revoking the shares of users who have left the system is also essential in practical dynamic membership scenarios. However, the previous work was insufficient for supporting explicit user revocation. This study strengthens the description of roles for authorized users and proposes a scheme to achieve non-interactive share refresh and dynamic user management. In each epoch, authorized users are classified into three roles: retain, newly join, and rejoin, and they receive a broadcast of the compact ciphertext encoding both the refresh information and the revocation instructions from the trusted center (dealer). Authorized users independently derive new shares through homomorphic computations, whereas revoked users are unable to generate new shares. Hash functions are used to bind revocation parameters to the cryptographic hashes of valid users in order to guarantee integrity during revocation, allowing for effective verification without compromising non-interactivity. Our new scheme not only extends the revocation structure but also preserves the O(n) communication complexity.

Cryptography doi: 10.3390/cryptography9040079

Authors: Ngoc Ai Van Nguyen Dung Hoang Duong Minh Thuy Truc Pham

Recent work at SCN 2020 by Boyen, Izabachène, and Li introduced a lattice-based key-encapsulation mechanism (KEM) that achieves CCA2-security in the standard model without relying on generic transformations. Their proof, however, leaves a few gaps that prevent a fully rigorous security justification. Building on the same design rationale, we revisit that construction and refine it to obtain a more compact and provably secure KEM under the Learning With Errors assumption. Furthermore, we extend this framework to derive an identity-based variant (IBKEM) whose security is established in the same model. The resulting schemes combine conceptual simplicity with improved efficiency and complete proofs of adaptive-ciphertext security.

Cryptography doi: 10.3390/cryptography9040078

Authors: Oussama Azzouzi Mohamed Anane Mohamed Chahine Ghanem Yassine Himeur Dominik Wojtczak

As embedded and IoT systems demand secure and compact encryption, developing cryptographic solutions that are both lightweight and efficient remains a major challenge. Many existing AES implementations either lack flexibility or consume excessive hardware resources. This paper presents an area-efficient and flexible AES-128 implementation based on a hardware/software (HW/SW) co-design, specifically optimized for platforms with limited hardware resources, resulting in reduced power consumption. In this approach, key expansion is performed in software on a lightweight MicroBlaze processor, while encryption and decryption are accelerated by dedicated hardware IP cores optimized at the Look-up Table (LuT) level. The design is implemented on a Xilinx XC5VLX50T Virtex-5 FPGA, synthesized using Xilinx ISE 14.7, and tested at a 100 MHz system clock. It achieves a throughput of 13.3 Gbps and an area efficiency of 5.44 Gbps per slice, requiring only 2303 logic slices and 7 BRAMs on a Xilinx FPGA. It is particularly well-suited for resource-constrained applications such as IoT nodes, secure mobile devices, and smart cards. Since key expansion is executed only once per session, the runtime is dominated by AES core operations, enabling efficient processing of large data volumes. Although the present implementation targets AES-128, the HW/SW partitioning allows straightforward extension to AES-192 and AES-256 by modifying only the software Key expansion module, ensuring practical scalability with no hardware changes. Moreover, the architecture offers a balanced trade-off between performance, flexibility and resource utilization without relying on complex pipelining. Experimental results demonstrate the effectiveness and flexibility of the proposed lightweight design.

Cryptography doi: 10.3390/cryptography9040077

Authors: Márcio Carvalho Filipe Sá Jorge Bernardino

Data security is essential for protecting sensitive information that could compromise both the sender and the receiver. Encryption mechanisms, such as the Advanced Encryption Standard (AES), play a key role in this protection. However, encrypting or decrypting data can significantly impact the performance of the database. This study aims to evaluate the impact of AES on the performance of SQL Server, Oracle, and MySQL when using Transparent Data Encryption (TDE) with the Transaction Processing Performance Council-H (TPC-H) benchmark at different Scale Factors. Performance was assessed using metrics such as elapsed time and system resource usage. In terms of scalability and performance efficiency, SQL Server proved to be the best among the databases tested. However, TDE introduced performance overhead compared to non-encryption test cases.

Cryptography doi: 10.3390/cryptography9040076

Authors: Saba Karimani Taraneh Eghlidos

Searchable Encryption (SE) schemes enable data users to securely search over outsourced encrypted data stored in the cloud. To support fine-grained access control, Attribute-Based Encryption with Keyword Search (ABKS) extends SE by associating access policies with user attributes. However, existing ABKS schemes often suffer from limited security and functionality, such as lack of verifiability, vulnerability to collusion, and insider keyword-guessing attacks (IKGA), or inefficiency in multi-authority and post-quantum settings, restricting their practical deployment in real-world distributed systems. In this paper, we propose a verifiable ciphertext-policy multi-authority ABKS (MA-CP-ABKS) scheme based on the Module Learning with Errors (MLWE) problem, which provides post-quantum security, verifiability, and resistance to both collusion and IKGA. Moreover, the proposed scheme supports multi-keyword searchability and forward security, enabling secure and efficient keyword search in dynamic environments. We formally prove the correctness, verifiability, completeness, and security of the scheme under the MLWE assumption against selective chosen-keyword attacks (SCKA) in the standard model and IKGA in the random oracle model. The scheme also maintains efficient computation and manageable communication overhead. Implementation results confirm its practical performance, demonstrating that the proposed MA-CP-ABKS scheme offers a secure, verifiable, and efficient solution for multi-organizational cloud environments.

Cryptography doi: 10.3390/cryptography9040075

Authors: Yuheng Qian Jing Gao Yuhan Qian Yaoling Ding An Wang

Reconstructing cryptographic operation sequences through side-channel analysis is essential for recovering private keys, but practical attacks are hindered by unlabeled, noisy, and high-dimensional power traces that challenge accurate classification. To address this, we propose STAR, a two-stage unsupervised clustering correction framework. First, a Gaussian Mixture Model (GMM) performs an initial clustering to generate reliable pseudo-labels from high-confidence samples. Next, a self-training mechanism uses these pseudo-labels to train a Convolutional Neural Network (CNN), which then iteratively reclassifies low-confidence samples to refine the entire dataset. Validated on standard ECC, RSA, and SM2 datasets, our framework achieved 100% classification accuracy, demonstrating a significant improvement of 12% to 48% over state-of-the-art methods. These findings confirm that STAR is an effective and robust framework for enhancing the precision of unsupervised side-channel analysis, thereby strengthening key recovery attacks.

Cryptography doi: 10.3390/cryptography9040074

Authors: Firdous Kausar Hafiz M. Asif Sajid Hussain Shahid Mumtaz

The metaverse represents a transformative integration of virtual and physical worlds, offering unprecedented opportunities for social interaction, commerce, education, healthcare, and entertainment. Establishing trust in these expansive and decentralized environments remains a critical challenge. Blockchain technology, with its decentralized, secure, and immutable nature, is emerging as an essential pillar of trust and digital asset ownership within the metaverse. This paper provides an extensive review of blockchain-enabled trust and reputation frameworks specifically tailored to metaverse ecosystems. We present an in-depth analysis of existing blockchain solutions across diverse metaverse domains, including gaming, virtual real estate, healthcare, and education. Our core contributions include a comprehensive taxonomy that classifies current trust and reputation schemes by their underlying mechanisms, threat models addressed, and their architectural strategies. We provide a comparative benchmark analysis evaluating key performance metrics such as security robustness, scalability, user privacy, and cross-platform interoperability, revealing critical trade-offs inherent in current designs. Our analysis finds that score-based designs trade scalability for nuanced reputation representation, while SSI- and SBT-based approaches improve Sybil-resistance but introduce significant privacy governance challenges. Finally, we outline unresolved research challenges, including cross-platform reputation portability, privacy-preserving computation, real-time trust management, and standardized governance structures.

Cryptography doi: 10.3390/cryptography9040073

Authors: Konstantina Souvatzidaki Konstantinos Limniotis

The emergence of quantum computing presents a significant threat to classical cryptographic primitives, particularly those employed in securing internet communications via widely used protocols such as Transport Layer Security (TLS). As conventional key exchange mechanisms will become increasingly vulnerable in the post-quantum era, the integration of post-quantum cryptographic (PQC) algorithms into existing security protocols is of utmost importance. This study investigates the impact of incorporating PQC key encapsulation mechanisms—specifically, the recent standards CRYSTALS-Kyber and HQC, in conjunction with the candidate standard BIKE—into the TLS 1.3 handshake. A comprehensive experimental evaluation was conducted to measure handshake latency under emulated network conditions with varying packet loss probabilities. The findings offer useful insights into the performance trade-offs introduced by PQC integration and further highlight the necessity of a timely transition to post-quantum cryptographic standards.

Cryptography doi: 10.3390/cryptography9040072

Authors: David Palma Pier Luca Montessoro

As quantum computing continues to advance, it threatens the long-term protection of traditional cryptographic methods, especially in biometric authentication systems where it is important to protect sensitive data. To overcome this challenge, we present a comprehensive, privacy-preserving framework for multimodal biometric authentication that can easily integrate any two binary-encoded modalities through feature-level fusion, ensuring that all sensitive information remains encrypted under a CKKS-based homomorphic encryption scheme resistant to both classical and quantum-enabled attacks. To demonstrate its versatility and effectiveness, we apply this framework to the retinal vascular patterns and palm vein features, which are inherently spoof-resistant and particularly well suited to high-security applications. This method not only ensures the secrecy of the combined biometric sample, but also enables the complete assessment of recognition performance and resilience against adversarial attacks. The results show that our approach provides protection against threats such as data leakage and replay attacks while maintaining high recognition performance and operational efficiency. These findings demonstrate the feasibility of integrating multimodal biometrics with post-quantum cryptography, giving a strong, privacy-oriented authentication solution suitable for mission-critical applications in the post-quantum era.

Cryptography doi: 10.3390/cryptography9040071

Authors: Shaomin Zhang Yiheng Huang Baoyi Wang

As electric vehicles (EVs) gain popularity, the existing public charging infrastructure is struggling to keep pace with the rapidly growing demand for the immediate charging needs of EVs. V2V power trading has gradually attracted widespread attention and development. EVs need to transmit sensitive information, such as transaction plans, through communication entities in the Internet of Vehicles (IoV). This could lead to leaks of sensitive information, thereby threatening the fairness of transactions. In addition, due to the differences in the cryptographic systems of entities, communication between entities faces challenges. Therefore, a privacy-preserving scheme for V2V double auction power trading based on heterogeneous signcryption and IoV is proposed. Firstly, a heterogeneous signcryption algorithm is designed to realize secure communication from certificateless cryptography to identity-based cryptography. Secondly, the scheme employs a pseudonym mechanism to protect the real identities of EVs. Furthermore, a verification algorithm is designed to verify the information sent by EVs and ensure the traceability and revocation of malicious EVs. The theoretical analysis shows that the proposed scheme could serve common security functions, and the experiment demonstrates that the proposed scheme reduces communication costs by about 14.56% and the computational cost of aggregate decryption by 80.51% compared with other schemes in recent years.

Cryptography doi: 10.3390/cryptography9040070

Authors: Hussain Ahmad Carolin Hannusch

Symmetric cryptography is essential for secure communication as it ensures confidentiality by using shared secret keys. This paper proposes a novel substitution-permutation network (SPN) that integrates Latin squares, permutations, and Reed-Muller (RM) codes to achieve robust security and resilience. As an adaptive design using binary representation with base-n Latin square mappings for non-linear substitutions, it supports any n (Codeword length and Latin square order), k (RM code dimension), d (RM code minimum distance) parameters aligned with the Latin square and RM(n,k,d) codes. The scheme employs 2log2n-round transformations using log2n permutations ρz, where in the additional log2n rounds, row and column pairs are swapped for each pair of rounds, with key-dependent πz permutations for round outputs and fixed ρz permutations for codeword shuffling, ensuring strong diffusion. The scheme leverages dynamic Latin square substitutions for confusion and a vast key space, with permutations ensuring strong diffusion and RM(n,k,d) codes correcting transmission errors and enhancing robustness against fault-based attacks. Precomputed components optimize deployment efficiency. The paper presents mathematical foundations, security primitives, and experimental results, including avalanche effect analysis, demonstrating flexibility and balancing enhanced security with computational and storage overhead.

Cryptography doi: 10.3390/cryptography9040069

Authors: Shaobo Zhang Yijie Yin Nangui Chen Honghui Ning

The rapid growth of smart healthcare improves medical efficiency through electronic data sharing but introduces security risks like privacy leaks and data tampering. However, existing ciphertext-policy attribute-based encryption faces challenges such as single points of failure, weak authentication, and inadequate integrity protection, hindering secure, efficient medical data sharing. Therefore, we propose LDDV, a lightweight decentralized medical data sharing scheme with dual verification. LDDV constructs a lightweight multi-authority collaborative key management architecture based on elliptic curve cryptography, which eliminates the risk of single point of failure and balances reliability and efficiency. Meanwhile, a lightweight dual verification mechanism based on elliptic curve digital signature provides identity authentication and data integrity verification. Security analysis and experimental results show that LDDV achieves 28–42% faster decryption speeds compared to existing schemes and resists specific threats such as chosen plaintext attacks.

Cryptography doi: 10.3390/cryptography9040068

Authors: Saloni Jain Amisha Bagri Maxime Cambou Dina Ghanai Miandoab Bertrand Cambou

Secure authentication in smart device ecosystems remains a critical challenge, particularly due to the irrevocability of compromised biometric templates in server-based systems. This paper presents a post-quantum secure multi-factor authentication protocol that combines templateless 2D and 3D facial biometrics, liveness detection, and Physical Unclonable Functions (PUFs) to achieve robust identity assurance. The protocol exhibits zero-knowledge properties, preventing adversaries from identifying whether authentication failure is due to the biometric, password, PUF, or liveness factor. The proposed protocol utilizes advanced facial landmark detection via dlib or mediapipe, capturing multi-angle facial data and mapping it. By applying a double-masking technique and measuring distances between randomized points, stabilized facial landmarks are selected through multiple images captured during enrollment to ensure template stability. The protocol creates high-entropy cryptographic keys, securely erasing all raw biometric data and sensitive keys immediately after processing. All key cryptographic operations and challenge-response exchanges employ post-quantum algorithms, providing resistance to both classical and quantum adversaries. To further enhance reliability, advanced error-correction methods mitigate noise in biometric and PUF responses, resulting in minimal FAR and FRR that meets industrial standards and resilience against spoofing. Our experimental results demonstrate this protocol’s suitability for smart devices and IoT deployments requiring high-assurance, scalable, and quantum-resistant authentication.

Cryptography doi: 10.3390/cryptography9040067

Authors: Phuc-Phan Duong Cong-Kha Pham

Substitution boxes (S-Boxes) are the core components of modern block ciphers, responsible for introducing the essential nonlinearity that protects against attacks like linear and differential cryptanalysis. For an 8-bit S-Box, the highest possible nonlinearity for a balanced Boolean function is 116. The best results previously reported in the literature achieved an average nonlinearity of 114.5 across the coordinate Boolean functions of 8 × 8 S-boxes. Our proposed method surpasses this record, producing S-boxes whose coordinate functions exhibit an average nonlinearity of 116. This is a significant achievement as it reaches the best result to date for the nonlinearity of the coordinate Boolean functions of an S-Box. Our S-Box generation method is based on multiplication over the field GF(24) and 4×4 component S-Boxes. The approach is also highly effective, capable of producing a large number of S-Boxes with good cryptographic properties. Other cryptographic criteria, such as BIC, SAC, DAP, and LAP, though not fully optimal, remain within acceptable ranges when compared with other reported designs. In addition, a side-channel attack evaluation is presented, covering both parameter analysis and experimental results on a real system when applying the proposed S-Box in the AES algorithm. These results make it a leading solution for block cipher design.

Cryptography doi: 10.3390/cryptography9040066

Authors: Anas A. Abudaqa Khaled Alshehri Muhamad Felemban

Crystals-Kyber and Classic-McEliece are two prominent post-quantum key encapsulation mechanisms (KEMs) designed to address the challenges posed by quantum computing to classical cryptographic schemes. While the former has been standardized by the National Institute of Standards and Technology (NIST), the latter is well-known for its exceptional robustness and as one of the finalists of the fourth round of post-quantum cryptography standardization. Private set intersection (PSI) is a privacy-preserving technique that enables two parties, each possessing a dataset, to compute the intersection of their sets without revealing anything else. This can be achieved thanks to homomorphic encryption (HE), which allows computations on encrypted data. In this paper, firstly, we study Kyber and McEliece, apart from being KEMs, as post-quantum public key encryption (PKE), and examine their homomorphic properties. Secondly, we design two different two-party PSI protocols that utilize the homomorphic capabilities of Kyber and McEliece. Thirdly, a practical performance evaluation under NIST’s security levels 1, 3, and 5 is conducted, focusing on three key metrics: storage overhead, communication overhead, and computation cost. Insights indicate that the Kyber-based PSI Protocol, which utilizes the multiplicative homomorphic property, is secure but less efficient. In contrast, the McEliece-based PSI protocol, while efficient in practice, raises concerns regarding its security as a homomorphic encryption scheme.

Cryptography doi: 10.3390/cryptography9040065

Authors: Lingling Xia Tao Zhu Zhengjun Jing Qun Wang Zhuo Ma Zimo Huang Ziyu Yin

Digital currencies, led by Bitcoin and USDT, are characterized by decentralization and anonymity, which obscure the identities of traders and create a conducive environment for illicit activities such as drug trafficking, money laundering, cyber fraud, and terrorism financing. Focusing on the USDT-TRC20 token on the Tron blockchain, we propose a two-layer transaction network-based approach for virtual currency address identity recognition for digging out hidden relationships and encrypted assets. Specifically, a two-layer transaction network is constructed: Layer A describes the flow of USDT-TRC20 between on-chain addresses over time, while Layer B represents the flow of TRX between on-chain addresses over time. Subsequently, an identity metric is proposed to determine whether a pair of addresses belongs to the same user or group. Furthermore, transaction records are systematically acquired through blockchain explorers, and the efficacy of the proposed recognition method is empirically validated using dataset from the Key Laboratory of Digital Forensics. Finally, the transaction topology is visualized using Neo4j, providing a comprehensive and intuitive representation of the traced transaction pathways.

Cryptography doi: 10.3390/cryptography9040064

Authors: Munkhbaatar Chinbat Liji Wu Xiangmin Zhang Yifan Yang Man Wei

Deep learning-based side-channel analysis is one of the most effective techniques for extracting and classifying sensitive information from a target device. This paper demonstrates the best-performing deep learning model for the target implementation by evaluating various deep learning architectures, including MLP, CNN, and RNN, while systematically optimizing their hyperparameters to achieve the best performance. The paper uses a case study of the Number Theoretic Transform accelerator for the CRYSTALS-Kyber key encapsulation mechanism to show that enhanced deep learning analysis can be used to break security. The best-performing deep learning-based model achieved a 96.64% accuracy in classifying pairwise coefficients of the s vector, which is used to generate the secret key with the NTT accelerator for Kyber768 and Kyber1024. For Kyber512, the model achieved an accuracy of 95.71%. The proposed approach significantly improves average training efficiency, with POIs achieving up to 1.45 times faster performance for MLP models, 10.53 times faster for CNNs, and 10.28 times faster for RNNs compared to deep learning methods without POIs, while maintaining high accuracy in side-channel analysis.

Cryptography doi: 10.3390/cryptography9040063

Authors: Noha E. El-Attar Marwa H. Salama Mohamed Abdelfattah Sanaa Taha

Detecting, tracking, and preventing cryptocurrency money laundering within blockchain systems is a major challenge for governments worldwide. This paper presents an anomaly detection model based on blockchain technology and machine learning to identify cryptocurrency money-laundering accounts within Ethereum blockchain networks. The proposed model employs Particle Swarm Optimization (PSO) to select optimal feature subsets. Additionally, three machine learning algorithms—XGBoost, Isolation Forest (IF), and Support Vector Machine (SVM)—are employed to detect suspicious accounts. A Genetic Algorithm (GA) is further applied to determine the optimal hyperparameters for each machine learning model. The evaluations demonstrate the superiority of the XGBoost algorithm over SVM and IF, particularly when enhanced with GA. It achieved accuracy, precision, recall, and F1-score values of 0.98, 0.97, 0.98, and 0.97, respectively. After applying GA, XGBoost’s performance metrics improved to 0.99 across all categories.

Cryptography doi: 10.3390/cryptography9040062

Authors: Altana Khutsaeva Anton Leevik Sergey Bezzateev

Modern distributed computing systems and applications with strict privacy requirements demand robust data confidentiality. A primary challenge involves enabling parties to exchange data or perform joint computations. These interactions must avoid revealing private information about the data. Protocols with the obliviousness property, known as oblivious protocols, address this issue. They ensure that no party learns more than necessary. This survey analyzes the security and performance of post-quantum oblivious protocols, with a focus on oblivious transfer and oblivious pseudorandom functions. The evaluation assesses resilience against malicious adversaries in the Universal Composability framework. Efficiency is quantified through communication and computational overhead. It identifies optimal scenarios for these protocols. This paper also surveys related primitives, such as oblivious signatures and data structures, along with their applications. Key findings highlight the inherent trade-offs between computational cost and communication complexity in post-quantum oblivious constructions. Open challenges and future research directions are outlined. Emphasis is placed on quantum-resistant designs and formal security proofs in stronger adversarial models.

Cryptography doi: 10.3390/cryptography9040061

Authors: Hanwei Qian Lingling Xia Ruihao Ge Yiming Fan Qun Wang Zhengjun Jing

As deepfake technology matures, its risks in spreading false information and threatening personal and societal security are escalating. Despite significant accuracy improvements in existing detection models, their inherent opacity limits their practical application in high-risk areas such as forensic investigations and news verification. To address this gap in trust, explainability has become a key research focus. This paper provides a systematic review of explainable deepfake detection methods, categorizing them into three main approaches: forensic analysis, which identifies physical or algorithmic manipulation traces; model-centric methods, which enhance transparency through post hoc explanations or pre-designed processes; and multimodal and natural language explanations, which translate results into human-understandable reports. The paper also examines evaluation frameworks, datasets, and current challenges, underscoring the necessity for trustworthy, reliable, and interpretable detection technologies in combating digital misinformation.

Cryptography doi: 10.3390/cryptography9040060

Authors: Sidra Anwar Jonathan Anderson

Digital contact-tracing (CT) systems differ in how they process risk and expose data, and the centralized–decentralized dichotomy obscures these choices. We propose a modular six-model classification and evaluate 18 platforms across 12 countries (July 2020–April 2021) using a 24-indicator rubric spanning privacy, security, functionality, and governance. Methods include double-coding with Cohen’s κ for inter-rater agreement and a 1000-draw weight-sensitivity check; assumptions and adversaries are stated in a concise threat model. Results: No single model dominates; Bulletin Board and Custodian consistently form the top tier on privacy goals, while Fully Centralized eases verification/notification workflows. Timelines show rapid GAEN uptake and near-contemporaneous open-source releases, with one late outlier. Contributions: (i) A practical, generalizable classification that makes compute-locus and data addressability explicit; (ii) a transparent indicator rubric with an evidence index enabling traceable scoring; and (iii) empirically grounded guidance aligning deployments with goals G1–G3 (PII secrecy, notification authenticity, unlinkability). Limitations include reliance on public documentation and architecture-level (not mechanized) verification; future work targets formal proofs and expanded double-coding. The framework and findings generalize beyond COVID-19 to privacy-preserving digital-health workflows.

Cryptography doi: 10.3390/cryptography9030059

Authors: Kwan Yin Chan Tsz Hon Yuen Siu Ming Yiu

Traceable ring signatures (TRSs) allow a signer to create a signature that maintains anonymity while enabling traceability if needed. It merges the characteristics of traditional ring signatures with the ability to trace signers, making it ideal for applications that demand both confidentiality and accountability. In a TRS scheme, a ring of potential signers generates a signature on a message without disclosing the actual signer’s identity. However, the identity can be traced if the signer uses the same tag for multiple signatures. This paper introduces a novel formal construction of TRS under universally composable (UC) security. We integrate verifiable random functions (VRFs) and zero-knowledge proofs for membership, employing Pedersen commitments. Our signature schemes maintain a logarithmic size while preserving the UC security guarantees. Additionally, we explore the potential to extend the property of one-time anonymity in TRS to K-time anonymity.

Cryptography doi: 10.3390/cryptography9030058

Authors: Alexandru Dinu

Chaotic systems, governed by deterministic nonlinear equations yet exhibiting highly complex and unpredictable behaviors, have emerged as valuable tools at the intersection of mathematics, engineering, and information security. This paper presents a comparative study of the Lorenz and Rössler systems, focusing on their dynamic complexity and statistical independence—two critical properties for applications in chaos-based cryptography. By integrating techniques from nonlinear dynamics (e.g., Lyapunov exponents, KS entropy, Kaplan–Yorke dimension) and statistical testing (e.g., chi-square and Gaussian transformation-based independence tests), we provide a quantitative framework to evaluate the pseudo-randomness potential of chaotic trajectories. Our results show that the Lorenz system offers faster convergence to chaos and superior statistical independence over time, making it more suitable for rapid encryption schemes. In contrast, the Rössler system provides complementary insights due to its simpler attractor and longer memory. These findings contribute to a multidisciplinary methodology for selecting and optimizing chaotic systems in secure communication and signal processing contexts.

Cryptography doi: 10.3390/cryptography9030057

Authors: Xiyuan Cheng Tiancong Cheng Xinyu Yang Wenbin Cheng Yiting Lin

With the rapid development of big data and artificial intelligence, the problem of image privacy leakage has become increasingly prominent, especially for images containing sensitive information such as faces, which poses a higher security risk. In order to improve the security and efficiency of image privacy protection, this paper proposes an image encryption scheme that integrates face detection and multi-level encryption technology. Specifically, a multi-task convolutional neural network (MTCNN) is used to accurately extract the face area to ensure accurate positioning and high processing efficiency. For the extracted face area, a hierarchical encryption framework is constructed using chaotic systems, lightweight block permutations, RNA cryptographic systems, and bit diffusion, which increases data complexity and unpredictability. In addition, a key update mechanism based on dynamic feedback is introduced to enable the key to change in real time during the encryption process, effectively resisting known plaintext and chosen plaintext attacks. Experimental results show that the scheme performs well in terms of encryption security, robustness, computational efficiency, and image reconstruction quality. This study provides a practical and effective solution for the secure storage and transmission of sensitive face images, and provides valuable support for image privacy protection in intelligent systems.

Cryptography doi: 10.3390/cryptography9030056

Authors: Sunil Kumar Dharminder Chaudhary S. A. Lakshmanan Cheng-Chi Lee

In several stream cipher designs, Boolean functions (BFs) play a crucial role as non-linear components, either serving as filtering functions or being used within the combining process. The overall strength of stream ciphers mainly depends on certain cryptographic properties of BFs, including their balancedness, non-linearity, resistance to correlation, and algebraic degrees. In this paper, we present novel findings related to the algebraic degrees of BFs, which play an important role in the design of symmetric cryptographic systems, and propose a novel algorithm to directly deduce the algebraic degree of a Boolean function (BF) from its truth table. We also explore new results concerning balanced Boolean functions, specifically characterizing them by establishing new results regarding their support. Additionally, we propose a new approach for a subclass of affine equivalent Boolean functions and discuss well-known cryptographic properties in a very simple and lucid manner using this newly introduced approach. Moreover, we propose the first algorithm in the literature to construct non-quadratic balanced Boolean functions (NQBBFs) that possess no linear structure where their derivative equals 1. Finally, we discuss the complexity of this algorithm and present a table that shows the time taken by this algorithm, after its implementation in SageMath, for the generation of Boolean functions corresponding to different values of n (i.e., number of variables).

Cryptography doi: 10.3390/cryptography9030055

Authors: Kung-Wei Hu Wun-Ting Lin Huan-Chih Wang Ja-Ling Wu

This paper enhances the multikey scenario in the Gentry–Sahai–Waters (GSW) fully homomorphic encryption scheme to increase its real-world applicability. We integrate the advantages of two existing GSW multikey approaches: one enabling distributed decryption and the other reducing memory requirements. We also apply the CRT decomposition and ciphertext compression techniques to the multikey settings. While leveraging the effectiveness of decomposition, we adapt the compression technique for practical cryptographic applications, as demonstrated through simulations in federated learning and multiparty communication scenarios. Our work’s potential impact on the cryptography field is significant, as it offers a more efficient and secure solution for distributed data processing in real-world scenarios, thereby advancing the state of the art in secure communication systems.

Cryptography doi: 10.3390/cryptography9030054

Authors: Afef Kchaou Sehmi Saad Hatem Garrab Mohsen Machhout

This paper presents a comprehensive register transfer-level (RTL) fault injection study targeting the program counter (PC) of the LEON3 processor, a SPARC V8-compliant core widely used in safety-critical and radiation-prone embedded applications. Using the enhanced NETFI+ framework, over four million faults, including single-event upsets (SEUs), multiple-bit upsets (MBUs), and single-event transients (SETs), were systematically injected into the PC across all pipeline stages. The analysis reveals that early stages, particularly Fetch (FE), Decode (DE), Register Access (RA), and Execute (EX), are highly sensitive to SEU and MBU faults. The propagation of errors detected in the two early stages of the pipeline (FE and DE) is classified with an important percentage of halt execution and timeout traps. Intermediate stages, such as RA and EX, exhibited a higher incidence of silent data corruption and halt execution, while the Memory (ME) and Exception (XC) stages demonstrated greater resilience through fault masking. SET faults were mostly transient and masked, though they occasionally resulted in control flow anomalies. In addition to error classification, detailed trap and exception analysis was performed to characterize fault-induced failure mechanisms. The findings underscore the need for pipeline-stage-specific hardening strategies and highlight the value of simulation-based fault injection for early design validation in safety-critical embedded processors.

Cryptography doi: 10.3390/cryptography9030053

Authors: Sana Challi Mukul Kulkarni Taoufik Serraj

Identity-based cryptography introduced by Shamir (Crypto’84) has seen many advances through the years. In the context of post-quantum identity-based schemes, most of the efficient designs are based on lattices. In this work, we propose an identity-based identification (IBI) scheme and an identity-based signature (IBS) scheme based on codes. Our design combines the hash-and-sign signature scheme, Wave, with a Stern-like signature scheme, BGKM-SIG1, instantiated over a ternary field using the large-weight Syndrome Decoding Problem (SDP). Our scheme significantly outperforms existing code-based identity-based signature constructions.

Cryptography doi: 10.3390/cryptography9030052

Authors: Abdul Ghafoor Iraklis Symeonidis Anna Rydberg Cecilia Lindahl Abdul Qadus Abbasi

Cybersecurity represents a critical challenge for data-sharing platforms involving multiple stakeholders, particularly within complex and decentralized systems such as livestock supply chain networks. These systems demand novel approaches, robust security protocols, and advanced data management strategies to address key challenges such as data consistency, transparency, ownership, controlled access or exposure, and privacy-preserving analytics for value-added services. In this paper, we introduced the Framework for Livestock Empowerment and Decentralized Secure Data eXchange (FLEX), as a comprehensive solution grounded on five core design principles: (i) enhanced security and privacy, (ii) human-centric approach, (iii) decentralized and trusted infrastructure, (iv) system resilience, and (v) seamless collaboration across the supply chain. FLEX integrates interdisciplinary innovations, leveraging decentralized infrastructure-based protocols to ensure trust, traceability, and integrity. It employs secure data-sharing protocols and cryptographic techniques to enable controlled information exchange with authorized entities. Additionally, the use of data anonymization techniques ensures privacy. FLEX is designed and implemented using a microservices architecture and edge computing to support modularity and scalable deployment. These components collectively serve as a foundational pillar of the development of a digital product passport. The FLEX architecture adopts a layered design and incorporates robust security controls to mitigate threats identified using the STRIDE threat modeling framework. The evaluation results demonstrate the framework’s effectiveness in countering well-known cyberattacks while fulfilling its intended objectives. The performance evaluation of the implementation further validates its feasibility and stability, particularly as the volume of evidence associated with animal identities increases. All the infrastructure components, along with detailed deployment instructions, are publicly available as open-source libraries on GitHub, promoting transparency and community-driven development for wider public benefit.

Cryptography doi: 10.3390/cryptography9030051

Authors: Xinyao Li Akhilesh Tyagi

Modern x86 processors incorporate performance-enhancing features such as prefetching mechanisms, cache coherence protocols, and support for large memory pages (e.g., 2 MB huge pages). While these architectural innovations aim to reduce memory access latency, boost throughput, and maintain cache consistency across cores, they can also expose subtle microarchitectural side channels that adversaries may exploit. This study investigates how the combination of prefetching techniques and huge pages can significantly enhance the throughput and accuracy of covert channels in controlled computing environments. Building on prior work that examined the impact of the MESI cache coherence protocol using single-cache-line access without huge pages, our approach expands the attack surface by simultaneously accessing multiple cache lines across all 512 L1 lines under a 2 MB huge page configuration. As a result, our 9-bit covert channel achieves a peak throughput of 4940 KB/s—substantially exceeding previously reported benchmarks. We further validate our channel on AMD SEV-SNP virtual machines, achieving up to an 88% decoding accuracy using write-access encoding with 2 MB huge pages, demonstrating feasibility even under TEE-enforced virtualization environments. These findings highlight the need for careful consideration and evaluation of the security implications of common performance optimizations with respect to their side-channel potential.

Cryptography doi: 10.3390/cryptography9030050

Authors: Dongyu Wu Bei Liang Zijie Lu Jintai Ding

Over years of development in secure multi-party computation (MPC), many sophisticated functionalities have been made practical, and multi-dimensional operations occur more and more frequently in MPC protocols, especially in protocols involving datasets of vector elements, such as privacy-preserving biometric identification and privacy-preserving machine learning. In this paper, we introduce a new kind of correlation, called tensor triples, which is designed to make multi-dimensional MPC protocols more efficient. We will discuss the generation process, the usage, and the applications of tensor triples and show that they can accelerate privacy-preserving biometric identification protocols, such as FingerCode, Eigenfaces, and FaceNet, by more than 1000 times, with reasonable offline costs, and grant pre-computability for the secure matrix multiplication process in privacy-preserving machine learning protocols, such as SecureML and SecureNN, while achieving similar efficiency.

Cryptography doi: 10.3390/cryptography9030048

Authors: Nikola Hristov-Kalamov Raúl Fernández-Ruiz Agustín Álvarez-Marquina Julio Guillén-García Roberto Gallardo-Cava Daniel Palacios-Alonso

As the demand for expansive back-end systems in online applications continues to grow, novel frameworks are necessitated to address the escalating operational demands, energy consumption, and associated costs. Traditional Client–Server models, while offering centralized security and reliability, are characterized by their high deployment and maintenance expenses. Conversely, Peer-to-Peer (P2P) models, despite being cost-effective and scalable, are hindered by inherent security and data integrity challenges. Moreover, the lack of a central authority in P2P systems complicates a definitive resolution of scenarios involving stakes, where users cannot withdraw without incurring a tangible loss. In this research work, a hybrid back-end framework is introduced, combining the advantages of both models through the utilization of cryptographic algorithms and Secure Multi-Party Computation (MPC) protocols. The baseline solution is lightweight and fully composable, making it capable of utilizing different more complex slot-in MPC techniques. The proposed framework’s effectiveness is demonstrated through a simplified two-player Spades game, although it is fully generalizable to any application. Evaluations across multiple case studies reveal substantial performance enhancements compared to conventional approaches, particularly post-initialization, highlighting the scheme’s potential as a cost-effective, energy-efficient, and secure solution for modern online applications.

Cryptography doi: 10.3390/cryptography9030049

Authors: Ran Chu Jun Mou Yuanhui Cui

A dual watermark and DNA image encryption based on a chaotic map is proposed. Firstly, a new discrete chaotic map is proposed, and the dynamic characteristics are analyzed. Then, the hash value changes initial conditions, and the pseudo-random sequence is generated. The encrypted copyright image is fused with the feature value of the original image and then encrypted again to form zero-watermarking, which is registered with the copyright certification authority. The zero-watermarking is taken as a robust watermark and embedded into the original image based on a chaotic sequence to ensure its invisibility. Finally, a cross-mutation DNA encryption is proposed. The experimental results verify the performance of encryption and dual watermark copyright authentication, and the ability to resist attacks.

Cryptography doi: 10.3390/cryptography9030047

Authors: Holger Mandry Julian Spiess Bjoern Driemeyer Joachim Becker Maurits Ortmanns

We present the first implementation of an FPGA-based PUF that leverages the usually contradictory requirements of stability and response time. Many state-of-the-art implementations of PUFs are either slow with a low error rate, like the ring oscillator-PUF, or fast with a higher error rate, like the arbiter-PUF. The presented implementation of an eye-opening PUF uses the phase-integrating effect of a ring oscillator to realize the shortest possible response for the required stability of the readout. This principle also allows for new automatic detection of unstable bits based on counting the number of oscillations required until an arbitration is conducted. This first implementation of an eye-opening PUF reduces the bit error rate to a number under our measurement limits, while the readout time is simultaneously kept as low as ≤1.54 μs, with an average of 0.85 μs. In addition, environmental temperature changes are evaluated, and methods for limiting these effects are discussed.

Cryptography doi: 10.3390/cryptography9020046

Authors: Hai Huang Jiwen Zheng Zhengyu Chen Shilei Zhao Hongwei Wu Bin Yu Zhiwei Liu

Modular multiplication is a pivotal operation in public-key cryptosystems such as RSA, ElGamal, and ECC. Modular multiplication design is crucial for improving overall system performance due to the large-bit-width operation with high computational complexity. This paper provides a classification of integer multiplication algorithms based on their implementation principles. Furthermore, the core concepts, implementation challenges, and research advancements of multiplication algorithms are systematically summarized. This paper also gives a brief overview of modular reduction algorithms for various types of moduli and discusses the implementation principles, application scenarios, and current research results. Finally, the detailed research development of modular multiplication algorithms in four major classes over prime fields is deeply analyzed and summarized, making it essential as a guide for future research.

Cryptography doi: 10.3390/cryptography9020045

Authors: Ismel Martínez-Díaz Carlos Miguel Legón-Pérez Guillermo Sosa-Gómez

Among the multiple important properties that characterize strong S-boxes for symmetric cryptography and are used in their designs, this study focuses on two: the non-linearity property, a classical security metric, and the confusion coefficient variance property, a statistical proxy for side channel resistance under the Hamming weight leakage model. Given an S-box, two sets can be created: the set of affine-shifted S-boxes, where S-boxes have the same non-linearity value, and the set of Hamming weight classes, where S-boxes have the same confusion coefficient variance value. The inherent values of these two properties ensure resistance to cryptographic attacks; however, if the value of one property increases, it will imply a decrease in the value of the other property. In view of the aforementioned fact, attaining a trade-off becomes a complex undertaking. The impetus for this research stems from the following hypothesis: if an initial S-box already exhibits a trade-off, it would be advantageous to employ a method that generates new S-boxes while preserving the balance. A thorough review of the extant literature reveals the absence of any methodology that encompasses the aforementioned elements. The present paper proposes a novel methodology for generating an affine-shifted subset of S-boxes, ensuring that the resulting subset possesses the same confusion coefficient variance value. We provide insights on the optimal search strategy to optimize non-linearity and confusion coefficient variance. The proposed methodology guarantees the preservation of constant values on the designated. It is possible to incorporate these properties into a comprehensive design scheme, in which case the remaining S-box properties are to be examined. We also demonstrate that, despite the fact that this subset contains S-boxes with the theoretical resistance to side channel attacks under the Hamming weight model, the S-boxes are in different Hamming weight classes.

Cryptography doi: 10.3390/cryptography9020044

Authors: Dongfang Zhao

We propose a new framework for compile-time ciphertext synthesis in fully homomorphic encryption (FHE) systems. Instead of invoking encryption algorithms at runtime, our method synthesizes ciphertexts from precomputed encrypted basis vectors using only homomorphic additions, scalar multiplications, and randomized encryptions of zero. This decouples ciphertext generation from encryption and enables efficient batch encoding through algebraic reuse. We formalize this technique as a randomized module morphism and prove that it satisfies IND-CPA security. Our proof uses a hybrid game framework that interpolates between encrypted vector instances and reduces the adversarial advantage to the indistinguishability advantage of the underlying FHE scheme. This reduction structure captures the security implications of ciphertext basis reuse and structured noise injection. The proposed synthesis primitive supports fast, encryption-free ingestion in outsourced database systems and other high-throughput FHE pipelines. It is compatible with standard FHE APIs and preserves layout semantics for downstream homomorphic operations.

Cryptography doi: 10.3390/cryptography9020043

Authors: Cheng-Chi Lee Tuan-Vinh Le Chun-Ta Li Dinh-Thuan Do Agbotiname Lucky Imoize

Recent advancements in wireless communication systems have facilitated the development of cutting-edge applications in modern architecture, and these systems are rapidly transforming our daily activities and enabling critical industrial processes [...]

Cryptography doi: 10.3390/cryptography9020042

Authors: Dawoon Kwon Junghwan Song

Differential cryptanalysis is one of the fundamental cryptanalysis techniques to evaluate the security of the block cipher. In many cases, resistance to differential cryptanalysis is proven through the upper bound of the differential characteristic probability, not the differential probability. Since the attacker uses a differential rather than a differential characteristic, resistance based on a differential characteristic tends to overestimate the security level of the block cipher. Such an overestimation is notably observed in lightweight block ciphers SKINNY, Midori, and CRAFT. In this paper, we examine the gap between the differential characteristics and the differential probability of lightweight block ciphers. We present practical methods for computing differential probability using a multistage graph. Using these methods, we count the exact number of maximum differential characteristics with fixed plaintext/ciphertext difference and activity pattern. By the exact number of maximum differential characteristics, we can calculate the probability that is closer to the real differential probability. In addition, by modifying the method, we compute a more accurate differential probability by considering the characteristics of the lower probability. We find differential distinguishers of 9-round Midori64 with probability 2−61.58, 9-round SKINNY64 with 2−58.67 and 14-round CRAFT with 2−60.32. Furthermore, we find a related-tweakey differential distinguisher of 11-round SKINNY64-64 with 2−55.93 and a related-tweak differential distinguisher of 17-round CRAFT with probability 2−63.37. Finally, we explain why these gaps are notable in Midori64, SKINNY64 and CRAFT by relating the S-box differential distribution table.

Cryptography doi: 10.3390/cryptography9020041

Authors: Bo Mi Siyuan Zeng Ran Zeng Fuyuan Wang Qi Zhou

With the rapid development of the automotive industry, research on the internet of vehicles (IoV) has become a hot topic in the field of automobiles. Considering the privacy of data collected from vehicles, this paper proposes a novel multiparty homomorphic encryption scheme (MHE) for secure multiparty computation without the need for a trusted third party. The scheme ensures efficient computation of data while preserving the privacy of each party’s data. It consists of four phases: construction, computation, recombination, and refreshing. In the recombination phase, the key is reconstructed using a span program, enabling secure computation among participating parties under a semi-honest model. Finally, we compare the proposed scheme with mainstream approaches and conduct experiments within the framework of federated learning. Through both experimental and theoretical analyses, the performance of the proposed scheme is comprehensively evaluated, demonstrating its efficiency and correctness.

Cryptography doi: 10.3390/cryptography9020040

Authors: Mohammed Rahmani Abderrahmane Nitaj Abdelhamid Tadmori Mhammed Ziane

In this paper, we present a novel method to solve trivariate polynomial modular equations of the form x(y2+Ay+B)+z≡0 (mod e). Our approach integrates Coppersmith’s method with lattice basis reduction to efficiently solve the former equation. Several variants of RSA are based on the cubic Pell equation x3+fy3+f2z3−3fxyz≡1 (mod N), where f is a cubic nonresidue modulus N=pq. In these variants, the public exponent e and the private exponent d satisfy ed≡1 (mod ψ(N)) with ψ(N)=p2+p+1q2+q+1. Moreover, d can be written in the form d≡v0z0 (mod ψ(N)) with any z0 satisfying gcd(z0,ψ(N))=1. In this paper, we apply our method to attack the variants when d≡v0z0 (mod ψ(N)) and when |z0| and |v0| are suitably small. We also show that our method significantly improves the bounds of the private exponents d of the previous attacks on the variants, particularly in the scenario of small private exponents and in the scenarios where partial information about the primes is available.

Cryptography doi: 10.3390/cryptography9020039

Authors: Ali Abdullah S. AlQahtani

Traditional key derivation techniques, including the widely adopted PBKDF2, operate with static parameters that do not account for contextual factors such as device capabilities, data sensitivity, or password strength. In this paper, we propose a novel adaptive PBKDF2-based encryption scheme that adjusts its iteration count dynamically based on computational resource index (CRI), data risk level (DRL), and password strength assessment. We present the theoretical model, algorithmic design, and empirical validation of our approach through nine comprehensive experiments, covering performance, scalability, brute-force resistance, entropy quality, and cross-platform consistency. Our results confirm that the adaptive method achieves a secure balance between computational cost and cryptographic strength, outperforming static PBKDF2 in dynamic scenarios. Our framework enhances cryptographic resilience in real-world deployments and offers a forward-compatible foundation for adaptive security solutions.

Cryptography doi: 10.3390/cryptography9020038

Authors: Manohar Raavi Qaiser Khan Simeon Wuthier Pranav Chandramouli Yaroslav Balytskyi Sang-Yoon Chang

Quantum computing challenges the mathematical problems anchoring the security of the classical public key algorithms. For quantum-resistant public key algorithms, the National Institute of Standards and Technology (NIST) has undergone a multi-year standardization process and selected the post-quantum cryptography (PQC) public key digital signatures of Dilithium, Falcon, and SPHINCS+. Finding common ground to compare these algorithms can be difficult because of their design differences, including the fundamental math problems (lattice-based vs. hash-based). We use a visualization model to show the key/signature size vs. security trade-offs for all PQC algorithms. Our performance analyses compare the algorithms’ computational loads in the execution time. Building on the individual algorithms’ analyses, we analyze the communication costs and implementation overheads when integrated with Public Key Infrastructure (PKI) and with Transport Layer Security (TLS) and Transmission Control Protocol (TCP)/Internet Protocol (IP). Our results show that the lattice-based algorithms of Dilithium and Falcon induce lower computational overheads than the hash-based algorithms of SPHINCS+. In addition, the lattice-based PQC can outperform the classical algorithm with comparable security strength; for example, Dilithium 2 and Falcon 512 outperform RSA 4096 in the TLS handshake time duration.