2025Activity reportProject-TeamCANARI
RNSR: 202324429H- Research center Inria Centre at the University of Bordeaux
- In partnership with:CNRS, Université de Bordeaux
- Team name: Cryptography ANalysis and ARIthmetic
- In collaboration with:Institut de Mathématiques de Bordeaux (IMB)
Creation of the Project-Team: 2023 July 01
Each year, Inria research teams publish an Activity Report presenting their work and results over the reporting period. These reports follow a common structure, with some optional sections depending on the specific team. They typically begin by outlining the overall objectives and research programme, including the main research themes, goals, and methodological approaches. They also describe the application domains targeted by the team, highlighting the scientific or societal contexts in which their work is situated.
The reports then present the highlights of the year, covering major scientific achievements, software developments, or teaching contributions. When relevant, they include sections on software, platforms, and open data, detailing the tools developed and how they are shared. A substantial part is dedicated to new results, where scientific contributions are described in detail, often with subsections specifying participants and associated keywords.
Finally, the Activity Report addresses funding, contracts, partnerships, and collaborations at various levels, from industrial agreements to international cooperations. It also covers dissemination and teaching activities, such as participation in scientific events, outreach, and supervision. The document concludes with a presentation of scientific production, including major publications and those produced during the year.
Keywords
Computer Science and Digital Science
- A4.3.1. Public key cryptography
- A4.3.3. Cryptographic protocols
- A4.3.4. Quantum Cryptography
- A8.5. Number theory
- A8.10. Computer arithmetic
Other Research Topics and Application Domains
- B9.5.1. Computer science
- B9.5.2. Mathematics
- B9.8. Reproducibility
- B9.10. Privacy
1 Team members, visitors, external collaborators
Research Scientists
- Damien Olivier Robert [Team leader, INRIA, Senior Researcher, HDR]
- Razvan Barbulescu [CNRS, Researcher]
- Xavier Caruso [CNRS, Senior Researcher, HDR]
- Andreas Enge [INRIA, Senior Researcher, HDR]
- Fredrik Johansson [INRIA, Researcher]
- Sabrina Kunzweiler [INRIA, ISFP]
- Aurel Page [INRIA, Researcher, HDR]
- Alice Pellet Mary [CNRS, Researcher]
Faculty Members
- Karim Belabas [UNIV BORDEAUX, Professor, HDR]
- Elena Berardini [CNRS, Professor]
- Maxime Bombar [UNIV BORDEAUX, Associate Professor, from Feb 2025]
- Guilhem Castagnos [UNIV BORDEAUX, Associate Professor, HDR]
- Henri Cohen [UNIV BORDEAUX, Emeritus]
- Jean-Marc Couveignes [UNIV BORDEAUX, Professor, HDR]
- Fabrice Etienne [UNIV BORDEAUX, ATER, from Sep 2025]
- Jean Gasnier [UNIV BORDEAUX, ATER, from Oct 2025]
- Olivier Ruatta [INSPE - LIMOGES, Professor Delegation, from Sep 2025]
Post-Doctoral Fellows
- Marc Houben [INRIA, Post-Doctoral Fellow]
- Wenwen Xia [UNIV BORDEAUX, Post-Doctoral Fellow, from Oct 2025]
PhD Students
- Alix Barraud [CNRS]
- Rayane Baït [UNIV BORDEAUX, from Sep 2025]
- Agathe Beaugrand [UNIV BORDEAUX, from Apr 2025 until Aug 2025]
- Agathe Beaugrand [UNIV BORDEAUX, until Mar 2025]
- Pierrick Dartois [IMT, until Aug 2025]
- Fabrice Drain [UNIV BORDEAUX]
- Fabrice Etienne [UNIV BORDEAUX, until Aug 2025]
- Jean Gasnier [UNIV BORDEAUX, until Sep 2025]
- Brieuc Lair [UNIV BORDEAUX, from Sep 2025]
- Afonso Li [UNIV BORDEAUX]
- Guilhem Mureau [INRIA]
- Leo Noel [NOKIA, CIFRE, from May 2025]
- Nicolas Sarkis [UNIV BORDEAUX, until Aug 2025]
- Alexander Wiesner [UNIV BORDEAUX, from Sep 2025]
- Anne-Edgar Wilke [UNIV BORDEAUX, until Apr 2025]
Technical Staff
- Bill Allombert [CNRS, Engineer]
Administrative Assistants
- Flavie Blondel [INRIA]
- Anne-Laure Gautier [INRIA]
Visiting Scientist
- Giacomo Spriano [ENS PARIS, from Sep 2025]
External Collaborators
- Maxime Bombar [UNIV BORDEAUX, until Feb 2025]
- Luca De Feo [IBM RESEARCH EUROPE, HDR]
- Benjamin Wesolowski [CNRS]
2 Overall objectives
The primary goals of the Canari project are, firstly, to design algorithmic solutions to manipulate the objects involved in the Langlands programme, secondly to develop algorithmic tools to handle the necessary arithmetic and analysis (real, complex and -adic) involved, and thirdly, to derive concrete applications, in particular to cryptography.
The Langlands programme postulates deep relationships between objects of three apparently unrelated worlds: the automorphic world, the world of Galois representations, and the motivic world.
The automorphic world belongs to the realm of analysis and infinite-dimensional vector spaces: its main citizens are automorphic forms, which are certain smooth functions satisfying nice differential equations. The number-theoretic content comes from the domains of these functions: they are defined on so-called arithmetic manifolds, of which many classical objects are special cases: modular curves, moduli spaces of abelian varieties, the space of Euclidean lattices of a given dimension, Arakelov class groups, etc.
The world of Galois representations is about symmetry and algebra. The main citizen is the group of all symmetries of the field of all algebraic numbers, the absolute Galois group . Galois representations are linear actions of on finite-dimensional vector spaces over a field (complex numbers, -adic numbers and finite fields are all important). They are like powerful microscopes that allow us to visualise a tiny portion of as a group of geometric symmetries.
The motivic world is about geometry. Its main citizens are algebraic varieties, that is, sets of solutions of polynomial equations, and their associated cohomologies. Important examples are algebraic curves and abelian varieties. One can classify varieties by discrete, or cohomological, invariants such as dimension and genus (integers). On some families of algebraic varieties, after fixing these discrete invariants, the family is classified by a continuous space which is itself an algebraic variety called a moduli space. Moduli spaces of curves and abelian varieties play a key role in number theory and in cryptography.
These worlds are tied together via the central notion of -function: generating series adapted to number theory. Each world has its own recipe to produce -functions, and the Langlands programme asserts that the -functions coming from the three worlds are the same; this has striking consequences as each origin then brings special properties to the other ones. A large portion of current research in number theory is placed in this context. Thus -functions can be seen as bridges between these three worlds, and the main goal of the team is to give algorithms to construct these bridges in practice.
A strong focus on the team is on making our algorithms available through open source software, notably Pari/GP, Flint (Arb, Calcium) and Mpc.
3 Research program
The team is organised around three axes. The goal of the first axis is to give a systematic computational treatment of objects from the Langlands programme, and to investigate algorithmic insight that can be gained by approching problems in computational number theory from the Langlands programme point of view.
These algorithms will be of two kinds: exact or of analytic, approximated nature (-adic, real or complex). Hence, the second axis is concerned with the development of effective complex and -adic analysis to handle the analytic objects that appear naturally. Finally, the new objects and computational problems will provide potential bases for next-generation cryptosystems, and the third axis uses these new insights to analyse the security of post-quantum cryptography, build new cryptosystems and improve the existing ones and study their security.
3.1 Algorithms for higher dimensional number theory
The goal of this axis is to design and implement efficient algorithms to enumerate, construct, represent, and compute with the fundamental objects of the Langlands programme and to explore their interactions. This will provide versatile tools for mathematicians to progress on difficult problems by directly manipulating intricate objects, and a collection of new problems and algorithms for cryptographers to use for the design of next-generation cryptographic primitives. Since many of these objects have a strong analytic flavour, the methods from our effective analysis axis will be vital.
The main topics of this theme will be:
- Automorphic forms: compute spaces of automorphic forms (Siegel and Hilbert modular forms, ...)
- Galois representations: compute Artin representations using tools from representation theory, Iwasawa theory, -adic Hodge theory.
- Varieties: abelian varieties, curves of higher genus, Shimura varieties and moduli spaces, hypergeometric motives.
- Bridges from the Langlands programme.
3.2 Effective analysis
The goal of this axis is to develop algorithms for efficient and reliable arithmetics in various fields (real, complex, -adic, finite), which is a prerequisite for computing with the number theoretical objects of both Axis 1 and Axis 3, and especially -functions, which are analytic objects by nature (defined in terms of series and integrals). Beyond elementary arithmetic and linear and nonlinear algebra, we also frequently need effective algorithms in the realm of complex and -adic analysis, including algorithms for solving differential equations.
There is a wealth of research questions to address to guarantee convergence, optimal complexities and efficiency at different precisions, as well as the exactness of the results.
The main topics of this theme will be:
- Real and complex analysis: rigorous algorithms for evaluating holonomic functions. For analytic operations like limits, differentiation, summation and integration, develop algorithms with guaranteed accuracy that can handle functions with singularities or pathological behaviour like strong oscillation.
- Symbolic-numeric representations: reduce the cost of computing with algebraic numbers of large degree or height, compute with mixed algebraic and purely transcendental fields.
- -adic analysis: optimise -adic linear algebra and -adic commutative algebra (including Gröbner bases) with respect to precision loss and instabilities.
3.3 Next generation and post-quantum cryptography
While the objects mentioned in Axis 1 may appear excessively abstract, when suitably instantiated, they become basic building blocks for next generation cryptosystems. First, these algebraic objects make it possible to construct quantum-resistant public key cryptosystems, which may become indispensable to secure communications in a future where large-scale quantum computers have become a reality. Second, the richness of these objects enables the construction of cryptographic schemes with advanced properties, such as homomorphic encryption, decentralised cryptography, secure multiparty computation and verifiable delay functions. The cryptosystems that will be studied in the team are related to (generalisations) of ideals and class groups in number fields: algebraic lattices, actions of class groups of orders in number fields and actions of groupoids constructed from quaternion algebras. Building and analysing these cryptosystems requires a deep understanding of the mathematical structures underlying them, which cannot simply be treated as black boxes.
The main topics of this theme will be:
- Isogenies: new cryptographic protocols from higher dimensional isogenies.
- Lattices: investigate the hardness of finding short vectors in algebraically structured lattices.
- Pairings and discrete logarithms, quantum algorithms to compute unit and class groups .
- Orders of number fields: algorithms for computing with orders in number fields, as well as regulators and class groups. These algorithms can be used to construct groups of unknown order, which find applications in advanced cryptographic primitives, for instance in the area of homomorphic encryption or threshold cryptography.
- Verifiable delay functions.
4 Application domains
Our main existing and future impact is through our software, notably Pari/GP, Flint (Arb, Calcium) and Mpc, which are world leaders in their respective domains. Pari/GP is the leading package used in number theory, and integrated into wider platforms like SageMath. Flint focus on lower level building blocks for number theory, like polynomial arithmetic, interval arithmetic (Arb) and symbolic computations (Calcium). Mpc, with its guarantees of correct rounding for basic complex arithmetic operations, operates on a lower level and thus has a larger scope. It serves as a reference for the GNU C library and is installed alongside GCC on each computer requiring the GNU Compiler Collection. The interval arithmetic of Arb provides a more flexible use case than Mpc, whence it has the widest potential of applications, far beyond the need of algorithmic number theory. It is already used in Mathematica and Maple, and a goal of the team will be to develop its reach even more.
The main impact of Axis 1, apart from the cryptographic applications, will be to give new tools to mathematicians to explore the world of the Langlands programme, construct objects explicitly and carry out experimentations, in particular via Pari/GP.
The main impact of Axis 2 will be the improvement of tools to handle precision better (floating point, -adic, interval arithmetic), broadening the scope outside the context of pure arithmetic. The focus of Axis 2 is different from scientific computing in that we require very high precision (hundreds to tens of thousands of digits), and if possible with certified approximation bounds.
Concerning Axis 3, the requirement by governmental agencies to have post-quantum cryptographic solutions means that the civil society already needs to pivot towards such solutions. The NIST has an ongoing post-quantum cryptography standardisation process. This is an international process and the Canari team will contribute to the analysis (and improvement) of the security of some of these schemes (notably the isogeny based ones and the ideal lattices ones).
5 Social and environmental responsibility
5.1 Footprint of research activities
The main footprint of our research activites are:
- The ecological impact of attending international conferences. We have signed the University of Bordeaux ecological chart saying that we should try to reduce travel and privilege train as much as possible. Some of us also signed a more restrictive commitment, saying that we will try to limit ourselves to 20 000km traveled by plane over a period of two years.1
- The impact of our computations. Some of our record computations (largest class polynomials, largest primality proof) require using a large cluster for a long time. To reduce this impact we aim to develop faster algorithms.
5.2 Impact of research results
Another possible impact of Axis 3 will be ecological. Moving blockchains from Proof of Work to Proof of Stake is key to reduce their ecological impact. Verifiable delay functions are a core component of proof of stake, so Axis 3 will play a small role in helping this transition. In the same vein, cryptography based on class groups makes it possible to reduce the bandwidth used for certain multiparty protocols.
6 Highlights of the year
Highlights of 2025 include the HDR defense of Aurel Page 36Hecke operators in algorithmic number theory in June 2025, and of Razvan Barbulescu 31Cryptanalysis of factoring and the discrete logarithms problem and their ramifications on the smooth numbers and modular curves in July 2025; along with 6 PhDs defenses: Agathe Beaugrand, Pierrick Dartois, Fabrice Étienne, Jean Gasnier Nicolas Sarkis, Anne-Edgar Wilke 32, 34, 37, 33, 35.
Canari was part of the submission of SQISign for round 2 of NIST’s call: Post-Quantum Cryptography: Additional Digital Signature Schemes, SQISign project.
There were new releases of Pari/GP (pari-2.17.3) and Flint (flint-3.4.0).
In a collaboration with Paul Underwood, A. Enge has used his CM software to establish a new record for proving a generic prime, namely the “repunit” , consisting of 109297 digits 1. The computation took place over 21 months and required 220 CPU years. Details can be found in a dedicated blog post.
6.1 Awards
- Guilhem Mureau got the Luca Trevisan Best Young Researcher Paper Award for his article “Special Genera of Hermitian Lattices and Applications to HAWK ” published at TCC 2025.
- Fredrik Johansson received the Applications of Computer Algebra Early Researcher Award 2025.
7 Latest software developments, platforms, open data
7.1 Latest software developments
7.1.1 PARI/GP
-
Keyword:
Computational number theory
-
Functional Description:
PARI/GP is a cross platform and open-source computer algebra system designed for fast computations in number theory: factorizations, algebraic number theory, elliptic curves, modular forms, L functions... It also contains a wealth of functions to compute with mathematical entities such as matrices, polynomials, power series, algebraic numbers, etc., and a lot of transcendental functions as well as numerical summation and integration routines. PARI is also available as a C library to allow for faster computations.
- URL:
-
Contact:
Aurel Page
-
Participant:
5 anonymous participants
-
Partner:
CNRS
7.1.2 FLINT
-
Name:
Fast Library for Number Theory
-
Keywords:
Computer algebra, Computational number theory, Arithmetic
-
Functional Description:
FLINT is a C library for doing number theory. At its core, FLINT provides arithmetic in standard rings such as the integers, rationals, algebraic, real, complex and p-adic numbers, finite fields, and number fields. It also provides polynomials (univariate and multivariate), power series, and matrices.
FLINT covers a wide range of functionality: primality testing, integer factorisation, multivariate polynomial GCD and factorisation, FFTs, multimodular reconstruction, special functions, exact and approximate linear algebra, LLL, finite field embeddings, and more.
- URL:
-
Contact:
Fredrik Johansson
-
Partner:
Technische Universität Kaiserslautern (UniKL)
7.1.3 GNU MPC
-
Keywords:
Complex number, Floating-point
-
Functional Description:
Mpc is a C library for the arithmetic of complex numbers with arbitrarily high precision and correct rounding of the result. It is built upon and follows the same principles as Mpfr. The library is written by Andreas Enge, Philippe Théveny and Paul Zimmermann.
-
Release Contributions:
Changes in version 1.3.1, released in December 2022: - Bug fix: It is again possible to include mpc.h without including stdio.h.
Changes in version 1.3.0 ("Ipomoea batatas"), released in December 2022: - New function: mpc_agm - New rounding modes "away from zero", indicated by the letter "A" and corresponding to MPFR_RNDA on the designated real or imaginary part. - New experimental ball arithmetic. - New experimental function: mpc_eta_fund - Bug fixes: - mpc_asin for asin(z) with small |Re(z)| and tiny |Im(z)| - mpc_pow_fr: sign of zero part of result when the base has up to sign the same real and imaginary part, and the exponent is an even positive integer - mpc_fma: the returned 'int' value was incorrect in some cases (indicating whether the rounded real/imaginary parts were smaller/equal/greater than the exact values), but the computed complex value was correct. - Remove the unmaintained Makefile.vc, build files for Visual Studio can be found at https://github.com/BrianGladman/mpc .
- URL:
-
Contact:
Andreas Enge
-
Participants:
Andreas Enge, Mickaël Gastineau, Paul Zimmermann, Philippe Theveny
7.1.4 SQISignHD
-
Keyword:
Cryptography
-
Functional Description:
Compact post-quantum signature algorithm using isogenies in higher dimension.
-
Contact:
Benjamin Wesolowski
7.1.5 SQIsign2d
-
Name:
Compact post-quantum signature algorithm using isogenies in dimension 2
-
Keyword:
Cryptography
-
Functional Description:
Compact post-quantum signature algorithm using isogenies in dimension 2, improving on SQIsign and SQIsignHD
-
Contact:
Luca De Feo
7.1.6 ThetaIsogenies
-
Keyword:
Cryptography
-
Functional Description:
Fast computation of 2n̂ isogenies in dimension 2.
- URL:
-
Contact:
Damien Olivier Robert
7.1.7 Kummer Line
-
Keyword:
Cryptography
-
Functional Description:
Library for the arithmetic of Kummer lines (arithmetic, isogenies, pairings)
- URL:
-
Contact:
Damien Olivier Robert
7.1.8 CM
-
Keyword:
Arithmetic
-
Functional Description:
The Cm software implements the construction of ring class fields of imaginary quadratic number fields and of elliptic curves with complex multiplication via floating point approximations. It consists of libraries that can be called from within a C program and of executable command line applications.
-
Release Contributions:
Version 0.4.4 "Fitzebohnen", released in July 2025, comes with the following new features: - Fix build with gcc-14. - Change parameters to increase likelihood of success for serial ecpp.
Version 0.4.3 "Fitzebohnen", released in February 2024, comes with the following new features: - Support FLINT version 3. - Add an upper bound on the permitted class number in ECPP, to avoid choosing discriminants for which class polynomials cannot be computed in reasonable time and with reasonable memory. - Add a binary ecpp-check for checking certificates.
- URL:
-
Contact:
Andreas Enge
-
Participant:
Andreas Enge
8 New results
8.1 Algorithms for number theory
Participants: Razvan Barbulescu, Karim Belabas, Xavier Caruso, Henri Cohen, Jean-Marc Couveignes, Andreas Enge, Fabrice Etienne, Aurel Page, Alice Pellet-Mary, Sabrina Kunzweiler, Wessel van Woerden.
In 44, K. de Boer, A. Pellet-Mary and B. Wesolowski gave a provable analysis of the heuristic algorithms of Buchmann/Biasse-Song, computing units and class groups of number fields in sub-exponential time.
The article 14, S. Kunzweiler and S. Wewers, has been published in Mathematics of Computation. They present a new algorithm to compute the lattice of integral differential forms of a superelliptic curve.
In 49, F. Étienne presents an algorithm to compute the Selmer groups of a finite Galois representation, using properties of Hecke operators of finite groups.
In 11, published in Acta Crystallographica, M. Sikirić, and W. van Woerden give a complete classification of six-dimensional iso-edge domains.
In 46, H. Cohen and W. Zudilin show how modifications of Apéry's continued fractions can give interesting results including new rapidly convergent continued fractions for certain interesting constants.
X. Caruso and his collaborators studied the algebraicity of the reductions modulo primes of -finite series. In 45, they state a general conjecture predicting the behavior of the Galois groups of when varies. Then, in 45, 52, they gave evidences towards their conjectures by computing or estimating the relevant Galois groups for several classes of -finite series, including Gaussian hypergeometric functions and Apéry-like sequences.
C. Armana, E. Berardini, X. Caruso, A. Leudière, J. Nardi, F. Pazuki wrote a algorithm-oriented survey on Drinfeld modules 39, covering in particular several applications to symbolic computation, cryptography and coding theory. This paper is supplemented by an implementation of Drinfeld modules and Anderson motives in SageMath, which is currenly submitted for integration in a future release.
The article 10 by X. Caruso and Q. Gazda on the computation of classical and -adic -series of -motives has been published in Research in Number Theory.
8.2 Cryptography
Participants: Agathe Beaugrand, Guilhem Castagnos, Ida Tucker.
In 6, A. Beaugrand, G. Castagnos and F. Laguillaumie develop efficient zero-knowledge proofs and arguments for the CL linearly homomorphic encryption scheme, addressing challenges posed by class groups of unknown order. The paper introduces batched proofs for ciphertext correctness, succinct shuffle arguments, and a new notion of partial extractability enabling Bulletproof-style techniques in the CL setting. Implementation shows that this approach is practical and enables maliciously secure applications such as an improved private set intersection sum protocol.
In 9, L. Braun, I. Damgård, F. Laguillaumie, K. Melissaris, C. Orlandi and I. Tucker improve distributed key generation and threshold decryption for the CL cryptosystem, reducing communication complexity compared to prior work. This is achieved by relaxing reconstruction requirements in verifiable secret sharing and by batching zero-knowledge proofs in unknown order groups, avoiding expensive proofs of knowledge. The resulting protocols are UC-secure with guaranteed output delivery, resilient to adaptive adversaries in the SIP model, and shown to be efficient through implementation and comparison with existing schemes.
8.3 Isogeny based cryptography
Participants: Bill Allombert, Pierrick Dartois, Sabrina Kunzweiler, Aurel Page, Damien Robert.
The paper 29, S. Kunzweiler, L. Maino T. Moriya C. Petit, G. Pope D. Robert, M. Stopar and Y.B. Ti, has been published in the proceeding of PKC 2025. The article studies cryptographic hash functions from isogeny graphs in dimension up to .
The paper 25, by D. Robert, written for the NuTMiC 2024 invited talk, a survey on the representation of isogenies, has been published in the LNCS proceedings.
The paper 22, by P. Dartois, J. Eriksen, B. Fouotsa, A. Herlédan Le Merdy R. Invernizzi, D. Robert, R. Rueger, F. Vercauteren, and B. Wesolowski, has been presented at CRYPTO 2025. It contains the first efficient implementation of an unrestricted class group action in the context of CSIDH, using isogenies in dimension 4.
The paper 24 by S. Galbraith, V. Gilchrist, and D. Robert has been presented at LATINCRYPT 2025. It gives new method to navigate isogeny volcanoes using self pairings and higher dimensional isogenies.
The paper 23 by P. Dartois, L. Maino, G. Pope and D. Robert, on optimised formula for -isogenies in dimension 2, presented in Asiacrypt 2024, was published in the LNCS proceedings.
The paper 18 by B. Allombert, F.-F. Biasse, J. K. Eriksen, P. Kutas, C. Leonardi, A. Page, R. Scheidler, and M. Tot Bagi, was published in PKC 2025.
8.4 Elliptic curves and abelian varieties
Participants: Razvan Barbulescu, Elena Berardini, Andreas Enge, Sabrina Kunzweiler, Aurel Page, Damien Robert, Nicolas Sarkis.
The paper 13 by J. Kieffer, A. Page and D. Robert on computing isogenies from modular polynomials in dimension 2 has appeared in Journal of Algebra.
The paper 30 by D. Robert and N. Sarkis has been presented at Eurocrypt 2025. It introduces the half ladder, factoring differential isogenies and doublings through 2-isogenies (leveraging theta groups in dimension 2), which gives a speed up on the standard Montgomery ladder for Montgomery curves.
In the preprint 40, R. Barbulescu, D. Robert and N. Sarkis study different models of Kummer lines through the prism of the theta group action. This gives a unified treatment of several families previously studied in the literature, along with some new characterisation of Montgomery curves.
The paper 12 by J. Gasnier and A. Guillevic on an algebraic point of view on the generation of pairing-friendly curves has been published in the SIAM Journal on Applied Algebra and Geometry.
The paper 17 by G. Pope, K. Reijnders, D. Robert, A. Sferlazza, and B. Smith was published in the journal IACR Communications in Cryptology. It leverages the cubical arithmetic introduced by D. Robert in 53 to simplify and accelerate computing pairings for isogeny based cryptography. The paper 15 by J. Lin, D. Robert, C. Zhao, and Y. Zheng, on using the biextension arithmetic also introduced in 53 for pairing based cryptography has been published in Designs, Codes and Cryptography.
The paper 16 by A. Maïga, D. Robert, D. Sow, on computing canonical lifts of elliptic curves in medium characteristic was published in Designs, Codes and Cryptography.
In the preprint 42 E. Berardini, A. Giangreco Maidana and S. Marseglia completely characterize abelian surfaces defined over finite fields which do not contain any possibly singular curve of genus less than or equal to 3, and explicitly describe the absolutely irreducible genus 3 curves lying on abelian surfaces containing no curves of genus less than or equal to 2.
8.5 Lattice-based cryptography
Participants: Afonso Li, Guilhem Mureau, Alice Pellet-Mary, Wenwen Xia.
In 21, C. Chevignard, G. Mureau, T. Espitau, A. Pellet-Mary, H. Pliatsok and A. Wallet studied the hardness of the module lattice isomorphism problem (module-LIP), which serve as a foundation for the security of Hawk, a signature scheme submitted to the NIST competition. In this work, they reduce the problem of breaking Hawk to the problem of computing a short element of a given norm, in a given ideal of some quaternion algebra. This problem, when instantiated with number fields instead of quaternion algebras, is known to be solvable in polynomial time. The quaternion algebra case however seems much more difficult to handle, and is still the subject of research from various teams, including the canari team.
In 28, B. Allombert, A. Pellet-Mary and W. van Woerden studied the hardness of module-LIP in number fields with at least one real embedding. They showed that in this case, there exists a polynomial time (heuristic) algorithm solving the problem. This does not impact the signature scheme Hawk, which is based on cyclotomic fields, i.e., fields with no real embeddings.
In 27, C. Chevignard and G. Mureau showed that there may be exponentially many ideals in a quaternion algebra that are above a given prime ideal of a number field. This shows that a previous algorithm used to solve module-LIP in totally real number fields cannot be immediately generalized to CM fields, since the naive generalization would require enumerating all the ideals mentioned above.
The paper 26 by W. van Woerden presented in Asiacrypt 2024 on Dense and Smooth Lattices in Any Genus was published in the LNCS proceedings.
In 43, K. de Boer, A. Page, R. Toma, and B. Wesolowski study the average hardness of the Short Independent Vector Problem (SIVP) in module lattices of fixed rank. They prove a worst case to average case reduction for this problem with a polynomial loss in the approximation factor, assuming the Generalized Riemann Hypothesis. The main tools are the theory of automorphic forms and the geometry of arithmetic orbifolds, which they use to prove a new quantitative fast equidistribution theorem for random walks in the space of module lattices.
8.6 Quantum algorithms for cryptanalysis
Participants: Razvan Barbulescu.
In 19, presented at LATINCRYPT 2025, R. Barbulescu, M. Barcau and V. Pasol extend Regev’s Quantum Algorithm to Elliptic Curves.
8.7 Code-Based Cryptography
Participants: Bombar Maxime.
The paper 20, M. Bombar, N. Resch, E. Wiedijk, has been published in the proceedings of ISIT 2025. The article investigates a common assumption that has been used to analyse the security of post-quantum code-based cryptosystems based on algebraically structured codes, namely quasi-cyclic codes, such as the recently standardised HQC.
8.8 Coding theory
Participants: Elena Berardini, Alix Barraud, Xavier Caruso, Jean-Marc Couveignes, Fabrice Drain, Jean Gasnier.
The paper 7 by E. Berardini and X. Caruso has been published in the Journal of Algebra and its Applications. It presents the first construction in the sum-rank metric of Reed–Muller codes.
The paper 8 by E. Berardini, R. Dastbasteh, J. Etxezarreta Martinez, S. Jain O. Sanz Larrarte was published in IEEE Journal on Selected Areas in Information Theory. In this work, the authors solve an open question on the construction of asymptotically good so-called CSS-T codes. Besides, they also propose a new technique to construct triorthogonal codes, broadening the range of codes available for magic state distillation.
In the preprint 41, A. Barraud investigates the dual of Algebraic Geometry codes constructed from Hirzebruch surfaces. She is able to explicitly describe such dual codes, and give a lower bound on their minimum distance. The knowledge of the dual of a code finds applications in many aspect of coding theory, from the conception of a decoding algorithm to the construction and study of quantum codes.
Effective geometry of curves and applications
In 47, J.-M. Couveignes and R. Lercier extend the Gauss-Cooley-Tuckee butterflies for fast evaluation and interpolation to the context of elliptic curves. They give three applications : multiplication in time in extensions of degree a power of two, over a large enough finite field; MDS -codes that can be encoded and checked in time and decoded up to -errors in quasi-linear time in ; an efficient variant of LWE cryptography that is not cyclotomic.
8.9 Effective analysis and certified arithmetic
Participants: Fredrik Johansson.
In 38, A. Ahlbäck and F. Johansson present optimized basecase algorithms for multiplication of multiprecision integers and floating-point numbers on modern CPUs.
In 50, F. Johansson describes the implementation of generic rings in FLINT. A notable result is that algebraic structures and operations built on rings with inexact representation (such as intervals) are supported in a mathematically rigorous way.
9 Partnerships and cooperations
Participants: Bill Allombert, Razvan Barbulescu, Karim Belabas, Elena Berardini, Xavier Caruso, Guilhem Castagnos, Andreas Enge, Jean-Marc Couveignes, Fredrik Johansson, Sabrina Kunzweiler, Aurel Page, Alice Pellet-Mary, Damien Robert.
9.1 International research visitors
Other international visits to the team
Marzio Mula and Sebastian Spindler (Universität der Bundeswehr, München) visited the team for 3 weeks. Katherine Stange (University of Colorado, Boulder) visited the team for 3 days. Nicolas Mascot (Trinity College, Dublin, Ireland) visited the team for 1 week.
The following international speakers gave a talk at the Canari seminar in 2025: Lam Pham (Ghent University), Lorenzo Furio (Institut de Mathématiques de Jussieu-Paris Rive Gauche), Maxime Roméas (ANSSI), Marzio Mula (Universität der Bundeswehr, München), Sebastian Spindler (Universität der Bundeswehr, München), Pierre Pébereau (Sorbonne Université), Michel Seck (École Polytechnique de Thies, Sénégal), Raymond van Bommel (University of Bristol), Clémence Bouvier (CARAMBA, INRIA Nancy), Katherine Stange (University of Colorado, Boulder), Elena Kirshanova (Technology Innovation Institute, Abu Dhabi), John Voight (University of Sydney), Jonathan Komada Eriksen (KU Leuven), Ludo Pulles (CWI Amsterdam), Camille Garnier (Université de Limoges), Axel Lemoine (INRIA Paris), Jean Kieffer (CNRS and CARAMBA), Philippe Moustrou (Institut de Mathématiques de Toulouse), Hugues Randriambololona (ANSSI), Eric Pichon-Pharabod (Max-Planck Institute for Mathematics in the Sciences, Leipzig), Victor Dyseryn (Télécom Paris).
9.2 European initiatives
9.2.1 Horizon Europe
-
MSCA-DN COGENT
Cohomology, Geometry, and Explicit Number Theory is a European Doctoral Network, funded by the European Commission (EC) as part of the MSCA programme and by UK Research and Innovation (UKRI), whose Network coordinator is Université Grenoble Alpes (UGA).
- 5 academic beneficiaries in the EU: Université Grenoble Alpes (France), Université de Bordeaux, TU Braunschweig (Germany), University of Galway (Ireland), Vrije Universiteit Amsterdam (Netherlands).
- 2 academic beneficiaries in the UK: University of Durham, University of Sheffield.
- 7 partner organizations: Colorado State University (USA), University of Massachusetts (USA), University of Michigan (USA), University of North Carolina-Greensboro (USA), University of Oklahoma (USA), ID Quantique (IDQ, Switzerland), MSM Programming (Croatia).
2024–2028, total budget 3M€ (EU) + 900k€ (UKRI), about 280k€ for Bordeaux.
9.3 National initiatives
-
PEPR Technologies Quantiques
Integrated project PQ-TLS: Post-quantum padlock for web browser
with Inria teams Grace, Cosmiq, Prosecco Universities of Bordeaux, Rennes, Limoges, Versailles–St. Quentin, Rouen, St. Étienne, and ENS Lyon and CEA
2022–2027, total budget 4180k€, of which 456k€ for Bordeaux
-
PEPR Cybersécurité
Integrated project CRYPTANALYSE: Cryptanalysis of classical cryptographic primitives
with Inria teams Caramba, Cosmiq, Universities of Rennes, Amiens, Sorbonne, and CNRS
2023–2028, total budget 5000k€, of which about 90k€ for Bordeaux
-
HQI project (HPC-Quantum Initiative, France 2030)
France Hybrid HPC Quantum Initiative, R&D et support
17 partners in France; we will mainly work with LIP6 and ENS de Lyon
2021–2027, 165k€ for Bordeaux
-
ANR AGDE
Arithmetic and geometry of discrete groups
with Aix-Marseille, Paris
2021–2025, 45k€ for Bordeaux
-
ANR NuSCAP
Numerical safety for computer-aided proofs
with Lyon, Nantes, Paris, Sophia-Antipolis, Toulouse
2021–2025
-
ANR PadLEfAn
-adic properties of -functions effective and analytic aspects
with Besançon, Caen
2022–2026
-
ANR PPaL
Practical -adic Langlands
with Lille, Lyon, Paris
2026–2030, 33k€ for Bordeaux
-
ANR Sangria
Secure distributed computation: cryptography, combinatorics and computer algebra
with Paris and région Occitanie
2021–2025
-
ANR TOTORO
Towards new assumptions in lattice-based cryptography (PI A. Pellet--Mary)
with Toulouse and Telecom Paris
2023–2027, 186k€
10 Dissemination
Participants: Bill Allombert, Razvan Barbulescu, Karim Belabas, Elena Berardini, Xavier Caruso, Guilhem Castagnos, Andreas Enge, Jean-Marc Couveignes, Fredrik Johansson, Sabrina Kunzweiler, Aurel Page, Alice Pellet-Mary, Damien Robert.
10.1 Promoting scientific activities
10.1.1 Scientific events: organisation
Member of the organizing committees
- We helped co-organize the 25th Forum des jeunes mathématiciennes and mathématiciens in Bordeaux, from November 26th to November 28th 2025 (3 days, 60 national participants). We thank Univ. Bordeaux and CNRS for fundings for this event.
- We organized the Charm workshop in Bordeaux, from June 16th to June 20th, on the hardness of module lattices (1 week, 30 international participants).
- We co-organized two FLINT development workshops in Saclay, in January and October.
- E. Berardini co-organises the CAIPI symposium, an itinerant symposium on coding theory, cryptography, arithmetic geometry and computer algebra.
- B. Allombert and A. Page organised the Atelier Pari/GP in Institut Pascal, Saclay, from January 6th to January 10th (45 participants).
- B. Allombert and A. Page organised the Atelier libpari in Bordeaux, from June 23rd to June 27th (12 participants).
10.1.2 Scientific events: selection
Member of the conference program committees
- S. Kunzweiler was part of the program committee of Crypto 2025 and PQCrypto 2026
- M. Bombar was part of the program committee of CT-RSA 2026.
- A. Page was part of the program committee of Lucant 2025.
10.1.3 Journal
Member of the editorial boards
- K. Belabas is an editor of Archiv der Mathematik since 2006.
- X. Caruso is member of the scientific board for the Journal de Théorie des Nombres de Bordeaux since 2022.
- J.-M. Couveignes is an editor of the Publications mathématiques de Besançon since 2019.
- J.-M. Couveignes was an editor of the Journal de théorie des nombres de Bordeaux from 2019 to 2023.
- A. Enge is an editor of Designs, Codes and Cryptography since 2004.
- A. Page is an associate editor of the LMFDB since 2022.
- E. Berardini is member of the editorial board of De Cifris Koine and of Journal of Combinatorial Theory, Series A
10.1.4 Invited talks
- P. Dartois gave an invited talk Theta coordinates: an introduction at the Leuven Isogeny Days 6.
- A. Page gave an invited talk Hecke operators: introduction and applications at the Leuven Isogeny Days 6.
- D. Robert gave an invited talk Cubical arithmetic: an introduction at the Leuven Isogeny Days 6.
- G. Castagnos gave an invited talk Threshold Cryptography based on Class Groups of Imaginary Quadratic Fields at WRACH 2025 : Workshop on Randomness and Arithmetics for Cryptographic Hardware, in Roscoff and at the Journées Nationales 2025 du GDR Sécurité Informatique in Caen
- E. Berardini gave an invited talk Evaluation codes in the sum-rank metric at the Arithmetic Geometry Cryptography and Coding Theory (AGCT) conference at CIRM
10.1.5 Research administration
- K. Belabas is Vice président en charge du numérique (vice-president in charge of digital strategy and policies) at the University of Bordeaux since March 2022.
- X. Caruso is vice-head of Institut de Mathématiques de Bordeaux, in charge of the IT department.
- J.-M. Couveignes is Chargé de mission pour la sécurité numérique at the University of Bordeaux.
- D. Robert is Chargé de mission Développement logiciel at the Institut Mathématiques de Bordeaux since 2018.
- A. Page and A. Enge are members of the Conseil d'Administration of the Société Arithmétique de Bordeaux, which publishes the Journal de Théorie des Nombres de Bordeaux and provides financial support for the organisation of number theory events.
- A. Enge is an elected member of the CAP chercheurs at Inria since 2023.
- A. Enge is a member of the Comité Parité et Égalité des Chances of Inria since 2024.
- G. Castagnos is responsible for the master's degree in cryptography and IT security of the University of Bordeaux since 2024.
- G. Castagnos is a member of the Conseil national des universités (CNU) section 25 Mathématiques since 2023.
10.2 Teaching - Supervision - Juries - Educational and pedagogical outreach
- S. Kunzweiler
- Project leader at the two-week CIMPA school Effective Algebra and the LMFDB, Makerere University (Uganda)
- Two lectures at the summer school Post-quantum cryptography in Bilbao Basque Center for Applied Mathematics in Bilbao (Spain)
- Online lecture series on Mathematical cryptography and algorithms in number theory for the Preliminary Arizona Winter School (online / USA)
- K. Belabas
- 64h course on computer algebra, Master 2 (preparation for the Agrégation national competitive examination), University of Bordeaux
- 35h course on quantum algorithms, Master 2, University of Bordeaux
- X. Caruso
- 35h course on quantum computing, Master 2, University of Bordeaux
- G. Castagnos
- 24h course on cryptology, Master 1, University of Bordeaux
- 36h course on advanced cryptography, Master 2, University of Bordeaux
- 35h course on algorithmics of integers and polynomials, Bachelor, University of Bordeaux
- J.-M. Couveignes
- 25h course on algorithmic arithmetics, Master, Université of Bordeaux
- 160h course at CPBX (undegraduate program for student in engineering)
- A. Page
- Main lecturer at the two-week CIMPA school Effective Algebra and the LMFDB, Makerere University (Uganda)
- Two lectures at the COGENT Winter School, University of Galway, Ireland.
- 33h exercise sessions on computer algebra, Master 2 (preparation for the Agrégation national competitive examination), University of Bordeaux
- A. Pellet-Mary
- 30h course on post-quantum cryptography, Master 2, University of Bordeaux
- E. Berardini
- 24h course on information theory, Master 1, University of Bordeaux
- 16h course on arithmetic and cryptology, Licence 3, University of Bordeaux
- M. Bombar
- 60h course on cryptanalysis, Master 2, University of Bordeaux
- 15h course on advanced cryptography, Master 2, University of Bordeaux
- 56h course on computer algebra, Master 1, University of Bordeaux
- 36h exercise session on arithmetic and cryptology, Licence 3, University of Bordeaux
10.2.1 Supervision
- PhD defended in June 2025: Anne-Edgar Wilke, Actions de groupes arithmétiques : théories de la réduction et algorithmes d'énumération, since September 2019, supervised by K. Belabas.
- PhD defended in July 2025 32: Agathe Beaugrand, Conception de systèmes cryptographiques utilisant des groupes de classes de corps quadratiques , supervised by Guilhem Castagnos and Fabien Laguillaumie.
- PhD defended in July 2025 34: Fabrice Étienne, Algorithmic applications of Hecke operators of finite groups for Galois representations, since September 2022, supervised by Aurel Page.
- PhD defended in July 2025 37: Nicolas Sarkis, Recherche de courbes planes de genre 2 adaptée à la factorisation des entiers, supervised by Razvan Barbulescu and Damien Robert.
- PhD defended in July 2025 33: Pierrick Dartois Improvement and security analysis of isogeny-based cryptographic schemes, supervised by Luca De Feo, Damien Robert and Benjamin Wesolowski.
- PhD defended in July 2025 35: Jean Gasnier, Algorithmique des isogénies et applications, supervised by Jean-Marc Couveignes.
- PhD in progress: Fabrice Drain, Codes for the sum-rank metric, since September 2023, supervised by Elena Berardini and Xavier Caruso.
- PhD in progress: Brieuc Lair, Deformations spaces of -adic Galois representations, since September 2025, supervised by Xavier Caruso and Léo Poyeton.
- PhD in progress: Guilhem Mureau, Isomorphism of algebraic lattices, since September 2023, supervised by Alice Pellet--Mary and Renaud Coulangeon.
- PhD in progress: Afonso Li, On the hardness of the NTRU problem, since October 2024, supervised by Alice Pellet--Mary and Benjamin Wesolowski.
- PhD in progress: Alix Barraud, Algebraic geometry codes from surfaces and quantum codes, since September 2024, supervised by Elena Berardini and Gilles Zémor.
- PhD in progress: Léo Noël, Solutions hybrides pour permettre une transition en douceur vers la cryptographie post quantique, since May 2025 supervised by Guilhem Castagnos
- PhD in progress: Rayane Baït, Algorithms for Galois representations coming from Shimura curves, since September 2025, supervised by Aurel Page and Nicolas Mascot.
- PhD in progress: Alexander Wiesner, Algorithms for polycyclic groups associated to number fields, since September 2025, supervised by Bill Allombert, Karim Belabas, Aurel Page and Bettina Eick.
- PhD in progress: Thibault Monneret, Hardness of lattice problems and automorphic forms, since September 2025, supervised by Aurel Page and Benjamin Wesolowski.
10.2.2 Juries
- X. Caruso
- Nhuan Le, Université de Caen (Caen, France) Sur les valeurs zêta et multizêta en caractéristique positive
- Epiphane Nouetowa, Université de Rennes (Rennes, France) Codes tordus, dualité et décodage : application à la cryptographie
- rapporteur, Lucas Legrand, Université de Limoges (Limoges, France) Gröbner bases over polyhedral algebras
- rapporteur, Nicolas Saussay, Université de Limoges (Limoges, France) Étude de la distance minimale des codes stabilisateurs locaux
- J.-M. Couveignes
- rapporteur, Candice Bernard, Université de Toulouse (Toulouse, France) Propriétés des tours récursives de courbes sur les corps finis
- rapporteur, Martin Azon, Université de Clermont-Auvergne (Clermont-Ferrand, France) Arithmétique des familles de courbes hyperelliptiques
- Jordi Pillet, Concordia (Canada) et Université de Bourgogne (Dijon, France) Identités de Fay, crochet de Goldman et systèmes intégrables
- Paul Kirchner, Université de Rennes (Rennes, France) Cryptanalysis of public-key cryptography
- directeur, Jean Gasnier, Université de Bordeaux (Bordeaux, France) Arithmétique et algorithmique des courbes algébriques et applicationx aux codes correcteurs et à la cryptographie
- F. Johansson
- Alexandre Goyer, Université Paris-Saclay (Saclay, France) Algorithmes symboliques-numériques en algèbre différentielle
- G. Castagnos
- directeur, Agathe Beaugrand, Université de Bordeaux (Bordeaux, France) Arguments à divulgation nulle de connaissance efficaces et succincts dans le cadre du chiffrement CL et applications
- S. Kunzweiler
- Pierrick Dartois, Université de Bordeaux (Talence, France) Fast computation of higher dimensional isogenies for cryptographic applications
- Nicolas Sarkis, Université de Bordeaux (Talence, France) Arithmetic of Kummer lines
- Valerie Gilchrist, Université Libre de Bruxelles (Bruxelles, Belgium) Improved algorithms of post-quantum cryptographic group actions
- A. Page
- directeur, Fabrice Étienne, Université de Bordeaux (Talence, France) Algorithmic applications of Hecke operators of finite groups for Galois representations
- Anne-Edgar Wilke, Université de Bordeaux (Talence, France) Actions de groupes arithmétiques : théories de la réduction et algorithmes d'énumération
10.2.3 Educational and pedagogical outreach
- A. Pellet-Mary gave a 1h30 talk about post-quantum cryptography to students of Sciences Po Lille and Centrale Lille (co-organized by Inria Lille).
- A. Enge has given a series of three presentations about cryptology during “Village des Maths” at Lycée A. Claveille in Périgeux for pupils aged 12 to 16 years.
- A. Page gave a series of four presentations about cryptology to high school students during “Fête de la Science”, Circuit Scientifique Bordelais hors les murs, at Lycée Gaston Fébus in Orthez.
- A. Enge has written the first four entries in a of “Goblins for number theory”, explaining in a hands-on approach how the distributed, object capabilities based framework of Guile Goblins could be used in the context of number theoretical computations that are distributed over the network, be it over TCP or Tor.
11 Scientific production
11.1 Major publications
- 1 inbookCan we dream of a 1-adic Langlands correspondence?2313Mathematics Going ForwardLecture Notes in MathematicsSpringer International Publishing2023, 537-560HALDOI
-
2
articleComputation of classical and
-adic -series of -motives.Research in Number Theory2024. In press. HAL - 3 inbookComputational Number Theory, Past, Present, and Future.2313Mathematics Going ForwardLecture Notes in MathematicsSpringer International Publishing2023, 561-578HALDOI
- 4 inproceedingsSQIsignHD: New Dimensions in Cryptography.Eurocrypt 2024 - 43rd Annual International Conference on the Theory and Applications of Cryptographic Techniques14651Lecture Notes in Computer ScienceZurich (CH), SwitzerlandSpringer Nature SwitzerlandApril 2024, 3-32HALDOI
- 5 proceedingsD.Damien Robert, eds. Breaking SIDH in polynomial time.Advances in Cryptology – EUROCRYPT 202314008Lecture Notes in Computer ScienceSpringer Nature Switzerland; Springer Nature SwitzerlandMarch 2023, 472-503HALDOI
11.2 Publications of the year
International journals
International peer-reviewed conferences
Conferences without proceedings
Edition (books, proceedings, special issue of a journal)
Doctoral dissertations and habilitation theses
Reports & preprints
Software
11.3 Cited publications
-
52
articleGalois Groups of Ap
'ery-like Series Modulo Primes.arXiv preprint arXiv:2510.232982025back to text - 53 miscFast pairings via biextensions and cubical arithmetic.December 2024HALback to textback to text