2025​Activity reportProject-TeamCAPSULE​‌

Better Reductions.​​

Our trust in the​​​‌ hardness of lattice-based constructions​ relies fundamentally on our​‌ understanding of the security​​ reductions between the (many,​​​‌ structured) variants of SIS​ and LWE. Depending on​‌ the additional structure allowed​​ to the designer, they​​​‌ are associated to number​ rings, ideals, and, more​‌ generally, modules over the​​ integer ring of a​​​‌ number field, and related​ to the corresponding class​‌ of lattices with symmetries.​​ Additionally, for LWE the​​​‌ noise distribution is also​ a parameter of the​‌ problem. Overall, this leads​​ to a plethora of​​​‌ variants and versions that​ need some hierarchizing and​‌ a better understanding of​​ the interplay between their​​​‌ related parameters. Thankfully, important​ classifying works have already​‌ been presented, regularly involving​​ members of our team​​​‌ (e.g. 57, 94​, 52.

Yet,​‌ there are still many​​ unclear results or relations​​ that are not yet​​​‌ satisfyingly understood. For example,‌ the fundamental reductions of‌​‌ Ajtai and Regev are​​ far from tight, incurring​​​‌ a blowup in important‌ parameters (sometimes estimated to‌​‌ be in $O(n^{11})$).​​​‌ While this is not‌ a problem asymptotically, it‌​‌ clearly raises concerns on​​ how to select parameters​​​‌ and the level of‌ security they actually achieve.‌​‌ However, these proofs techniques​​ have not been updated​​​‌ since their presentations: it‌ is not unlikely that‌​‌ more recent tools could​​ lead to improvements. In​​​‌ another example, there seems‌ to be a non‌​‌ smooth gap of difficulty​​ between the hardness of​​​‌ very structured variants of‌ LWE (linked to “ideal‌​‌ lattices problems”) and less-but-still-quite​​ structured ones. Roughly speaking,​​​‌ the former seems to‌ belong to subexponential complexity‌​‌ while the latter variants​​ are still considered exponential.​​​‌ Our current knowledge is‌ also not enough to‌​‌ guarantee the actual existence​​ of this gap, which​​​‌ prevents an accurate understanding‌ of the underlying problems'‌​‌ concrete hardness. In a​​ last example, one can​​​‌ also notice that all‌ the proof strategies for‌​‌ these general reductions rely​​ on the same high-level​​​‌ arguments. Yet, multiple works‌ dealing with subcases had‌​‌ to be presented to​​ reach the current state​​​‌ of the art. On‌ the one hand, it‌​‌ could be that there​​ is a unifying, all-encompassing​​​‌ presentation that would greatly‌ simplify the state of‌​‌ the affairs and bring​​ a kind of maturity​​​‌ to this field. On‌ the other hand, there‌​‌ may be fundamental obstructions​​ to a general framework,​​​‌ and highlighting them would‌ definitely help the community's‌​‌ understanding. These three examples​​ raise important questions first​​​‌ about security, but also‌ about our way of‌​‌ using the mathematical tools​​ behind these results. Our​​​‌ team's objectives are to‌ investigate all these paths‌​‌ and to find either​​ positive or negative answers​​​‌ to improve the general‌ understanding of the area.‌​‌

Algorithms for hard problems​​ and attacks on cryptosystems.​​​‌

We have proposed some‌ algorithms to study the‌​‌ security of hard computational​​ problems in cyclotomic fields​​​‌ as the Principal Ideal‌ Problem (PIP) in 48‌​‌, reducing module lattices​​ as a generalization of​​​‌ the LLL algorithm in‌ the ring of integers‌​‌ of a number field​​ in 83 or in​​​‌ a tower of cyclotomic‌ fields in 78.‌​‌ We generalized the BKW​​ algorithm to binary LWE​​​‌ setting in 79 and‌ studied the Learning Parities‌​‌ with Noise (LPN) Problem​​ in 84.

We​​​‌ have also attacked concrete‌ cryptographic schemes. We broke‌​‌ some multivariate schemes such​​ as the SFLASH signature​​​‌ schemes in 65 and‌ variants 71, and‌​‌ the ASASA schemes in​​ 87. We have​​​‌ also broken FHE schemes‌ based on overstretched NTRU‌​‌ parameters in 80 or​​ concrete FHE in 59​​​‌.

We want to‌ study the resistance of‌​‌ post-quantum cryptosystems and hard​​ problems against classical and​​​‌ quantum adversaries. It is‌ particularly interesting for lattice‌​‌ problems since the cryptanalysis​​ of these problems is​​​‌ very young. One key‌ objective in this line‌​‌ of research would be​​​‌ to find an analog​ of the BKZ algorithm​‌ for structured lattices defined​​ over a number field.​​​‌ It is also interesting​ to improve the recent​‌ work of 46,​​ which suggests that this​​​‌ problem may be weaker​ than previously thought.

Constructions​‌ and practical cryptosystems.

Applications​​ of cryptography usually culminate​​​‌ with the description of​ an efficient cryptosystem. An​‌ important part of our​​ activity in post-quantum cryptography​​​‌ therefore targets the design​ of new schemes resistant​‌ to quantum attackers, providing​​ advanced functionalities to its​​​‌ users, without sacrificing efficiency.​

In this area, members​‌ of CAPSULE have worked​​ on the lattice-based signature​​​‌ scheme Falcon and its​ efficiency-security trade-off ModFalcon 60​‌. A first objective​​ would be to extend​​​‌ in a useful way​ the so-called “trapdoor generation”​‌ which is core to​​ the two schemes above.​​​‌ In a nutshell, the​ secret key corresponds to​‌ a basis of short​​ vectors of a lattice,​​​‌ that only the user​ should be able to​‌ compute efficiently. ModFalcon already​​ extended the class of​​​‌ lattices for which this​ can be done, and​‌ it is an interesting​​ question to manage an​​​‌ even larger class of​ lattice. In terms of​‌ applications, this would allow​​ for even more flexibility,​​​‌ which can be particularly​ useful when the signature​‌ scheme is used as​​ a black box inside​​​‌ a larger cryptographic algorithm.​ It could also allow​‌ for other functionalities such​​ as threshold signatures or​​​‌ maybe masked signatures. On​ this line of thought,​‌ we are also interested​​ in designing masked lattice​​​‌ signatures or even multi-party​ signatures. While there have​‌ been very recent proposals​​ (relying on a different​​​‌ paradigm than the Falcon​ family), the efficiency is​‌ still lacking in practice.​​ A success here could​​​‌ lead to concrete industrial​ applications.

But this is​‌ not the only construction​​ on which the team​​​‌ is currently working. There​ are many interesting cryptographic​‌ constructions that need to​​ be studied to obtain​​​‌ efficient post-quantum schemes, such​ as signatures and zero-knowledge​‌ proofs, but also signatures​​ with more properties like​​​‌ group signatures, blind signatures​ ... and applications like​‌ e-voting. Indeed, a lot​​ of progress has been​​​‌ made to obtain efficient​ signatures and public key​‌ encryptions, especially with the​​ NIST competition, but the​​​‌ efficiency of more advanced​ schemes is still far​‌ from existing (but not​​ post-quantum) solutions. One of​​​‌ the big challenges would​ be to obtain efficient​‌ zero-knowledge proof systems, as​​ this primitive is often​​​‌ an easy way to​ build more advanced primitives.​‌

Tools‌​‌ for discovering new attacks.​​

Symmetric cryptosystems are widely​​​‌ used because they are‌ the only ones that‌​‌ can achieve some major​​ functionalities such as high-speed​​​‌ or low-cost encryption, fast‌ message authentication, and efficient‌​‌ hashing. But, unlike public-key​​ cryptographic algorithms, secret-key primitives​​​‌ do not have satisfying‌ security proofs. The security‌​‌ of these algorithms is​​ empirically established by cryptanalysis.​​​‌

It is obvious that‌ this security criterion, despite‌​‌ its success so far,​​ is not completely satisfactory.​​​‌ For instance we may‌ estimate that, for a‌​‌ given primitive, no more​​ than a few dozens​​​‌ of researchers are actively‌ working on breaking it.‌​‌ Hence, due to this​​ weak effort, the non-discovery​​​‌ of an attack against‌ a particular primitive does‌​‌ not mean so much.​​ Besides, finding the best​​​‌ attacks on a given‌ design is a time-consuming‌​‌ work, and errors can​​ lead to under- or​​​‌ over-estimating its security.

Therefore,‌ our team specializes in‌​‌ building tools for automatically​​ finding large classes of​​​‌ attacks. This transforms the‌ statement “we did not‌​‌ find any attack of​​ this kind”, which is​​​‌ only a subjective guarantee,‌ into “the audit tool‌​‌ X did not find​​ any attack”, which is​​​‌ a formal statement, giving‌ a quantifiable objective guarantee.‌​‌

In the past, the​​ members of the team​​​‌ have proposed many tools,‌ for example for improving‌​‌ attacks on round-reduced versions​​ of AES 54,​​​‌ Demirci-Selçuk attacks on AES‌ 63, and impossible‌​‌ differential attacks 62.​​

Our more recent work​​​‌ uses tools based on‌ MILP (Mixed Integer Linear‌​‌ Programming), SAT (Satisfiability) or​​ CP (Constraint Programming). In​​​‌ this setting, the search‌ and optimization of an‌​‌ attack are reduced to​​ a problem of a​​​‌ specific form, for which‌ an off-the-shelf solver is‌​‌ used. Besides the actual​​ work of implementing this​​​‌ reduction, our research aims‌ at better understanding the‌​‌ differences between these optimization​​ tools, finding which ones​​​‌ are more adapted for‌ a given problem, and‌​‌ adapting some of these​​ general-purpose software tools to​​​‌ particular cryptographic problems.

Finding‌ and optimizing a cryptanalytic‌​‌ attack in its entirety​​ is an especially interesting​​​‌ problem, since it requires‌ the integration of different‌​‌ steps (for example a​​ good distinguisher and a​​​‌ key-recovery phase). Since the‌ search space is of‌​‌ exponential size, often making​​ the problem intractable, it​​​‌ is possible to first‌ find an approximation of‌​‌ the best attacks and​​ then instantiate precisely the​​​‌ values of the parameters.‌ Also, if MILP, SAT‌​‌ and CP tools quickly​​ give an answer, it​​​‌ is tempting to build‌ ad-hoc tools that can‌​‌ more efficiently take into​​ account the weaknesses discovered​​​‌ by these tools.

Finally,‌ there are only a‌​‌ few tools for analyzing​​ the security of ARX​​​‌ ciphers based on additions,‌ rotations and xor operations.‌​‌ These functions are hard​​​‌ to analyze with the​ current cryptanalytic techniques, and​‌ no attack has really​​ endangered the full Chacha​​​‌ stream cipher proposed by​ Dan Bernstein or the​‌ block cipher Speck proposed​​ by the NSA. They​​​‌ can be implemented very​ efficiently in x86 processors​‌ and currently Chacha is​​ in the most used​​​‌ ciphersuites on TLS, making​ them prominent targets for​‌ cryptanalysis.

New Designs.

Our​​ goal is to analyze​​​‌ the security of the​ new symmetric-key designs by​‌ developing new cryptanalytic techniques.​​ The LowMC block cipher​​​‌ is one of the​ first symmetric primitives designed​‌ for taking into account​​ the efficiency constraints of​​​‌ public-key cryptosystems. It has​ been built as a​‌ FHE-friendly cipher, by minimizing​​ the number of multiplicative​​​‌ gates which are the​ main efficiency bottleneck for​‌ this application. Several attacks​​ have been proposed on​​​‌ LowMC and LowMC v2.​ LowMC v3 was used​‌ in Picnic, a Zero-Knowledge-based​​ post-quantum signature scheme proposed​​​‌ at the NIST competition,​ which wasn't standardized.

The​‌ Keccak hash function has​​ been standardized in 2015​​​‌ as SHA-3. Keccak brought​ new interest in a​‌ new design called Sponge​​ function and permutation-based primitives.​​​‌ Some round-reduced versions of​ SHA-3 have been used​‌ in many constructions from​​ Pseudo-Random Generator in SHAKE,​​​‌ to the Pseudo-Random Function​ Farfalle 47, the​‌ authenticated encryption scheme Keyak,​​ or the hash function​​​‌ KangarooTwelve proposed as an​ RFC. Only a few​‌ attacks have been proposed​​ against SHA-3 and new​​​‌ cryptanalysis tools need to​ be designed.

Quantum Cryptanalysis.​‌

Since 2016, many works​​ have been done in​​​‌ the cryptanalysis of symmetric​ primitives using quantum algorithms.​‌ While symmetric cryptosystems are​​ generally believed to hold​​​‌ well against adversaries equipped​ with a quantum computer,​‌ these works have substantiated​​ these claims with dedicated​​​‌ security analyses, such as​ the best attacks against​‌ reduced-round versions of the​​ standard AES 50.​​​‌

Grover's search algorithm, which​ can provide a quadratic​‌ speedup on exhaustive key​​ search (from $2^{\mathrm{k‌}}$ operations to $2^{\mathrm{k}/2}$), is​‌ often cited as the​​ main player in the​​​‌ quantum security of symmetric​ primitives. However, in the​‌ past few years, the​​ landscape of quantum algorithms​​​‌ for cryptanalysis has considerably​ expanded, with notable results​‌ such as quantum speedups​​ above quadratic for specific​​​‌ constructions 51. These​ recent works highlight the​‌ benefit of combining state-of-the-art​​ quantum algorithms and symmetric​​​‌ cryptanalysis techniques.

In team​ CAPSULE, our research in​‌ quantum cryptanalysis is three-fold.​​

First, we develop new​​​‌ quantum algorithms for cryptanalytic​ problems, which we aim​‌ to apply in symmetric​​ cryptography, but may also​​​‌ have applications in public-key​ cryptography. An example of​‌ such a double-edged sword​​ is our recent work​​​‌ on quantum walks 49​.

Second, we analyze​‌ existing classical cryptanalysis techniques​​ and study how to​​​‌ translate them into quantum​ cryptanalysis techniques. Intuitively, a​‌ primitive that is classically​​ vulnerable should be quantumly​​​‌ broken as well, but​ this is not always​‌ the case, as classical​​ attack strategies are not​​​‌ always exploitable in the​ quantum setting. Our research​‌ in this area focuses​​ on the strategies which​​ can exhibit the largest​​​‌ quantum speedups, quadratic (like‌ Grover's search) or even‌​‌ above by using advanced​​ frameworks.

Finally, after identifying​​​‌ new classes of quantum‌ attacks, we aim at‌​‌ integrating these attacks into​​ automated tools. Indeed, the​​​‌ task of finding and‌ optimizing quantum attacks can‌​‌ be even more challenging​​ that classical ones, since​​​‌ they rely often on‌ different strategies, sometimes counterintuitive.‌​‌ Furthermore, since the resulting​​ procedures are quantum algorithms,​​​‌ the analysis of their‌ time and memory complexities‌​‌ comes with specific technicalities.​​ Our goal is to​​​‌ automatize this step as‌ well in a way‌​‌ that may benefit cryptanalysts​​ interested in this topic​​​‌ but unfamiliar with quantum‌ algorithms.

Hardware​​ and embedded implementations.

Side​​​‌ Channel Attacks (SCA) rely‌ on statistical tools to‌​‌ extract the secret information​​ from leakage traces. Then,​​​‌ algorithmic techniques usually based‌ on previous cryptanalytic results‌​‌ are used to efficiently​​ recover secret data. Indeed,​​​‌ the known black-box attacks‌ are extended by exploiting‌​‌ the leakage information, that​​ gives more information on​​​‌ the internal secret variables,‌ a.k.a. the grey-box model.‌​‌ The SCA information can​​ be for instance the​​​‌ Hamming weight of a‌ limited number of variables.‌​‌ Recently, the white-box model​​ has been proposed, where​​​‌ the adversary can stop‌ the execution of a‌​‌ process and has access​​ to all variables.

Side-channel​​​‌ attacks have been successfully‌ applied to break many‌​‌ embedded implementations these last​​​‌ 20 years. After the​ information theoretic approach of​‌ Ishai, Sahai and Wagner​​ 76 to prove the​​​‌ security of implementations, secure​ theoretical foundations have been​‌ laid by Prouff and​​ Rivain and later Duc​​​‌ et al. in 93​, 66. Soon​‌ after, some tools have​​ been developed such as​​​‌ 42, 43,​ 41 to protect software​‌ and hardware implementations with​​ masking techniques. Nowadays, we​​​‌ have sound masking schemes.​ Some of them already​‌ have been introduced into​​ lattice-based implementations 44,​​​‌ where generally securing randomness​ presents an interesting challenge.​‌ We aim at extending​​ the results of 44​​​‌, 45, 86​, 70 to other​‌ post-quantum alternatives like code-based,​​ multivariate, or hash-based schemes​​​‌ and to provide secure​ implementations.

More recently,​‌ other tools coming from​​ statistical learning (such as​​​‌ deep learning) have been​ proposed to break embedded​‌ implementations. They open the​​ door to powerful techniques​​​‌ and more efficient attacks.​ Template attacks model the​‌ leakage distribution with a​​ Gaussian distribution, approximating the​​​‌ actual distribution by considering​ its mean and its​‌ standard deviation. More standard​​ attacks, a.k.a. Differential Power​​​‌ Analysis (DPA), only consider​ the mean. However, higher​‌ moments can be useful​​ to consider. Deep learning​​​‌ techniques are useful to​ efficiently extract complex relations​‌ between variables even in​​ the presence of noise.​​​‌ Taking into account these​ more powerful deep learning​‌ or white-box attacks as​​ well as developing countermeasures​​​‌ is a hot, trendy​ topic in SCA. In​‌ the former, deep learning​​ allow to find correlations​​​‌ between many points of​ interest of one curve,​‌ a.k.a. horizontal attacks. In​​ the latter, white-box cryptography​​​‌ provides the adversary with​ the same kind of​‌ information, since they can​​ stop the execution of​​​‌ the program and get​ noiseless information on all​‌ of its variables. Taking​​ into account such powerful​​​‌ attackers is one main​ challenge for side-channel attacks.​‌

Finally, we are interested​​ in working on the​​​‌ new micro-architectural attacks HertzBleed​ and others. These​‌ attacks show that side-channel​​ attacks are also a​​​‌ threat to software implementations.​ Porting to software some​‌ of the many techniques​​ used to secure embedded​​​‌ systems is thus a​ major topic.

Software implementations.​‌

Constant-time implementation is a​​ programming principle that aims​​​‌ at providing code where​ the running time and​‌ memory accesses are independent​​ of the secret values.​​​‌ Timing leakage can be​ used to mount attacks​‌ on computers and smartphones.​​ There exist many tools​​​‌ in the literature that​ help developers to avoid​‌ these leakage, but insecure​​ implementations are still aplenty.​​​‌ For instance, we recently​ broke the WPA-3 implementation​‌ used in FreeRadius and​​ iwd (iNet Wireless Daemon)​​​‌ 55, and also​ found other weaknesses.

We​‌ want to discover new​​ attacks in open-source libraries​​​‌ and to help developers​ in order to verify​‌ the constant-time property of​​ their codes. For example,​​​‌ some tools are tailored​ to small pieces of​‌ cryptographic codes and do​​ not scale well with​​​‌ more complex codes that​ rely on many libraries.​‌ Our goal is to​​ provide verification tools for​​ analyzing the constant-time property​​​‌ of large source codes.‌ We are also interested‌​‌ in studying the security​​ of DRM systems used​​​‌ in widely deployed systems.‌ We do not have‌​‌ permanent researchers on reverse-engineering,​​ but we work with​​​‌ postdoc students such as‌ Alexandre Gonzalvez, as well‌​‌ as Mohamed Sabt from​​ the Spicy team on​​​‌ this topic. Besides, we‌ co-supervise 3 theses on‌​‌ the security of software​​ implementations.

Security Proofs of​​​‌ Protocols and Real-World Systems.‌

We are interested in‌​‌ studying the security of​​ cryptographic protocols deployed in​​​‌ the real-world such as‌ WhatsApp, middlebox, Content-Delivery Network‌​‌ (CDN), TLS, and 5G​​ networks. Recently, we have​​​‌ also considered the security‌ of searchable symmetric encryption,‌​‌ where the goal is​​ to outsource the storage​​​‌ of a database to‌ an untrusted server, while‌​‌ maintaining search capabilities. This​​ last area is a​​​‌ nice application of secure‌ computations and the PhD‌​‌ thesis of R. Bost​​ (P.A. Fouque's PhD student)​​​‌ in this domain received‌ the GDR Security price‌​‌ of the best PhD​​ in 2018. We also​​​‌ work with Cristina Onete,‌ an assistant professor at‌​‌ Limoges on this topic.​​ Currently, we are interested​​​‌ to propose hybridization techniques‌ between pre- and post-quantum‌​‌ cryptography for various protocols​​ such as Signal, IPSEC,​​​‌ ... in the PEPR‌ post-quantum cryptography.

Microarchitectural attacks.‌​‌

Microarchitectural attacks are very​​ potent side-channel attacks that​​​‌ exploit the microarchitecture features‌ of modern processors, such‌​‌ as caches, branch predictors,​​ and speculative execution. They​​​‌ represent a significant threat‌ to the security of‌​‌ cryptographic implementations, as they​​ can leak sensitive information​​​‌ through subtle timing variations‌ and other side effects.‌​‌ Most work focuses on​​ x86 architectures, but ARM​​​‌ architectures are also concerned,‌ especially with the widespread‌​‌ use of ARM in​​ mobile devices, and recent​​​‌ interest in deploying more‌ ARM CPUs in laptop‌​‌ and desktop computer. We​​ are interested in studying​​​‌ complex ARM microarchitectures, such‌ as the Qualcomm Snapdragon‌​‌ chip, to understand their​​ vulnerabilities to microarchitectural attacks.​​​‌ This line of work‌ involves reverse-engineering the microarchitecture,‌​‌ developing new attack techniques,​​ and proposing effective countermeasures​​​‌ to mitigate these threats.‌ We investigate these topics‌​‌ in collaboration with the​​ SUSHI Inria team and​​​‌ the ANSSI.

NIST post-quantum competition.​​

The NIST post-quantum competition​​​‌ aims at standardizing quantum-safe​ public-key primitives. The goal​‌ is to propose a​​ quantum-safe alternative for the​​​‌ schemes based on number​ theory which are threatened​‌ by the advent of​​ quantum computers. It is​​​‌ expected to have a​ huge and long-term impact​‌ on all public-key cryptography.​​ It received 69 proposals​​​‌ in November 2017. The​ Falcon signature scheme, co-designed​‌ by some members of​​ the Capsule team, has​​​‌ been selected by NIST​ in July 2022. We​‌ have also submitted Solmae​​ to the Korean Post-Quantum​​​‌ Competition, which is a​ variant of Falcon that​‌ is easier to implement​​ hence to protect from​​​‌ SCA. Finally, we have​ also proposed BAT 69​‌, an encryption scheme​​ that follows the design​​​‌ rationale of Falcon. We​ plan to submit this​‌ scheme to the IETF​​ as it enjoys interesting​​​‌ properties in terms of​ bandwidth, that are not​‌ displayed by NIST's selected​​ key encapsulation scheme, Kyber.​​​‌

In June 2023, we​ have submitted the PROV​‌ and VOX signature schemes​​ to NIST's new call​​​‌ for digital signatures. These​ two schemes are based​‌ on multivariate cryptography problems,​​ and are variants of​​​‌ the unbalanced Oil-and-Vinegar signature​ schemes, proposed in 1997​‌ by Patarin. PROV has​​ a security proof, while​​​‌ VOX is a stronger​ version of UOV that​‌ avoids known weaknesses (namely,​​ UOV has a large​​​‌ set of isotropic vectors​ common to all quadratic​‌ forms of the public​​ key).

NIST competition on​​​‌ lightweight symmetric encryption.

The​ NIST lightweight cryptography standardization​‌ process is an initiative​​ to develop and standardize​​​‌ new authenticated encryption algorithms​ suitable for constrained devices.​‌ There is a real​​ need for new standards​​​‌ in lightweight cryptography, and​ the selected algorithms are​‌ expected to be widely​​ deployed within the Internet​​​‌ of Things, as well​ as on more constrained​‌ devices such as contactless​​ smart cards, or medical​​​‌ implants. The NIST received​ 56 submissions in February​‌ 2019. Team Capsule has​​ studied the security of​​​‌ some of these schemes.​

Monitoring Current Standards.

While​‌ we are very involved​​ in the design phase​​​‌ of new cryptographic standards,​ we also monitor the​‌ algorithms that are already​​ standardized. We look at​​​‌ some implementations of WPA3​ and we discovered a​‌ micro-architectural attack 56.​​ We also studied the​​​‌ privacy of the EME​ standard (Encrypted Media Extensions)​‌ for Digital Rights Managment​​ in browsers in 89​​​‌.

7.1.1 TNFS-alpha

• Name:
  alpha​​​‌ for the Tower Number‌ Field Sieve algorithm
• Keyword:‌​‌
  Cryptography
• Functional Description:
  This​​ library implements a simulation​​​‌ tool for the tower‌ number field sieve algorithm‌​‌ computing discrete logarithms in​​ extension fields of small​​​‌ degree (tested up to‌ 54). The library contains‌​‌ an implementation of the​​ exact computation of alpha,​​​‌ the bias between the‌ expected smoothness of an‌​‌ integer and the expected​​ smoothness of a norm​​​‌ of an algebraic integer‌ in a number field‌​‌ made of two extensions.​​ The algorithm is a​​​‌ generalization to extensions of‌ the exact implementation of‌​‌ alpha in the software​​ CADO-NFS. The software contains​​​‌ an implementation of the‌ E-function of B. A.‌​‌ Murphy (Murphy's E) which​​ estimates the quality of​​​‌ the polynomial selection step‌ in TNFS through a‌​‌ simulation of the yield​​ of the relation collection​​​‌ in the TNFS algorithm.‌ Finally, it contains a‌​‌ database of pairing-friendly curve​​ seeds with the estimated​​​‌ level of security w.r.t.‌ a discrete logarithm computation‌​‌ in the corresponding finite​​ field.
• News of the​​​‌ Year:
  In 2025, new‌ curves in the family‌​‌ Gasnier-Guillevic were added. As​​ part of the PEPR​​​‌ Cryptanalyse, new tables of‌ polynomials with automorphisms were‌​‌ included to the project​​ (degrees 6, 8, 9).​​​‌ Finally, new tables of‌ sparse polynomials of degrees‌​‌ 19 and 26 were​​ included.
• URL:
  https://­gitlab.­inria.­fr/­tnfs-alpha/­alpha
• Publications:​​​‌
  hal-04666521, hal-04205681,‌ hal-03667798, hal-03371573,‌​‌ hal-02263098, hal-02396352
• Contact:​​
  Aurore Guillevic
• Participant:
  Aurore​​​‌ Guillevic

7.1.2 Qarton

• Keywords:‌
  Quantum programming, Cryptography, Post-quantum,‌​‌ Quantum cryptanalysis
• Functional Description:​​
  Qarton is a python​​​‌ library to represent, analyze,‌ simulate and optimize medium‌​‌ and large-scale quantum circuits​​ at the logical level,​​​‌ with a focus on‌ circuits arising in cryptanalysis.‌​‌
• Release Contributions:
  First version​​ of the library.
• URL:​​​‌
  https://­qarton-10b5d8.­gitlabpages.­inria.­fr/
• Contact:
  Andre Schrottenloher‌

8.1.1 Proofs​​ of Security of Symmetric​​​‌ Constructions

Participants: André Schrottenloher‌.

8.1.2​​ Symmetric Cryptanalysis of Primitives​​​‌ and Tools

8.1.3​​​‌ Quantum Cryptanalysis

8.2.1 Lattices

8.2.2 Elliptic​​ curves and isogenies

Participants:​​ Aurore Guillevic.

8.2.3​​​‌ Quantum Cryptanalysis

8.2.4 Protocols

Avengers assemble!‌​‌ Supervised learning meets lattice​​ reduction

Participants: Pierre-Alain Fouque​​​‌, Damien Marion,‌ Quyen Nguyen, Alexandre‌​‌ Wallet.

10

In​​ this work, we attack​​​‌ Kyber's key-generation algorithm using‌ power analysis and lattice‌​‌ reduction. More specifically, we​​ target the Centered Binomial​​​‌ Distribution (CBD) sampler which‌ generates the secret data‌​‌ of the underlying Learning​​ With Error (LWE) instance.​​​‌ From a side-channel perspective,‌ our attack uses a‌​‌ single trace, leveraging classifiers​​ developed through supervised learning.​​​‌ We assess the block-size‌ in lattice reduction that‌​‌ would complete the key​​ recovery, providing a fine-grained​​​‌ trade-offs between the correctly‌ guessed proportion and the‌​‌ block-size, based on standard​​ estimates. Finally, we conducted​​​‌ large-scale experiments, from power‌ traces to secret key‌​‌ recovery (for most of​​ the instances) under a​​​‌ threshold of 18 hours,‌ targeting all three Kyber's‌​‌ security levels. Our average​​ rate of success across​​​‌ all security level is‌ more than 96%.

On‌​‌ the Success Rate of​​ Simple Side-Channel Attacks Against​​​‌ Masking with Unlimited Attack‌ Traces

Participants: Aymeric Hiltenbrand‌​‌, Julien Eynard,​​ Romain Poussier.

23​​​‌

In this work, we‌ investigate how the masking‌​‌ countermeasure affects the success​​ rate of simple attacks.​​​‌ To this end, we‌ provide theoretical, simulated, and‌​‌ practical experiments. Interestingly, we​​ will see that masking​​​‌ can allow us to‌ asymptotically recover more information‌​‌ on the secret than​​ in the case of​​​‌ an unprotected implementation, depending‌ on the masking type.‌​‌ We will see that​​ this is true for​​​‌ masking encodings that add‌ non-linearity with respect to‌​‌ the leakages, such as​​ arithmetic masking, while it​​​‌ is not for Boolean‌ masking. We believe this‌​‌ context provides interesting results,​​ as the average information​​​‌ of arithmetic encoding is‌ proven less informative than‌​‌ the Boolean one.

GnuZero:​​ A Compiler-Based Zeroization Static​​​‌ Detection Tool for the‌ Masses

Participants: Pierre-Alain Fouque‌​‌, Pierrick Philippe.​​

25

Coding standards for​​​‌ secure programming recommend "scrubbing"‌ sensitive data once it‌​‌ is no longer needed;​​ otherwise, secrets may be​​​‌ recovered, as illustrated in‌ the Heartbleed attack. Despite‌​‌ being an effective software-based​​ countermeasure, zeroization, i.e., overwriting​​​‌ with zeroes, turns out‌ to be challenging and‌​‌ error-prone. Current verification approaches​​ suffer from scalability or​​​‌ precision issues when applied‌ to production software in‌​‌ practice. In this paper,​​ we put forward the​​​‌ GCC Static Analyzer (GSA),‌ which is a symbolic‌​‌ execution engine for error​​ finding. Specifically, we extend​​​‌ the GSA to build‌ GnuZero; our automated tool‌​‌ that detects missing zeroization​​​‌ for all stack/heap variables​ storing sensitive data, either​‌ directly or by derivation.​​ Our experiments confirm GnuZero​​​‌ efficiency and effectiveness in​ verifying real-world benchmarks. In​‌ particular, GnuZero passes all​​ the relevant Juliet’s test​​​‌ programs, namely associated to​ the MITRE’s CWE-244 and​‌ CWE-226. In addition, GnuZero​​ succeeds in identifying new​​​‌ vulnerabilities in open-source cryptographic​ modules.

10.1.1 Visits​​ to international teams

11.1.1​​​‌ Scientific events: organisation

• Patrick​ Derbez co-organized the 1st​‌ Workshop on Symmetric-key Cryptanalysis​​ Automation and Modelling.​​​‌ This workshop was held​ at Università degli Studi​‌ Roma Tre, Rome, Italy,​​ the 15th of March​​ 2025.

11.1.2 Scientific events: selection‌

11.1.3 Journal

11.1.4​​ Invited talks

Participants: Clémence​​​‌ Chevignard, Pierrick Dartois‌, Patrick Derbez,‌​‌ Pierre-Alain Fouque, André​​ Schrottenloher, Yixin Shen​​​‌.

• Pierre-Alain Fouque -‌ Quantum Factoring - Tavares‌​‌ Lecture at SAC 2025​​, Toronto, Canada, August​​​‌ 2025.
• André Schrottenloher -‌ Reducing the Number of‌​‌ Qubits in Quantum Factoring​​ - Séminaire de sécurité​​​‌ du LORIA, Nancy,‌ France, April 2025.
• André‌​‌ Schrottenloher - La cryptographie​​ à l'épreuve du calcul​​​‌ quantique - Journée des‌ sciences et technologies quantiques‌​‌ de Rennes, Rennes,​​ France, May 2025
• André​​​‌ Schrottenloher - Reducing the‌ Number of Qubits in‌​‌ Quantum Factoring - Quantum​​ Summer Cluster Workshop,​​​‌ Simon's Institute for the‌ Theory of Computing, Berkeley,‌​‌ USA, July 2025
• Clémence​​ Chevignard - Reducing the​​​‌ Number of Qubits in‌ Quantum Factoring - Quantum‌​‌ Innovation 2025, Osaka,​​ July 2025
• André Schrottenloher​​​‌ - Quantum Attacks on‌ Symmetric Constructions - 1st‌​‌ Workshop on Generic Attacks​​ and Proofs in Symmetric​​​‌ Cryptography (GAPS 2025) -‌ NTU Singapore, September 2025‌​‌
• André Schrottenloher - Convolution-Based​​ Quantum Cryptanalysis - 20th​​​‌ Anniversary of the CWI‌ Cryptology Group, Amsterdam,‌​‌ Netherlands, September 2025
• André​​ Schrottenloher - Convolution-based Quantum​​​‌ Cryptanalysis - Dagstuhl Seminar‌ 25431: Quantum Cryptanalysis -‌​‌ Schloss Dagstuhl, Germany, October​​ 2025
• Yixin Shen -​​​‌ Finding many Collisions via‌ Quantum Walks - 2nd‌​‌ Workshop on Quantum Computing​​ and Quantum Information Theory​​​‌ (SUQUNET Workshop) - Sabancı‌ Üniversitesi, Istanbul, Turkey, 2025‌​‌
• Pierrick Dartois - What​​ you need to know​​​‌ about higher dimensional isogenies‌ - Leuven Isogeny Days‌​‌ 6 - KU Leuven,​​​‌ Belgium, September 2025
• Pierrick​ Dartois - An introduction​‌ to SQIsign - Journée​​ du PEPR PQ-TLS -​​​‌ Paris, France, December 2025​
• Patrick Derbez - Cryptanalytic​‌ Extraction of Deep Neural​​ Networks with Non-Linear Activations​​​‌ - NTU Seminars,​ NTU, Singapore, December 2025​‌

11.1.5 Scientific expertise

Participants:​​ Pierre-Alain Fouque, Aurore​​​‌ Guillevic, André Schrottenloher​, Yixin Shen.​‌

• Pierre-Alain Fouque was the​​ president of the selection​​​‌ committee for a professor​ position in section 27​‌ at the Université de​​ Rennes.
• Aurore Guillevic was​​​‌ a member of the​ selection committee for an​‌ assistant professor position (MCF252186)​​ in section 27 at​​​‌ Université de Versailles Saint​ Quentin (UVSQ).
• Yixin Shen​‌ was a jury member​​ of the selection committee​​​‌ for INRIA CRCN/ISFP researcher​ position at the INRIA​‌ Saclay center.
• André Schrottenloher​​ reviewed projects for ID4Mobility​​​‌ and for the Czech​ Science Foundation.

11.1.6 Research​‌ administration

Participants: Aurore Guillevic​​, Yixin Shen.​​​‌

• Aurore Guillevic is in​ charge of the young​‌ researchers (mission jeunes chercheurs)​​ and at the Commission​​​‌ Personnel.
• Yixin Shen is​ at the Commission Délégation​‌ Inria.

11.2.1 Teaching

Participants: Daniel​‌ de Almeida Braga,​​ Patrick Derbez, Pierre-Alain​​​‌ Fouque, Aurore Guillevic​, Damien Marion,​‌ André Schrottenloher.

• Master:​​ André Schrottenloher, Enjeux de​​​‌ la cryptographie post-quantique, 3​ hours conference, Centrale- Supélec​‌ Rennes.
• Master: André Schrottenloher,​​ Cryptanalyse , 7.5 hours​​​‌ lectures, 7.5 hours lab​ sessions, M2, University of​‌ Rennes.
• Bachelor: André Schrottenloher,​​ Introduction à la Cryptologie,​​​‌ 9 hours lectures, ENS​ de Rennes.
• Master: Aurore​‌ Guillevic and Gaël Claudel,​​ Advanced Course in Cryptography​​​‌ for security (BCS), 16.5​ hours lab sessions, M2,​‌ University of Rennes, France;​​
• Master: Aurore Guillevic, Mathematics​​​‌ for security (MSEC), 12​ hours lectures, 2 $\times ‌$ 12 hours lab sessions,​​ M1, University of Rennes,​​​‌ France;
• Master: Aurore Guillevic,​ Unix refresher crash course,​‌ 3 hours lab sessions,​​ M1, University of Rennes,​​​‌ France;
• Master: Pierre-Alain Fouque,​ Basics for Cryptography, 22h​‌ lectures, M1, University of​​ Rennes, France;
• Master: Pierre-Alain​​​‌ Fouque, Advanced Cryptography, 16h​ lectures, M2, University of​‌ Rennes, France;
• Master: Pierre-Alain​​ Fouque, Security Proof, 12h​​​‌ lectures, M2, University of​ Rennes, France;
• Bachelor: Daniel​‌ De Almeida Braga, Introduction​​ à la Securité (ISE),​​​‌ 1.5 hour lecture, 3​ hours lab session, L1,​‌ University of Rennes, France;​​
• Bachelor: Daniel De Almeida​​​‌ Braga, Enjeux de Sécurité​ (ESEC), 7.5 hours lectures,​‌ L3, University of Rennes,​​ France;
• Master: Daniel De​​​‌ Almeida Braga, Security Project,​ 24h project supervision, M1,​‌ University of Rennes, France;​​
• Master: Daniel De Almeida​​​‌ Braga, Low Level Programming,​ 19.5 hours lab sessions,​‌ M1, University of Rennes,​​ France;
• Master: Daniel De​​​‌ Almeida Braga, Cybersécurité: Menaces​ et organisations, hygiène numérique​‌ (SENV), 6 hours lectures,​​ 10.5 hours lab sessions,​​​‌ M1, University of Rennes,​ France;
• Master: Daniel De​‌ Almeida Braga, Sécurité avancée​​ des SI d'entreprise (SSYS2),​​​‌ 18 hours lectures, 36​ hours lab sessions, M2,​‌ University of Rennes, France;​​
• Master: Daniel De Almeida​​​‌ Braga, Introduction au pentest,​ 6 hours lectures, 12​‌ hours lab sessions, M1,​​ University of Rennes, France;​​
• Daniel De Almeida Braga:​​​‌ Co-director of the Master‌ 2 CISO (RSSI), University‌​‌ of Rennes, France.
• Bachelor:​​ Damien Marion, numérique éco-responsable​​​‌ (NEC2), 7.5 hours lectures,‌ 9 hours lab sessions,‌​‌ 9 hours seminars, 9​​ hours projects, L2, University​​​‌ of Rennes, France;
• Bachelor:‌ Damien Marion, enjeux sociétaux‌​‌ et empreinte écologique du​​ numérique (3EN), 6 hours​​​‌ lectures, 12 hours projects,‌ L3, University of Rennes,‌​‌ France;
• Master: Damien Marion,​​ databases security (SBD), 33​​​‌ hours lab sessions, M1,‌ University of Rennes, France;‌​‌
• Master: Damien Marion, cryptography​​ and privacy (SDATA), 12​​​‌ hours lectures, 21 hours‌ lab sessions, 10.5 hours‌​‌ seminars, M1, University of​​ Rennes, France;
• Master: Damien​​​‌ Marion, secured implementations for‌ cryptography (SIMP), 3.5 hours‌​‌ lectures, 39 hours lab​​ sessions, M2, University of​​​‌ Rennes, France;
• Master: Damien‌ Marion, research project, 24‌​‌ hours project supervision, M1,​​ University of Rennes, France;​​​‌
• Damien Marion: contact regarding‌ teaching activities of the‌​‌ ecological transition in computer​​ science at the University​​​‌ of Rennes, France;
• Master:‌ Patrick Derbez, Cryptanalyse, 7.5‌​‌ hours lectures, 7.5 hours​​ lab sessions, M2, University​​​‌ of Rennes.
• Bachelor: Patrick‌ Derbez, Introduction à la‌​‌ programmation, 15 hours lectures,​​ 16.5 hours lab sessions,​​​‌ L1, University of Rennes.‌
• Bachelor: Patrick Derbez, Introduction‌​‌ à la Cryptologie, 3​​ hours lectures, 3 hours​​​‌ lab sessions, L1, University‌ of Rennes.

11.2.2 Supervision‌​‌

Participants: Daniel de Almeida​​ Braga, Patrick Derbez​​​‌, Pierre-Alain Fouque,‌ Aurore Guillevic, Damien‌​‌ Marion, André Schrottenloher​​, Yixin Shen.​​​‌

• PhD: Phuong Hoa Nguyen,‌ MILP and symmetric-key cryptanalysis‌​‌33, started October​​ 2021, defended February 2025.​​​‌ Supervisors: Patrick Derbez and‌ Pierre-Alain Fouque.
• PhD: Paul‌​‌ Kirchner, Cryptanalysis of public-key​​ cryptography32, defended​​​‌ May 2025. Supervisors: Pierre-Alain‌ Fouque, with Aurore Guillevic‌​‌ in 2024–2025.
• PhD: Pierrick​​ Philippe, Secrets in Compiler:​​​‌ Detection of Secret-related Weaknesses‌ in GCC Static Analyzer‌​‌, started October 2022,​​ defended December 2025. Supervisors:​​​‌ Mohamed Sabt (IRISA) and‌ Pierre-Alain Fouque.
• PhD in‌​‌ progress: Clémence Chevignard, Module-LIP:​​ réductions, cryptanalyse, algorithmes,​​​‌ started November 2023. Supervisors:‌ Pierre-Alain Fouque, Alexandre Wallet‌​‌ and Rémi Giraud (Qualcomm).​​
• PhD in progress: Mathieu​​​‌ Degré, Nouveaux modèles MILP‌ adaptés aux problèmes cryptographiques‌​‌, started January 2024.​​ Supervisors: Patrick Derbez, André​​​‌ Schrottenloher.
• PhD in progress:‌ Aurel Pichollet–Mugnier, Security of‌​‌ ASCON and Lightweight Symmetric​​ Primitives against Quantum Attackers​​​‌, started November 2024.‌ Supervisors: Patrick Derbez, André‌​‌ Schrottenloher, Zoé Amblard (Thales​​ SIX)
• PhD in progress:​​​‌ Baptiste Germon, Independence hypothesis‌ in differential cryptanalysis,‌​‌ started October 2024. Supervisors:​​ Patrick Derbez, Christina Boura​​​‌ (IRIF)
• PhD in progress:‌ Roderick Asselineau, Cryptanalyse d'algorithmes‌​‌ symétriques utilisés dans la​​ vie réelle, started​​​‌ April 2025. Supervisors: Patrick‌ Derbez, Pierre-Alain Fouque, Brice‌​‌ Minaud (Inria Paris).
• PhD​​ in progress: Bastien Michel,​​​‌ Optimisation de la cryptanalyse‌ de primitives symétrique,‌​‌ started October 2024. Supervisors:​​ Patrick Derbez, Maria Naya-Plasencia​​​‌ (Inria Paris).
• PhD in‌ progress: Marie Euler, Outils‌​‌ pour la cryptanalyse et​​ la conception de primitives​​​‌ cryptographiques, VAE. Supervisors:‌ Patrick Derbez.
• PhD in‌​‌ progress: Gaël Claudel, Analyse​​ des attaques par canaux​​​‌ auxiliaires de schémas de‌ signature post quantique :‌​‌ approches combinées. Supervisors:​​​‌ Patrick Derbez, Damien Marion,​ Aurore Guillevic, Benoît Gérard​‌ (ANSSI).
• PhD in progress:​​ Aymeric Hiltenbrand, Attaques par​​​‌ canaux auxiliaires sur la​ cryptographie post- quantique,​‌ from December 2023. Supervisors:​​ Guenael Renault (ANSSI), Pierre-Alain​​​‌ Fouque, Romain Poussier (ANSSI),​ Damien Marion.
• PhD in​‌ progress: Guilhem Niot, Threshold​​ Post-Quantum Cryptography. Supervisors:​​​‌ Pierre- Alain Fouque and​ Thomas Prest (PQShield).
• PhD​‌ in progress: Mathias Boucher.​​ Improved Quantum Cryptanalysis on​​​‌ Lattices, started September​ 2025. Supervisors: Yixin Shen​‌ and Pierre-Alain Fouque.
• PhD​​ in progress: Alisée Lafontaine,​​​‌ New tools for quantum​ symmetric cryptanalysis, started​‌ October 2025. Supervisors: André​​ Schrottenloher and Patrick Derbez.​​​‌
• PhD in progress: Paul​ Delhom, Signatures Avancées Post-Quantiques​‌, started November 2025.​​ Supervisors: Corentin Jeudy (Orange),​​​‌ Olivier Sanders (Orange) and​ Pierre-Alain Fouque.
• PhD in​‌ progress: Théo Goureau, ARMADA:​​ ARM Microarchitectural Attacks Discovery​​​‌ and Analysis, started​ October 2025. Supervisors: Daniel​‌ De Almeida Braga, Pierre-Alain​​ Fouque, Guillaume Hiet (SUSHI)​​​‌ and Thomas Rokicki (SUSHI).​
• Internship: Mathias Boucher (M2)​‌ Regev’s reduction on a​​ family of easily decodable​​​‌ lattices (March-July 2025). Supervisor:​ Yixin Shen.
• Internship: Alisée​‌ Lafontaine (M2) New tools​​ for quantum symmetric cryptanalysis​​​‌ (March-September 2025). Supervisor: André​ Schrottenloher.
• Internship: Babacar Ndiaye​‌ (M2 Université de Limoges)​​ Polynomial selection for the​​​‌ Tower Number Field Sieve​ (April-August 2025). Supervisor: Aurore​‌ Guillevic.
• Internship: Hubert de​​ Groote (M2 MPRI) Security​​​‌ proof for Falcon sampler​ (April-August 2025). Supervisor: Pierre-Alain​‌ Fouque.
• Internship: Adrian Lagasse​​ (M1 Université de Rennes)​​​‌ Analysis and Exploitation of​ Intel's Instruction Prefetcher (May-August​‌ 2025). Supervisor: Daniel De​​ Almeida Braga.

11.2.3 Juries​​​‌

Participants: Pierre-Alain Fouque,​ Aurore Guillevic, André​‌ Schrottenloher, Yixin Shen​​.

• Pierre-Alain Fouque was​​​‌ a reviewer of the​ PhD thesis of Philipp​‌ Gajland (June 4, 2025,​​ Bochum-Universität, Germany).
• Pierre-Alain Fouque​​​‌ was a reviewer of​ the HDR thesis of​‌ Yann Rotella (February 6,​​ 2025, Université de Versailles-Saint-Quentin-en-Yvelines,​​​‌ France).
• Pierre-Alain Fouque was​ the President of the​‌ PhD thesis of Tristan​​ Claverie (June 6, 2025,​​​‌ Université de Rennes, France).​
• Pierre-Alain Fouque was an​‌ examiner of the PhD​​ thesis of Paul Kirchner​​​‌ (May 22, 2025, Université​ de Rennes, France).
• Pierre-Alain​‌ Fouque was the President​​ of the PhD thesis​​​‌ of Charles Meyer-Hilfiger (September​ 30, 2025, Université de​‌ Sorbonne University, France).
• Pierre-Alain​​ Fouque was a reviewer​​​‌ of the PhD thesis​ of Nicolas Bon (November​‌ 14, 2025, École normale​​ supérieure, France).
• Pierre-Alain Fouque​​​‌ was a reviewer of​ the PhD thesis of​‌ Henry Bambury (November 18,​​ 2025, École normale supérieure,​​​‌ France).
• Pierre-Alain Fouque was​ an examiner of the​‌ PhD thesis of Guirec​​ Lebrun (December 1, 2025,​​​‌ École normale supérieure, France).​
• Pierre-Alain Fouque was the​‌ President of the PhD​​ thesis of Pierre Pébereau​​​‌ (December 16, 2025, Université​ de Sorbonne University, France).​‌
• Pierre-Alain Fouque was an​​ examiner of the PhD​​​‌ thesis of Pierrick Philippe​ (December 10, 2025, Université​‌ de Rennes, France).
• Pierre-Alain​​ Fouque was a reviewer​​​‌ of the PhD thesis​ of Viet-Sang Nguyen (December​‌ 19, 2025, Université de​​ Saint-Étienne, France).
• André Schrottenloher​​​‌ was a reviewer of​ the PhD thesis of​‌ Nathalie Lang (July 14,​​ 2025, Bauhaus-Universität Weimar, Germany).​​
• Aurore Guillevic was a​​​‌ reviewer of the PhD‌ thesis of François Palma‌​‌ (December 12, 2025, Université​​ de Toulon, France).
• Yixin​​​‌ Shen was an examiner‌ of the PhD thesis‌​‌ of Joseph Cunningham (September​​ 5, 2025, Université Libre​​​‌ de Bruxelles, Belgique).

11.2.4‌ Educational and pedagogical outreach‌​‌

Participants: Daniel de Almeida​​ Braga, Patrick Derbez​​​‌, Pierre-Alain Fouque,‌ Yixin Shen.

• Yixin‌​‌ Shen gave a talk​​ at the ENS Rennes​​​‌ student research seminar about‌ "Collision finding, random walks‌​‌ and quantum algorithms" in​​ November 2025.
• Daniel De​​​‌ Almeida Braga organized a‌ Capture The Flag (CTF)‌​‌ event for students at​​ University of Rennes in​​​‌ April 2025, to bridge‌ bachelor and master, with‌​‌ around 70 participants.
• Patrick​​ Derbez gave a 3​​​‌ hours lecture on "Differential‌ Cryptanalysis" at the summer‌​‌ school colocated to the​​ SAC 2025 conference in​​​‌ August 2025. SAC 2025‌ Summer School
• Pierre-Alain Fouque‌​‌ gave a 3 hours​​ lecture on "Quantum algorithms​​​‌ for cryptanalysis" at the‌ CEMRACS 2025 in July‌​‌ 2025. CIRM Luminy

11.3.1 Productions (articles,​​​‌ videos, podcasts, serious games,‌ ...)

Participants: Damien Marion‌​‌, Yixin Shen.​​

• Yixin Shen was featured​​​‌ in an interview by‌ the French media CURIEUX!‌​‌ discussing post-quantum cryptography.
• Damien​​ Marion was interviewed by​​​‌ a french journal, Cryptographie‌ : les algorithmes du‌​‌ futur. Sciences Ouest, october​​.

11.3.2 Participation in​​​‌ Live events

Participants: André‌ Schrottenloher, Yixin Shen‌​‌.

• Yixin Shen and​​ André Schrottenloher were panelists​​​‌ of Amphi Métier R&D,‌ at Ecole polytechnique, Palaiseau,‌​‌ France, 2025

International journals

• 3​​​‌ articleD.Divesh Aggarwal‌, Y.Yanlin Chen‌​‌, R.Rajendra Kumar​​ and Y.Yixin Shen​​​‌. Improved Classical and‌ Quantum Algorithms for the‌​‌ Shortest Vector Problem via​​ Bounded Distance Decoding.​​​‌SIAM Journal on Computing‌542March 2025‌​‌, 233-278HALDOI​​back to text
• 4​​​‌ articleK.Kaveh Bashiri‌, X.Xavier Bonnetain‌​‌, A.Akinori Hosoyamada​​​‌, N.Nathalie Lang​ and A.André Schrottenloher​‌. Improved Quantum Linear​​ Attacks and Application to​​​‌ CAST.IACR Transactions​ on Symmetric Cryptology2025​‌2June 2025,​​ 124-165HALDOIback​​​‌ to text
• 5 article​C.Christina Boura,​‌ P.Patrick Derbez and​​ B.Baptiste Germon.​​​‌ Extending the Quasidifferential Framework:​ From Fixed-Key to Expected​‌ Differential Probability.IACR​​ Transactions on Symmetric Cryptology​​​‌20251March 2025​, 515-541HALDOI​‌back to text
• 6​​ articleM.Mathieu Degré​​​‌, P.Patrick Derbez​, L.Lucie Lahaye​‌ and A.André Schrottenloher​​. New models for​​​‌ the cryptanalysis of ASCON​.Designs, Codes and​‌ Cryptography936February​​ 2025, 2055-2072HAL​​​‌DOIback to text​
• 7 articleM.Mathieu​‌ Degré, P.Patrick​​ Derbez and A.André​​​‌ Schrottenloher. Simplified Meet-in-the-middle​ Preimage Attacks on AES-based​‌ Hashing.IACR Communications​​ in Cryptology24​​​‌2025. In press.​ HALback to text​‌
• 8 articleP.Patrick​​ Derbez, B.Baptiste​​​‌ Germon, B.Bastien​ Michel and M.Maria​‌ Naya Plasencia. Improved​​ Cryptanalysis of GIFT-64.​​​‌IACR Transactions on Symmetric​ Cryptology202542025​‌, 284-307HALDOI​​back to text
• 9​​​‌ articleQ.Quentin Edme​, P.-A.Pierre-Alain Fouque​‌ and A.André Schrottenloher​​. Faster Quantum Algorithms​​​‌ for MQ2 and Applications​.IACR Communications in​‌ Cryptology21April​​ 2025, 1-28HAL​​​‌DOIback to text​
• 10 articleP.-A.Pierre-Alain​‌ Fouque, D.Damien​​ Marion, Q.Quyen​​​‌ Nguyen and A.Alexandre​ Wallet. Avengers assemble!​‌ Supervised learning meets lattice​​ reduction.IACR Transactions​​​‌ on Cryptographic Hardware and​ Embedded Systems2025September​‌ 2025, 409 -​​ 436HALDOIback​​​‌ to text
• 11 article​J.Jean Gasnier and​‌ A.Aurore Guillevic.​​ An Algebraic Point of​​​‌ View on the Generation​ of Pairing-Friendly Curves.​‌SIAM Journal on Applied​​ Algebra and Geometry9​​​‌2June 2025,​ 456-480HALDOIback​‌ to text

International peer-reviewed​​ conferences

• 12 inproceedingsJ.​​​‌Jyotirmoy Basak, R.​Ritam Bhaumik, A.​‌ K.Amit Kumar Chauhan​​, R.Ravindra Jejurikar​​​‌, A.Ashwin Jha​, A.Anandarup Roy​‌, A.André Schrottenloher​​ and S.Suprita Talnikar​​​‌. Post-quantum Security of​ Key-Alternating Feistel Ciphers.​‌Lecture Notes in Computer​​ ScienceASIACRYPT 2025 -​​​‌ 31st International Conference on​ the Theory and Application​‌ of Cryptology and Information​​ SecurityLNCS-16245Lecture Notes​​​‌ in Computer ScienceMelbourne,​ AustraliaSpringer Nature Singapore​‌December 2026, 446-478​​HALDOIback to​​​‌ textback to text​
• 13 inproceedingsY.Yanis​‌ Belkheyar, P.Patrick​​ Derbez, S.Shibam​​​‌ Ghosh, G.Gregor​ Leander, S.Silvia​‌ Mella, L.Léo​​ Perrin, S.Shahram​​​‌ Rasoolzadeh, L.Lukas​ Stennes, S.Siwei​‌ Sun, G.Gilles​​ van Assche and D.​​​‌Damian Vizár. ChiLow​ and ChiChi: New Constructions​‌ for Code Encryption.​​Advances in Cryptology –​​​‌ EUROCRYPT 2025: 44th Annual​ International Conference on the​‌ Theory and Applications of​​ Cryptographic Techniques, Madrid, Spain,​​ May 4–8, 2025, Proceedings,​​​‌ Part IIIEUROCRYPT 2025‌ - 44th Annual International‌​‌ Conference on the Theory​​ and Applications of Cryptographic​​​‌ TechniquesLNCS-15601Lecture Notes‌ in Computer ScienceMadrid,‌​‌ SpainSpringer Nature Switzerland​​April 2025, 212-243​​​‌HALDOIback to‌ textback to text‌​‌
• 14 inproceedingsC.Christina​​ Boura, P.Patrick​​​‌ Derbez, B.Baptiste‌ Germon, R. H.‌​‌Rachelle Heim Boissier and​​ M.María Naya-Plasencia.​​​‌ SPEEDY: Caught at Last‌.ASIACRYPT 2025 -‌​‌ 31st International Conference on​​ the Theory and Application​​​‌ of Cryptology and Information‌ SecurityLNCS-16245Lecture Notes‌​‌ in Computer ScienceMelbourne,​​ AustraliaSpringer Nature Singapore​​​‌December 2026, 189-220‌HALDOIback to‌​‌ text
• 15 inproceedingsK.​​Kevin Carrier, C.​​​‌Charles Meyer-Hilfiger, Y.‌Yixin Shen and J.-P.‌​‌Jean-Pierre Tillich. Assessing​​ the Impact of a​​​‌ Variant of MATZOV's Dual‌ Attack on Kyber.‌​‌Advances in Cryptology -​​ CRYPTO 2025CRYPTO 2025​​​‌ - 45th Annual International‌ Cryptology ConferenceSanta Barbara,‌​‌ United StatesSpringer2025​​, 1-36HALback​​​‌ to textback to‌ text
• 16 inproceedingsS.‌​‌Sofia Celi, D.​​Daniel Escudero and G.​​​‌Guilhem Niot. Share‌ the MAYO: Thresholdizing MAYO‌​‌.PQCrypto 2025 -​​ 16th International Conference on​​​‌ Post-Quantum Cryptography15577Lecture‌ Notes in Computer Science‌​‌Taipei, TaiwanSpringer Nature​​ SwitzerlandMarch 2025,​​​‌ 165-198HALDOIback‌ to text
• 17 inproceedings‌​‌S.Sofia Celi,​​ R.Rafael del Pino​​​‌, T.Thomas Espitau‌, G.Guilhem Niot‌​‌ and T.Thomas Prest​​. Efficient Threshold ML-DSA​​​‌.35th USENIX Security‌ Symposium (USENIX Security 2026)‌​‌Baltimore, United StatesAugust​​ 2026HALback to​​​‌ text
• 18 inproceedingsC.‌Clémence Chevignard, P.-A.‌​‌Pierre-Alain Fouque and A.​​André Schrottenloher. Reducing​​​‌ the Number of Qubits‌ in Quantum Factoring.‌​‌45th Annual International Cryptology​​ Conference, Santa Barbara, CA,​​​‌ USA, August 17–21, 2025,‌ Proceedings, Part VCRYPTO‌​‌ 2025 - Advances in​​ CryptologyLNCS-16001Lecture Notes​​​‌ in Computer ScienceSanta‌ Barbara, United StatesSpringer‌​‌ Nature SwitzerlandAugust 2025​​, 384-415HALDOI​​​‌back to textback‌ to text
• 19 inproceedings‌​‌C.Clémence Chevignard,​​ G.Guilhem Mureau,​​​‌ T.Thomas Espitau,‌ A.Alice Pellet-Mary,‌​‌ H.Heorhii Pliatsok and​​ A.Alexandre Wallet.​​​‌ A reduction from Hawk‌ to the principal idealproblem‌​‌ in a quaternion algebra​​.Eurocrypt 2025 -​​​‌ 44th Annual International Conference‌ on the Theory and‌​‌ Applications of Cryptographic Techniques​​Lecture Notes in Computer​​​‌ ScienceMadrid, SpainMay‌ 2025HALDOIback‌​‌ to text
• 20 inproceedings​​P.Patrick Derbez and​​​‌ M.Marie Euler.‌ Minimalist Model for Impossible‌​‌ Differentials.SAC 2025​​ - 32nd International Conference​​​‌ on Selected Areas in‌ CryptographyLNCS 16207Lecture‌​‌ Notes in Computer Science​​Toronto, CanadaSpringer Nature​​​‌ SwitzerlandJanuary 2026,‌ 113-143HALDOIback‌​‌ to text
• 21 inproceedings​​K.Kévin Duverger,​​​‌ P.-A.Pierre-Alain Fouque,‌ C.Charlie Jacomme,‌​‌ G.Guilhem Niot and​​ C.Cristina Onete.​​​‌ Subversion-resilient Key-exchange in the‌ Post-quantum World.CCS‌​‌ 2025 - 32nd ACM​​​‌ Conference on Computer and​ Communications SecurityTaipei, Taiwan​‌September 2025, 1-49​​HALback to text​​​‌
• 22 inproceedingsK.Keitaro​ Hashimoto, S.Shuichi​‌ Katsumata, G.Guilhem​​ Niot and T.Thom​​​‌ Wiggers. Revisiting PQ​ WireGuard: A Comprehensive Security​‌ Analysis With a New​​ Design Using Reinforced KEMs​​​‌.47th IEEE Symposium​ on Security and Privacy​‌ (S&P '26)SAN FRANCISCO,​​ United StatesMay 2026​​​‌HALback to text​
• 23 inproceedingsA.Aymeric​‌ Hiltenbrand, J.Julien​​ Eynard and R.Romain​​​‌ Poussier. On the​ Success Rate of Simple​‌ Side-Channel Attacks Against Masking​​ with Unlimited Attack Traces​​​‌.Lecture Notes in​ Computer Science, vol 15952​‌CASCADE 2025 - International​​ Conference on Constructive Approaches​​​‌ for Security Analysis and​ Design of Embedded Systems​‌15952Lecture Notes in​​ Computer ScienceSaint-Etienne (FR),​​​‌ FranceSpringer Nature Switzerland;​ Springer Nature SwitzerlandOctober​‌ 2026, 343-366HAL​​DOIback to text​​​‌
• 24 inproceedingsG.Guilhem​ Niot. Practical Deniable​‌ Post-Quantum X3DH: A Lightweight​​ Split-KEM for K-Waay.​​​‌ASIA CCS '25: Proceedings​ of the 20th ACM​‌ Asia Conference on Computer​​ and Communications SecurityASIACCS​​​‌ 2025 - 20th ACM​ Asia Conference on Computer​‌ and Communications SecurityHanoi,​​ VietnamACMAugust 2025​​​‌, 298-312HALDOI​back to text
• 25​‌ inproceedingsP.Pierrick Philippe​​, M.Mohamed Sabt​​​‌ and P.-A.Pierre-Alain Fouque​. GnuZero: A Compiler-Based​‌ Zeroization Static Detection Tool​​ for the Masses.​​​‌DSN 2025 - 55th​ Annual IEEE/IFIP International Conference​‌ on Dependable Systems and​​ NetworksNaples, ItalyJune​​​‌ 2025, 1-14HAL​back to textback​‌ to text
• 26 inproceedings​​R.Rafael del Pino​​​‌, S.Shuichi Katsumata​, G.Guilhem Niot​‌, M.Michael Reichle​​ and K.Kaoru Takemure​​​‌. Unmasking TRaccoon: A​ Lattice-Based Threshold Signature with​‌ An Efficient Identifiable Abort​​ Protocol.CRYPTO 2025​​​‌ - 45th Annual International​ Cryptology Conference16005Lecture​‌ Notes in Computer Science​​Santa Barbara, United States​​​‌Springer Nature SwitzerlandAugust​ 2025, 423-456HAL​‌DOIback to text​​
• 27 inproceedingsR.Rafael​​​‌ del Pino and G.​Guilhem Niot. Finally!​‌ A Compact Lattice-Based Threshold​​ Signature.PKC 2025​​​‌ - International Conference on​ Practice and Theory in​‌ Public Key Cryptography15676​​Lecture Notes in Computer​​​‌ ScienceRoros, NorwaySpringer​ Nature SwitzerlandMay 2025​‌, 169-199HALDOI​​back to text
• 28​​​‌ inproceedingsA.Amaury Pouly​ and Y.Yixin Shen​‌. Discrete gaussian sampling​​ for BKZ-reduced basis.​​​‌Post-Quantum Cryptography - 16th​ International Workshop, PQCrypto 2025​‌Taipei, Taiwan2025,​​ 63-88HALDOIback​​​‌ to textback to​ text

Conferences without proceedings​‌

• 29 inproceedingsC.Clémence​​ Chevignard, P.-A.Pierre-Alain​​​‌ Fouque and A.André​ Schrottenloher. Reducing the​‌ Number of Qubits in​​ Quantum Factoring.QIP​​​‌ 2025 - 28th Annual​ Conference on Quantum Information​‌ ProcessingRaleigh, North Carolina,​​ United States2025,​​​‌ 384-415HALback to​ textback to text​‌
• 30 inproceedingsC.Clémence​​ Chevignard and G.Guilhem​​​‌ Mureau. Ideally HAWKward:​ How Not to Break​‌ Module-LIP.CFAIL 2025​​ - Conference for Failed​​ Approaches and Insightful Losses​​​‌ in Cryptology (an affiliated‌ workshop to Crypto 2025)‌​‌Santa Barbara (CA), United​​ States2025, 1-7​​​‌HALback to text‌
• 31 inproceedingsS.Shuichi‌​‌ Katsumata, G.Guilhem​​ Niot, I.Ida​​​‌ Tucker and T.Thom‌ Wiggers. Comprehensive Deniability‌​‌ Analysis of Signal Handshake​​ Protocols: X3DH, PQXDH to​​​‌ Fully Post-Quantum with Deniable‌ Ring Signatures.34th‌​‌ USENIX Conference on Security​​ Symposium (USENIX Security '25)​​​‌Seattle, United StatesAugust‌ 2025HALDOIback‌​‌ to text

Doctoral dissertations​​ and habilitation theses

• 32​​​‌ thesisP.Paul Kirchner‌. Cryptanalysis of public-key‌​‌ cryptography.Université de​​ RennesMay 2025HAL​​​‌back to text
• 33‌ thesisP.-H.Phuong-Hoa Nguyen‌​‌. New automated approaches​​ in cryptanalysis.Université​​​‌ de RennesFebruary 2025‌HALback to text‌​‌

Reports & preprints

• 34​​ miscX.Xavier Bonnetain​​​‌, J.Johanna Loyer‌, A.André Schrottenloher‌​‌ and Y.Yixin Shen​​. A Tight Quantum​​​‌ Algorithm for Multiple Collision‌ Search.2025HAL‌​‌back to text
• 35​​ miscK.Katharina Boudgoust​​​‌, C.Corentin Jeudy‌, E.Erkan Tairi‌​‌ and W.Weiqiang Wen​​. Hardness of M-LWE​​​‌ with General Distributions and‌ Applications to Leaky Variants‌​‌.August 2025HAL​​
• 36 miscP.Pierrick​​​‌ Dartois, J. K.‌Jonathan Komada Eriksen,‌​‌ R.Riccardo Invernizzi and​​ F.Frederik Vercauteren.​​​‌ qt-Pegasis: Simpler and Faster‌ Effective Class Group Actions‌​‌.October 2025HAL​​back to text