[{"t":"abe","k":"assumption","id":"ABE-ASSUMPTION-Q-TYPE-COMPUTATIONAL-PES","s":"q-type-computational-pes","title":"q-type (computational PES)","key":null,"y":null,"sub":"Assumption used by one or more ABE construction specifications: q-type (computational PES)."},{"t":"abe","k":"assumption","id":"ABE-ASSUMPTION-Q-TYPE-PAIR-ENCODING-INSTANTIATION","s":"q-type-pair-encoding","title":"q-type pair-encoding instantiation","key":null,"y":null,"sub":"Assumption used by one or more ABE construction specifications: q-type pair-encoding instantiation."},{"t":"abe","k":"scheme","id":"gpsw","s":"gpsw","title":"Goyal–Pandey–Sahai–Waters KP-ABE","key":"GPSW06","y":2006,"sub":"The first KP-ABE. Shamir-style polynomial secret sharing over a monotone access tree; ciphertext carries per-attribute exponentiations. Selective security under the standard DBDH assumption."},{"t":"abe","k":"scheme","id":"bsw","s":"bsw","title":"Bethencourt–Sahai–Waters CP-ABE","key":"BSW07","y":2007,"sub":"First CP-ABE. Monotone access tree with threshold gates; large universe via ROM hash. Per-attribute fresh randomness \\( r_j \\) doubles SK vs. Waters11. Proven only in GGM + ROM."},{"t":"abe","k":"scheme","id":"lw11_kpabe","s":"lw11-kpabe","title":"Lewko–Waters Unbounded KP-ABE","key":"LW11b","y":2011,"sub":"First unbounded KP-ABE in the standard model: \\( O(1) \\) MPK, no a-priori attribute universe. Uses composite-order groups (\\( N = p_1 p_2 p_3 \\)) and nested dual-system encryption to hide ephemeral semi-functionality acr"},{"t":"abe","k":"scheme","id":"waters11","s":"waters11-2","title":"Waters CP-ABE (PKC 2011)","key":"Waters11","y":2011,"sub":"CP-ABE for LSSS policies whose ciphertext size and encryption and decryption time grow linearly with the access formula, selectively secure under a concrete non-interactive (q-type) assumption in the standard model; only"},{"t":"abe","k":"scheme","id":"bns13_arithmetic_kpabe","s":"bns13-arithmetic-kpabe","title":"Boneh–Nikolaenko–Segev KP-ABE for Arithmetic Circuits","key":"BNS13","y":2013,"sub":"Selectively secure LWE KP-ABE for polynomial-size arithmetic circuits, with a single matrix secret key whose asymptotic size depends on depth rather than circuit gate or wire count."},{"t":"abe","k":"scheme","id":"hw13_fast_kpabe","s":"hw13-fast-kpabe","title":"Hohenberger–Waters Fast-Decryption KP-ABE","key":"HW13","y":2013,"sub":"Expressive large-universe KP-ABE whose decryption takes two pairings, at the cost of a secret-key blow-up by the number of distinct attributes in the policy."},{"t":"abe","k":"scheme","id":"rw13_cpabe","s":"rw13-cpabe","title":"Rouselakis–Waters Large-Universe CP-ABE","key":"RW13","y":2013,"sub":"First practical large-universe CP-ABE without random oracles. Replaces Waters11's per-attribute public elements with a Boneh–Boyen-style encoder \\( (u, h) \\) that maps any attribute \\( A \\in \\mathbb{Z}_p \\) to \\( u^{A} h"},{"t":"abe","k":"scheme","id":"rw13_kpabe","s":"rw13-kpabe","title":"Rouselakis–Waters Large-Universe KP-ABE","key":"RW13","y":2013,"sub":"KP-ABE counterpart of the RW13 CP-ABE, directly inspired by Lewko–Waters' composite-order scheme. Same universe encoder \\( (u, h) \\), constant-size public parameters, large universe via \\( \\mathbb{Z}_p \\) attribute label"},{"t":"abe","k":"scheme","id":"attrapadung14","s":"attrapadung14-2","title":"Attrapadung Pair Encoding Framework — Short-CT KP-ABE","key":"Attrapadung14","y":2014,"sub":"Introduces pair encoding schemes (PES): a combinatorial object that compiles generically to adaptive ABE via dual-system encryption. This spec captures the headline \"short-CT\" KP-ABE instantiation (Scheme 5); other insta"},{"t":"abe","k":"scheme","id":"bgg14_kpabe","s":"bgg14-kpabe","title":"Boneh–Gentry–Gorbunov–Halevi–Nikolaenko–Segev–Vaikuntanathan–Vinayagamurthy KP-ABE for Circuits","key":"BGG+14","y":2014,"sub":"KP-ABE for arithmetic circuits from LWE whose secret key is one short matrix, of size set by the circuit's depth rather than its size. Introduces the BGG+ key-homomorphic evaluation that later lattice ABE schemes (BV16, "},{"t":"abe","k":"scheme","id":"cgw15_cpabe","s":"cgw15-cpabe","title":"Chen–Gay–Wee CP-ABE","key":"CGW15","y":2015,"sub":"Adaptively secure CP-ABE in prime-order groups under \\( k \\)-Lin, from a predicate-encoding framework for dual system ABE: \\( k+1 \\) prime-order elements simulate each composite-order one, halving the ciphertext of earli"},{"t":"abe","k":"scheme","id":"cgw15_kpabe","s":"cgw15-kpabe","title":"Chen–Gay–Wee KP-ABE","key":"CGW15","y":2015,"sub":"KP-ABE dual of CGW15 CP-ABE: adaptively secure in prime-order groups under \\( k \\)-Lin via predicate encodings, halving the secret key of earlier prime-order schemes. Fixed \\( 2(k+1) \\) pairings."},{"t":"abe","k":"scheme","id":"abgw17_cpabe","s":"abgw17-cpabe","title":"Ambrona–Barthe–Gay–Wee CP-ABE (GGM framework)","key":"ABGW17","y":2017,"sub":"Large-universe unbounded CP-ABE, adaptively secure in the generic group model: the paper's Master Theorem lifts the symbolic security of its encoding, proved by hand (the paper's tool, ggm-symbolic-solver, proves its CP-"},{"t":"abe","k":"scheme","id":"abgw17_kpabe","s":"abgw17-kpabe","title":"Ambrona–Barthe–Gay–Wee KP-ABE (GGM framework)","key":"ABGW17","y":2017,"sub":"KP-ABE dual of ABGW17 CP-ABE: large-universe unbounded KP-ABE, adaptively secure in the generic group model through the Master Theorem, the symbolic security of its encoding proved by hand (the paper's tool could not pro"},{"t":"abe","k":"scheme","id":"fame_cpabe","s":"fame-cpabe","title":"FAME CP-ABE (Agrawal–Chase)","key":"AC17","y":2017,"sub":"First fast, adaptive, unbounded CP-ABE from a standard (DLIN) assumption with a fixed 6-pairing decryption. Implemented in Charm; FABEO's implementation extends its code. Tradeoff: each key/CT row spends 3 \\( \\mathbb{G}_"},{"t":"abe","k":"scheme","id":"fame_kpabe","s":"fame-kpabe","title":"FAME KP-ABE (Agrawal–Chase)","key":"AC17","y":2017,"sub":"KP-ABE dual of FAME CP-ABE. Adaptive DLIN security with fixed 6-pairing decryption. Large-universe via ROM-modeled hash. Sizes transpose from the CP-ABE variant."},{"t":"abe","k":"scheme","id":"cgkw18","s":"cgkw18-2","title":"Chen–Gong–Kowalczyk–Wee Unbounded KP-ABE","key":"CGKW18","y":2018,"sub":"Adaptively secure unbounded KP-ABE for read-once monotone span programs from \\( k \\)-Lin, any \\( k \\ge 1 \\), in prime-order groups and the standard model, with shorter keys and ciphertexts than Okamoto–Takashima (Asiacry"},{"t":"abe","k":"scheme","id":"amy19_dfa_cpabe","s":"amy19-dfa-cpabe","title":"Agrawal–Maitra–Yamada CP-ABE for DFA","key":"AMY19","y":2019,"sub":"Ciphertext-policy counterpart of the DLIN DFA compiler, supporting unbounded machines, inputs, and key requests by swapping its two MSP-ABE components."},{"t":"abe","k":"scheme","id":"amy19_dfa_kpabe","s":"amy19-dfa-kpabe","title":"Agrawal–Maitra–Yamada KP-ABE for DFA","key":"AMY19","y":2019,"sub":"First pairing-based KP-ABE for DFA from static DLIN supporting unbounded input length, machine size, and key requests; obtained through a modular MSP compiler."},{"t":"abe","k":"scheme","id":"kw19_cpabe","s":"kw19-cpabe","title":"Kowalczyk–Wee CP-ABE for NC1","key":"KW19a","y":2019,"sub":"First adaptive ABE for NC1 (monotone Boolean formulas) from static \\( k \\)-Lin in prime-order groups with attribute multi-use and polynomial security loss. Secret key is policy-size-independent (\"compact\")."},{"t":"abe","k":"scheme","id":"kw19_kpabe","s":"kw19-kpabe","title":"Kowalczyk–Wee KP-ABE for NC1","key":"KW19a","y":2019,"sub":"First compact + adaptive + many-use + \\( k \\)-Lin KP-ABE for NC1. CT is policy-size independent — a milestone that resolves the Lewko–Waters'11 open problem. Built from a piecewise-guessing security framework plus a line"},{"t":"abe","k":"scheme","id":"ll20a_kpabe","s":"ll20a-kpabe","title":"Lin–Luo Compact KP-ABE for ABP (beyond NC1)","key":"LL20a","y":2020,"sub":"First compact adaptive KP-ABE for arithmetic branching programs (beyond NC1) from standard \\( k \\)-Lin. CT size is independent of ABP size; SK grows linearly in ABP size, where earlier ABE for ABPs had keys up to quadrat"},{"t":"abe","k":"scheme","id":"ll20b_cpabe","s":"ll20b-cpabe","title":"Lin–Luo Succinct CP-ABE for ABP","key":"LL20b","y":2020,"sub":"CP-ABE for arithmetic branching programs with CONSTANT-size secret keys, adaptive under MDDH\\( _k \\) (implied by \\( k \\)-Lin) in prime-order groups: SK = \\( 3k+4 \\) group elements (7 under SXDH), independent of the polic"},{"t":"abe","k":"scheme","id":"ll20b_kpabe","s":"ll20b-kpabe","title":"Lin–Luo Succinct KP-ABE for ABP (constant CT)","key":"LL20b","y":2020,"sub":"KP-ABE for arithmetic branching programs with CONSTANT-size ciphertexts, adaptive under MDDH\\( _k \\) (implied by \\( k \\)-Lin): \\( 2k+3 \\) source-group elements, 5 at SXDH. Before it, only Attrapadung–Tomida (Asiacrypt 20"},{"t":"abe","k":"scheme","id":"fabeo_cpabe","s":"fabeo-cpabe","title":"FABEO CP-ABE (Riepel–Wee)","key":"RW22","y":2022,"sub":"Among the pairing CP-ABE schemes compared in the paper, it reports the smallest keys and ciphertexts and the fewest decryption pairings at one use per attribute (3; \\( \\tau+2 \\) in general; Table 3), optimal security bou"},{"t":"abe","k":"scheme","id":"fabeo_kpabe","s":"fabeo-kpabe","title":"FABEO KP-ABE (Riepel–Wee)","key":"RW22","y":2022,"sub":"KP-ABE dual of FABEO CP-ABE. \\( \\tau+1 \\) pairings (2 at \\( \\tau=1 \\)), optimal \\( O(t^{2}/p) \\) bound (\\( t \\) the number of generic-group oracle queries), native multi-use, large universe. Among the pairing KP-ABE sche"},{"t":"abe","k":"scheme","id":"glue22_cpabe","s":"glue22-cpabe","title":"GLUE CP-ABE","key":"VA22","y":2022,"sub":"Generalized, large-universe, unbounded and expressive CP-ABE whose nk/nc partition parameters expose a flexible encryption/decryption trade-off and support non-monotone and online/offline extensions."},{"t":"abe","k":"scheme","id":"lll22_cpabe","s":"lll22-cpabe","title":"Li–Lin–Luo \"Doubly Succinct\" CP-ABE for Formulas (hybrid)","key":"LLL22","y":2022,"sub":"First \"doubly succinct\" ABE: constant-size SK (2 group elements) AND policy-size-independent CT. Combines an LWE-based secret sharing for branching programs (no trapdoor) with the ABDP inner-product FE in a generic pairi"},{"t":"abe","k":"scheme","id":"lll22_kpabe","s":"lll22-kpabe","title":"Li–Lin–Luo KP-ABE for Circuits (constant SK, hybrid)","key":"LLL22","y":2022,"sub":"First KP-ABE for BOUNDED-DEPTH CIRCUITS with constant-size (3-element) secret keys. Hybrid lattice + pairing (GGM) construction: an LWE-based secret sharing (BGG+14 encodings, no trapdoor) whose policy share is linear in"},{"t":"abe","k":"scheme","id":"hll24_dfa_cpabe","s":"hll24-dfa-cpabe","title":"Hsieh–Lin–Luo CP-ABE for DFA (§7)","key":"HLL24","y":2024,"sub":"General framework for lattice ABE: noisy linear garbling for class F + evasive IPFE → KP/CP-ABE for F. Yields succinct CP-ABE for circuits (eliminating tensor LWE), and the first lattice public-key ABE for uniform comput"},{"t":"abe","k":"scheme","id":"hll24_circuit_cpabe","s":"hll24-circuit-cpabe","title":"Hsieh–Lin–Luo CP-ABE for bounded-arithmetic circuits (§6)","key":"HLL24","y":2024,"sub":"General framework for lattice ABE: noisy linear garbling for class F + evasive IPFE → KP/CP-ABE for F. Yields succinct CP-ABE for circuits (eliminating tensor LWE), and the first lattice public-key ABE for uniform comput"},{"t":"abe","k":"scheme","id":"hll24","s":"hll24-2","title":"Hsieh–Lin–Luo succinct CP-ABE for circuits (§8)","key":"HLL24","y":2024,"sub":"General framework for lattice ABE: noisy linear garbling for class F + evasive IPFE → KP/CP-ABE for F. Yields succinct CP-ABE for circuits (eliminating tensor LWE), and the first lattice public-key ABE for uniform comput"},{"t":"abe","k":"scheme","id":"sb25_nonlinear_kpabe","s":"sb25-nonlinear-kpabe","title":"Suegami–Bottazzi KP-ABE for Nonlinear Operations","key":"SB25","y":2025,"sub":"Ring-LWE KP-ABE for modulo-q arithmetic circuits that evaluates nonlinear lookup tables directly over BGG+ encodings, trading larger keys and KeyGen cost for faster repeated decryption."},{"t":"abe","k":"scheme","id":"lzf26_constant_ct_cpabe","s":"lzf26-constant-ct-cpabe","title":"Liu–Zhang–Fu Constant-Ciphertext CP-ABE for NC1","key":"LZF26","y":2026,"sub":"Selectively secure lattice CP-ABE for NC1 with ciphertext size \\( \\mathrm{poly}(\\lambda) \\), independent of circuit size, input length, and depth."},{"t":"abe","k":"problem","id":"ABE-OP-017","s":"op-17","title":"ABE for bounded-depth circuits from LWE","key":null,"y":null,"sub":"Solved problem · Collusion-resistant ABE for all circuits up to a depth bound fixed at setup, from LWE. Solved in 2013 by recoding lattice encodings gate by gate along the policy circuit."},{"t":"abe","k":"problem","id":"ABE-OP-003","s":"op-3","title":"ABE for unbounded-depth circuits from circular LWE","key":null,"y":null,"sub":"Open problem · Can collusion-resistant ABE handle circuits of every polynomial depth, with no depth bound fixed at setup, from circular small-secret LWE alone? Every known construction adds an evasive or a pairing-based "},{"t":"abe","k":"problem","id":"ABE-OP-016","s":"op-16","title":"Adaptively secure ABE for Boolean formulas from pairings","key":null,"y":null,"sub":"Solved problem · The formula question when a static pairing assumption may be used instead of LWE. Solved by compact adaptively secure ABE for NC1 from \\( k \\)-Lin, after dual-system encryption first gave adaptive securi"},{"t":"abe","k":"problem","id":"ABE-OP-013","s":"op-13","title":"Adaptively secure ABE for circuits from LWE","key":null,"y":null,"sub":"Open problem · Can lattice ABE for bounded-depth circuits be proved secure when the adversary picks the challenge attribute after seeing the public key and keys? From LWE, circuit ABE is only semi-adaptive, and adaptive "},{"t":"abe","k":"problem","id":"ABE-OP-012","s":"op-12","title":"Adaptively secure lattice ABE for Boolean formulas","key":null,"y":null,"sub":"Open problem · Adaptive lattice ABE for Boolean formulas (NC1), the class for which pairings already give adaptive security. From LWE, adaptive security is known only for CNF formulas with constant-size clauses."},{"t":"abe","k":"problem","id":"ABE-OP-015","s":"op-15","title":"Adaptively secure lattice ABE for t-CNF formulas","key":null,"y":null,"sub":"Solved problem · Adaptive lattice ABE for CNF formulas whose clauses each read at most a constant number t of input bits. Solved, giving the first adaptive lattice ABE beyond identity-based encryption."},{"t":"abe","k":"problem","id":"ABE-OP-023","s":"op-23","title":"Ciphertext-policy ABE for circuits from LWE","key":null,"y":null,"sub":"Open problem · Can public-key ciphertext-policy ABE handle every circuit up to a depth fixed at setup, with no bound on circuit size, from LWE alone? Key-policy ABE has done so since 2013; ciphertext-policy schemes from "},{"t":"abe","k":"problem","id":"ABE-OP-018","s":"op-18","title":"One-key ABE for unbounded-depth circuits from circular LWE","key":null,"y":null,"sub":"Solved problem · ABE for circuits of unbounded depth that stays secure when the adversary holds a single key, from circular security alone. Solved by bootstrapping lattice ABE encodings."},{"t":"abe","k":"problem","id":"ABE-OP-019","s":"op-19","title":"Secret-key ABE for unbounded-depth circuits from circular LWE","key":null,"y":null,"sub":"Solved problem · Collusion-resistant ABE for unbounded-depth circuits in which encryption needs the master secret key, from circular small-secret LWE alone. Solved for the ciphertext-policy orientation."},{"t":"abe","k":"problem","id":"ABE-OP-014","s":"op-14","title":"Semi-adaptively secure ABE for circuits from LWE","key":null,"y":null,"sub":"Solved problem · Circuit ABE from LWE in which the challenge attribute may depend on the public key but is fixed before any key query. Solved by delaying when the challenge is planted in the public parameters."},{"t":"abe","k":"problem","id":"ABE-OP-021","s":"op-21","title":"Unbounded-depth ABE from a doubly circular assumption","key":null,"y":null,"sub":"Solved problem · Public-key ABE for unbounded-depth circuits in the standard model from a new falsifiable assumption that couples circular LWE with a pairing-group component. Solved for key-policy ABE."},{"t":"abe","k":"problem","id":"ABE-OP-020","s":"op-20","title":"Unbounded-depth ABE from circular LWE in the generic group model","key":null,"y":null,"sub":"Solved problem · Public-key ABE for unbounded-depth circuits from circular small-secret LWE when the scheme may also use a bilinear group modeled as generic. Solved for key-policy ABE."},{"t":"abe","k":"problem","id":"ABE-OP-022","s":"op-22","title":"Unbounded-depth ABE from evasive LWE variants","key":null,"y":null,"sub":"Solved problem · Collusion-resistant ABE for unbounded-depth circuits when an evasive LWE variant may be assumed on top of circular-type LWE assumptions. Solved, but the evasive variants used were later attacked."},{"t":"abe","k":"paper","id":"ABE-PAPER-2005-SW","s":"sw05","title":"Fuzzy Identity-Based Encryption","key":"SW05","y":2005,"sub":"Amit Sahai, Brent Waters · EUROCRYPT 2005"},{"t":"abe","k":"paper","id":"ABE-PAPER-2006-GPSW","s":"gpsw06","title":"Attribute-Based Encryption for Fine-Grained Access Control of Encrypted Data","key":"GPSW06","y":2006,"sub":"Vipul Goyal, Omkant Pandey, Amit Sahai, Brent Waters · ACM CCS 2006"},{"t":"abe","k":"paper","id":"ABE-PAPER-2007-BSW","s":"bsw07","title":"Ciphertext-Policy Attribute-Based Encryption","key":"BSW07","y":2007,"sub":"John Bethencourt, Amit Sahai, Brent Waters · IEEE Symposium on Security and Privacy 2007"},{"t":"abe","k":"paper","id":"ABE-PAPER-2010-LOSSTW","s":"lostw10","title":"Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption","key":"LOSTW10","y":2010,"sub":"Allison Lewko, Tatsuaki Okamoto, Amit Sahai, Katsuyuki Takashima, Brent Waters · EUROCRYPT 2010"},{"t":"abe","k":"paper","id":"ABE-PAPER-2011-WATERS","s":"waters11","title":"Ciphertext-Policy Attribute-Based Encryption: An Expressive, Efficient, and Provably Secure Realization","key":"Waters11","y":2011,"sub":"Brent Waters · PKC 2011"},{"t":"abe","k":"paper","id":"ABE-PAPER-2011-LW-MAABE","s":"lw11a","title":"Decentralizing Attribute-Based Encryption","key":"LW11a","y":2011,"sub":"Allison Lewko, Brent Waters · EUROCRYPT 2011"},{"t":"abe","k":"paper","id":"ABE-PAPER-2011-LW-UNBOUNDED","s":"lw11b","title":"Unbounded HIBE and Attribute-Based Encryption","key":"LW11b","y":2011,"sub":"Allison Lewko, Brent Waters · EUROCRYPT 2011"},{"t":"abe","k":"paper","id":"ABE-PAPER-2012-SSW-REVOCATION","s":"ssw12","title":"Dynamic Credentials and Ciphertext Delegation for Attribute-Based Encryption","key":"SSW12","y":2012,"sub":"Amit Sahai, Hakan Seyalioglu, Brent Waters · CRYPTO 2012"},{"t":"abe","k":"paper","id":"ABE-PAPER-2012-OT","s":"ot12","title":"Fully Secure Unbounded Inner-Product and Attribute-Based Encryption","key":"OT12","y":2012,"sub":"Tatsuaki Okamoto, Katsuyuki Takashima · ASIACRYPT 2012"},{"t":"abe","k":"paper","id":"ABE-PAPER-2012-LW","s":"lw12","title":"New Proof Methods for Attribute-Based Encryption: Achieving Full Security through Selective Techniques","key":"LW12","y":2012,"sub":"Allison Lewko, Brent Waters · CRYPTO 2012"},{"t":"abe","k":"paper","id":"ABE-PAPER-2013-BNS-ARITH","s":"bns13","title":"Attribute-Based Encryption for Arithmetic Circuits","key":"BNS13","y":2013,"sub":"Dan Boneh, Valeria Nikolaenko, Gil Segev · IACR ePrint 2013"},{"t":"abe","k":"paper","id":"ABE-PAPER-2013-GVW","s":"gvw13","title":"Attribute-Based Encryption for Circuits","key":"GVW13","y":2013,"sub":"Sergey Gorbunov, Vinod Vaikuntanathan, Hoeteck Wee · STOC 2013"},{"t":"abe","k":"paper","id":"ABE-PAPER-2013-GGHSSW","s":"gghsw13","title":"Attribute-Based Encryption for Circuits from Multilinear Maps","key":"GGHSW13","y":2013,"sub":"Sanjam Garg, Craig Gentry, Shai Halevi, Amit Sahai, Brent Waters · CRYPTO 2013"},{"t":"abe","k":"paper","id":"ABE-PAPER-2013-HW-FAST","s":"hw13","title":"Attribute-Based Encryption with Fast Decryption","key":"HW13","y":2013,"sub":"Susan Hohenberger, Brent Waters · IACR ePrint 2013"},{"t":"abe","k":"paper","id":"ABE-PAPER-2013-RW","s":"rw13","title":"Practical Constructions and New Proof Methods for Large Universe Attribute-Based Encryption","key":"RW13","y":2013,"sub":"Yannis Rouselakis, Brent Waters · ACM CCS 2013"},{"t":"abe","k":"paper","id":"ABE-PAPER-2014-ATTRAPADUNG","s":"attrapadung14","title":"Dual System Encryption via Doubly Selective Security: Framework, Fully-secure Functional Encryption for Regular Languages, and More","key":"Attrapadung14","y":2014,"sub":"Nuttapong Attrapadung · EUROCRYPT 2014"},{"t":"abe","k":"paper","id":"ABE-PAPER-2014-BGGPS","s":"bgg14","title":"Fully Key-Homomorphic Encryption, Arithmetic Circuit ABE, and Compact Garbled Circuits","key":"BGG+14","y":2014,"sub":"Dan Boneh, Craig Gentry, Sergey Gorbunov, Shai Halevi, Valeria Nikolaenko, Gil Segev, Vinod Vaikuntanathan, Dhinakaran Vinayagamurthy · EUROCRYPT 2014"},{"t":"abe","k":"paper","id":"ABE-PAPER-2014-CW-SEMIADAPTIVE","s":"cw14","title":"Semi-Adaptive Attribute-Based Encryption and Improved Delegation for Boolean Formula","key":"CW14","y":2014,"sub":"Jie Chen, Hoeteck Wee · SCN 2014"},{"t":"abe","k":"paper","id":"ABE-PAPER-2015-CGW","s":"cgw15","title":"Improved Dual System ABE in Prime-Order Groups via Predicate Encodings","key":"CGW15","y":2015,"sub":"Jie Chen, Romain Gay, Hoeteck Wee · EUROCRYPT 2015"},{"t":"abe","k":"paper","id":"ABE-PAPER-2016-BV","s":"bv16","title":"Circuit-ABE from LWE: Unbounded Attributes and Semi-Adaptive Security","key":"BV16","y":2016,"sub":"Zvika Brakerski, Vinod Vaikuntanathan · CRYPTO 2016"},{"t":"abe","k":"paper","id":"ABE-PAPER-2017-ABGW","s":"abgw17","title":"Attribute-Based Encryption in the Generic Group Model: Automated Proofs and New Constructions","key":"ABGW17","y":2017,"sub":"Miguel Ambrona, Gilles Barthe, Romain Gay, Hoeteck Wee · ACM CCS 2017"},{"t":"abe","k":"paper","id":"ABE-PAPER-2017-FAME","s":"ac17","title":"FAME: Fast Attribute-Based Message Encryption","key":"AC17","y":2017,"sub":"Shashank Agrawal, Melissa Chase · ACM CCS 2017"},{"t":"abe","k":"paper","id":"ABE-PAPER-2018-CGW-IPE","s":"cgw18","title":"Improved Inner-Product Encryption with Adaptive Security and Full Attribute-Hiding","key":"CGW18","y":2018,"sub":"Jie Chen, Junqing Gong, Hoeteck Wee · ASIACRYPT 2018"},{"t":"abe","k":"paper","id":"ABE-PAPER-2018-CGKW","s":"cgkw18","title":"Unbounded ABE via Bilinear Entropy Expansion, Revisited","key":"CGKW18","y":2018,"sub":"Jie Chen, Junqing Gong, Lucas Kowalczyk, Hoeteck Wee · EUROCRYPT 2018"},{"t":"abe","k":"paper","id":"ABE-PAPER-2019-AMY-DFA","s":"amy19","title":"Attribute Based Encryption for Deterministic Finite Automata from DLIN","key":"AMY19","y":2019,"sub":"Shweta Agrawal, Monosij Maitra, Shota Yamada · IACR ePrint 2019"},{"t":"abe","k":"paper","id":"ABE-PAPER-2019-KW","s":"kw19a","title":"Compact Adaptively Secure ABE for NC1 from k-Lin","key":"KW19a","y":2019,"sub":"Lucas Kowalczyk, Hoeteck Wee · EUROCRYPT 2019"},{"t":"abe","k":"paper","id":"ABE-PAPER-2019-TSABARY","s":"tsabary19","title":"Fully Secure Attribute-Based Encryption for t-CNF from LWE","key":"Tsabary19","y":2019,"sub":"Rotem Tsabary · CRYPTO 2019"},{"t":"abe","k":"paper","id":"ABE-PAPER-2019-KW-CCA","s":"kw19b","title":"Realizing Chosen Ciphertext Security Generically in Attribute-Based Encryption and Predicate Encryption","key":"KW19b","y":2019,"sub":"Venkata Koppula, Brent Waters · CRYPTO 2019"},{"t":"abe","k":"paper","id":"ABE-PAPER-2020-AY-FH","s":"ay20b","title":"CP-ABE for Circuits (and more) in the Symmetric Key Setting","key":"AY20b","y":2020,"sub":"Shweta Agrawal, Shota Yamada · TCC 2020"},{"t":"abe","k":"paper","id":"ABE-PAPER-2020-LL-EUROCRYPT","s":"ll20a","title":"Compact Adaptively Secure ABE from k-Lin: Beyond NC1 and towards NL","key":"LL20a","y":2020,"sub":"Huijia Lin, Ji Luo · EUROCRYPT 2020"},{"t":"abe","k":"paper","id":"ABE-PAPER-2020-AY","s":"ay20a","title":"Optimal Broadcast Encryption from Pairings and LWE","key":"AY20a","y":2020,"sub":"Shweta Agrawal, Shota Yamada · EUROCRYPT 2020"},{"t":"abe","k":"paper","id":"ABE-PAPER-2020-LL","s":"ll20b","title":"Succinct and Adaptively Secure ABE for ABP from k-Lin","key":"LL20b","y":2020,"sub":"Huijia Lin, Ji Luo · ASIACRYPT 2020"},{"t":"abe","k":"paper","id":"ABE-PAPER-2020-AT","s":"at20","title":"Unbounded Dynamic Predicate Compositions in ABE from Standard Assumptions","key":"AT20","y":2020,"sub":"Nuttapong Attrapadung, Junichi Tomida · ASIACRYPT 2020"},{"t":"abe","k":"paper","id":"ABE-PAPER-2021-GLW","s":"glw21","title":"Adaptive Security via Deletion in Attribute-Based Encryption: Solutions from Search Assumptions in Bilinear Groups","key":"GLW21","y":2021,"sub":"Rishab Goyal, Jiahui Liu, Brent Waters · ASIACRYPT 2021"},{"t":"abe","k":"paper","id":"ABE-PAPER-2021-DKW","s":"dkw21","title":"Decentralized Multi-Authority ABE for DNFs from LWE","key":"DKW21","y":2021,"sub":"Pratish Datta, Ilan Komargodski, Brent Waters · EUROCRYPT 2021"},{"t":"abe","k":"paper","id":"ABE-PAPER-2022-LLL","s":"lll22","title":"ABE for Circuits with Constant-Size Secret Keys and Adaptive Security","key":"LLL22","y":2022,"sub":"Hanjun Li, Huijia Lin, Ji Luo · TCC 2022"},{"t":"abe","k":"paper","id":"ABE-PAPER-2022-FABEO","s":"rw22","title":"FABEO: Fast Attribute-Based Encryption with Optimal Security","key":"RW22","y":2022,"sub":"Doreen Riepel, Hoeteck Wee · ACM CCS 2022"},{"t":"abe","k":"paper","id":"ABE-PAPER-2022-VA-GLUE","s":"va22","title":"GLUE: Generalizing Unbounded Attribute-Based Encryption for Flexible Efficiency Trade-Offs","key":"VA22","y":2022,"sub":"Marloes Venema, Greg Alpár · IACR ePrint 2022"},{"t":"abe","k":"paper","id":"ABE-PAPER-2022-WWW-MAABE","s":"www22","title":"Multi-Authority ABE from Lattices without Random Oracles","key":"WWW22","y":2022,"sub":"Brent Waters, Hoeteck Wee, David J. Wu · TCC 2022"},{"t":"abe","k":"paper","id":"ABE-PAPER-2022-AYY-MIABE","s":"ayy22","title":"Multi-Input Attribute Based Encryption and Predicate Encryption","key":"AYY22","y":2022,"sub":"Shweta Agrawal, Anshu Yadav, Shota Yamada · CRYPTO 2022"},{"t":"abe","k":"paper","id":"ABE-PAPER-2023-HLL","s":"hll23","title":"Attribute-Based Encryption for Circuits of Unbounded Depth from Lattices","key":"HLL23","y":2023,"sub":"Yao-Ching Hsieh, Huijia Lin, Ji Luo · FOCS 2023"},{"t":"abe","k":"paper","id":"ABE-PAPER-2023-ARYY","s":"aryy23","title":"Constant Input Attribute Based (and Predicate) Encryption from Evasive and Tensor LWE","key":"ARYY23","y":2023,"sub":"Shweta Agrawal, Melissa Rossi, Anshu Yadav, Shota Yamada · CRYPTO 2023"},{"t":"abe","k":"paper","id":"ABE-PAPER-2023-DKW","s":"dkw23","title":"Fully Adaptive Decentralized Multi-Authority ABE","key":"DKW23","y":2023,"sub":"Pratish Datta, Ilan Komargodski, Brent Waters · EUROCRYPT 2023"},{"t":"abe","k":"paper","id":"ABE-PAPER-2023-FWW","s":"fww23","title":"How to Use (Plain) Witness Encryption: Registered ABE, Flexible Broadcast, and More","key":"FWW23","y":2023,"sub":"Cody Freitag, Brent Waters, David Wu · CRYPTO 2023"},{"t":"abe","k":"paper","id":"ABE-PAPER-2023-ZLCW-LR","s":"zlcw23","title":"Leakage-Resilient Attribute-Based Encryption with Attribute-Hiding","key":"ZLCW23","y":2023,"sub":"Yijian Zhang, Yunhao Ling, Jie Chen, Luping Wang · ICISC 2023"},{"t":"abe","k":"paper","id":"ABE-PAPER-2023-JLL","s":"jll23","title":"On the Optimal Succinctness and Efficiency of Functional Encryption and Attribute-Based Encryption","key":"JLL23","y":2023,"sub":"Aayush Jain, Huijia Lin, Ji Luo · EUROCRYPT 2023"},{"t":"abe","k":"paper","id":"ABE-PAPER-2023-ZZGQ-REGPE","s":"zzgq23","title":"Registered ABE via Predicate Encodings","key":"ZZGQ23","y":2023,"sub":"Ziqi Zhu, Kai Zhang, Junqing Gong, Haifeng Qian · ASIACRYPT 2023"},{"t":"abe","k":"paper","id":"ABE-PAPER-2023-HLWW","s":"hlww23","title":"Registered Attribute-Based Encryption","key":"HLWW23","y":2023,"sub":"Susan Hohenberger, George Lu, Brent Waters, David Wu · EUROCRYPT 2023"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-HLL","s":"hll24","title":"A General Framework for Lattice-Based ABE Using Evasive Inner-Product Functional Encryption","key":"HLL24","y":2024,"sub":"Yao-Ching Hsieh, Huijia Lin, Ji Luo · EUROCRYPT 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-WW","s":"ww24a","title":"Adaptively Secure Attribute-Based Encryption from Witness Encryption","key":"WW24a","y":2024,"sub":"Brent Waters, Daniel Wichs · TCC 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-AMY-TM","s":"aky24","title":"Attribute Based Encryption for Turing Machines from Lattices","key":"AKY24","y":2024,"sub":"Shweta Agrawal, Simran Kumari, Shota Yamada · CRYPTO 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-WEE","s":"wee24","title":"Circuit ABE with \\( \\mathrm{poly}(\\mathrm{depth}, \\lambda) \\)-sized Ciphertexts and Keys from Lattices","key":"Wee24","y":2024,"sub":"Hoeteck Wee · CRYPTO 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-AKY-PRFE","s":"aky24a","title":"Compact Pseudorandom Functional Encryption from Evasive LWE","key":"AKY24a","y":2024,"sub":"Shweta Agrawal, Simran Kumari, Shota Yamada"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-BM","s":"bm24","title":"Limits on Adaptive Security for Attribute-Based Encryption","key":"BM24","y":2024,"sub":"Zvika Brakerski, Stav Medina · TCC 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-LYXXZPD-HRABE","s":"lyx24","title":"Make Revocation Cheaper: Hardware-Based Revocable Attribute-Based Encryption","key":"LYX+24","y":2024,"sub":"Xiaoguo Li, Guomin Yang, Tao Xiang, Shengmin Xu, Bowen Zhao, Hwee Hwa Pang, Robert H. Deng · IEEE S&P 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-AKY-PRMIFE","s":"aky24b","title":"Pseudorandom Multi-Input Functional Encryption and Applications","key":"AKY24b","y":2024,"sub":"Shweta Agrawal, Simran Kumari, Shota Yamada"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-GLWW","s":"glww24","title":"Reducing the CRS Size in Registered ABE Systems","key":"GLWW24","y":2024,"sub":"Rachit Garg, George Lu, Brent Waters, David Wu · CRYPTO 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-CW","s":"cw24","title":"Unbounded ABE for Circuits from LWE, Revisited","key":"CW24","y":2024,"sub":"Valerio Cini, Hoeteck Wee · ASIACRYPT 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2024-VB-CCA","s":"vb24","title":"Using Predicate Extension for Predicate Encryption to Generically Obtain Chosen-Ciphertext Security and Signatures","key":"VB24","y":2024,"sub":"Marloes Venema, Leon Botros · IACR Communications in Cryptology 2024"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-HWW-ADAPTIVE-BE","s":"hww25","title":"A Generic Approach to Adaptively-Secure Broadcast Encryption in the Plain Model","key":"HWW25","y":2025,"sub":"Yao-Ching Hsieh, Brent Waters, David J. Wu · EUROCRYPT 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-WEE","s":"wee25","title":"Almost Optimal KP and CP-ABE for Circuits from Succinct LWE","key":"Wee25","y":2025,"sub":"Hoeteck Wee · EUROCRYPT 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-CW-TM","s":"cw25","title":"Faster ABE for Turing Machines from Circular Evasive LWE","key":"CW25","y":2025,"sub":"Valerio Cini, Hoeteck Wee · EUROCRYPT 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-SB-LUT","s":"sb25","title":"Lookup-Table Evaluation over Key-Homomorphic Encodings and KP-ABE for Nonlinear Operations","key":"SB25","y":2025,"sub":"Sora Suegami, Enrico Bottazzi · IACR ePrint 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-LWW-MARABE","s":"lww25","title":"Multi-Authority Registered Attribute-Based Encryption","key":"LWW25","y":2025,"sub":"George Lu, Brent Waters, David Wu · EUROCRYPT 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-KNP-SKL","s":"knp25","title":"PKE and ABE with Collusion-Resistant Secure Key Leasing","key":"KNP25","y":2025,"sub":"Fuyuki Kitagawa, Ryo Nishimaki, Nikhil Pappu"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-WBWL-PE","s":"wwlw25","title":"Predicate Encryption from Lattices: Enhanced Compactness and Refined Functionality","key":"WWLW25","y":2025,"sub":"Yuejun Wang, Baocang Wang, Qiqi Lai, Huaxiong Wang · PKC 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-CHW-RABE","s":"chw25","title":"Registered ABE and Adaptively-Secure Broadcast Encryption from Succinct LWE","key":"CHW25","y":2025,"sub":"Jeffrey Champion, Yao-Ching Hsieh, David J. Wu · CRYPTO 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-WW-UNBOUNDED-RABE","s":"ww25","title":"Unbounded Distributed Broadcast Encryption and Registered ABE from Succinct LWE","key":"WW25","y":2025,"sub":"Hoeteck Wee, David J. Wu · CRYPTO 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2025-AMYY-ZEROIZING","s":"amyy25","title":"Zeroizing Attacks against Evasive and Circular Evasive LWE","key":"AMYY25","y":2025,"sub":"Shweta Agrawal, Anuja Modi, Anshu Yadav, Shota Yamada · TCC 2025"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-AMYY","s":"abm26","title":"ABE for Unbounded Circuits from Circular LWE and Pairings","key":"ABM+26","y":2026,"sub":"Shweta Agrawal, Supriyo Banerjee, Anuja Modi, Rajeev Raghunath, Anshu Yadav, Shota Yamada"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-GY-FBE","s":"gy26a","title":"Adaptively-Secure Flexible and Identity-Based Broadcast Encryption from Decomposed LWE","key":"GY26a","y":2026,"sub":"Rishab Goyal, Saikumar Yadugiri"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-LZF-CONSTANT-CT","s":"lzf26","title":"Ciphertext-Policy ABE for NC1 Circuits with Constant-Size Ciphertexts from Succinct LWE","key":"LZF26","y":2026,"sub":"Jiaqi Liu, Yuanyi Zhang, Fang-Wei Fu · IACR ePrint 2026"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-GY-THRESHOLD-DMPE","s":"gy26","title":"Distributed Monotone Policy Encryption with Stronger Security for DNFs and Threshold Policies from Lattices","key":"GY26","y":2026,"sub":"Rishab Goyal, Saikumar Yadugiri"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-CW-DMPE","s":"cw26a","title":"Distributed Monotone-Policy Encryption for DNFs from Lattices","key":"CW26a","y":2026,"sub":"Jeffrey Champion, David J. Wu · EUROCRYPT 2026"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-GY-EQUIVOCAL-BE","s":"gy26b","title":"Equivocal Broadcast Encryption: Adaptively-Secure Optimal Distributed Broadcast Encryption from Lattices","key":"GY26b","y":2026,"sub":"Rishab Goyal, Saikumar Yadugiri · CRYPTO 2026"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-CW-OPT-DMPE","s":"cw26b","title":"Optimal Distributed Monotone-Policy Encryption for DNFs and More from Lattices","key":"CW26b","y":2026,"sub":"Jeffrey Champion, David J. Wu"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-SWW-RABE","s":"sww26","title":"Pairing-Based Registered ABE for Boolean Formulas with a Linear-Size CRS","key":"SWW26","y":2026,"sub":"Roy Stracovsky, Brent Waters, David J. Wu · CRYPTO 2026"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-WW-SILENT","s":"ww26","title":"Silent Threshold Cryptography from Pairings: Expressive Policies in the Plain Model","key":"WW26","y":2026,"sub":"Brent Waters, David Wu · EUROCRYPT 2026"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-CWY-SILENT-THRESHOLD","s":"cwy26","title":"Silent Threshold Encryption from Lattices","key":"CWY26","y":2026,"sub":"Jeffrey Champion, David J. Wu, Shota Yamada"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-AMR-TREE-ENCODINGS","s":"amr26a","title":"Tree Encodings I: How to Authenticate a Truth Table","key":"AMR26a","y":2026,"sub":"Damiano Abram, Giulio Malavolta, Lawrence Roy"},{"t":"abe","k":"paper","id":"ABE-PAPER-2026-AMR-DEPTH-UNBOUNDED","s":"amr26b","title":"Tree Encodings IV: Depth-Unbounded Attribute-Based Encryption and Delay Encryption","key":"AMR26b","y":2026,"sub":"Damiano Abram, Giulio Malavolta, Lawrence Roy"},{"t":"abe","k":"result","id":"ABE-RESULT-2005-SW-INTRODUCED-FUZZY-IBE-AND-THE-ABE-VIEW","s":"sw05-fuzzy-ibe-abe","title":"Fuzzy IBE → ABE","key":"SW05","y":2005,"sub":"A secret key for one attribute set decrypts ciphertexts whose attribute set overlaps it in at least a specified threshold, giving fuzzy IBE and the conceptual precursor of ABE."},{"t":"abe","k":"result","id":"ABE-RESULT-2006-GPSW-INTRODUCED-KP-ABE-FOR-ACCESS-STRUCTURES","s":"gpsw06-key-policy-abe","title":"Key-policy ABE","key":"GPSW06","y":2006,"sub":"GPSW formalized KP-ABE by placing an attribute set on each ciphertext and an access structure in each secret key, with collusion resistance expressed through secret sharing."},{"t":"abe","k":"result","id":"ABE-RESULT-2007-BSW-ADAPTIVE-GENERIC-GROUP-SECURITY","s":"bsw07-adaptive-cp-abe-analysis","title":"Adaptive CP-ABE analysis in the generic group model","key":"BSW07","y":2007,"sub":"BSW analyzed its CP-ABE construction in an adaptive challenge-policy and key-query CPA game in the generic bilinear group model, with the attribute hash modeled as a random oracle."},{"t":"abe","k":"result","id":"ABE-RESULT-2007-BSW-INTRODUCED-CP-ABE-CONSTRUCTION","s":"bsw07-ciphertext-policy-abe","title":"Ciphertext-policy ABE","key":"BSW07","y":2007,"sub":"BSW constructed CP-ABE in which a ciphertext carries a monotone threshold access tree and a user's secret key carries an attribute set."},{"t":"abe","k":"result","id":"ABE-RESULT-2007-BSW-IMPLEMENTED-ABE","s":"bsw07-the-first-implemented-cp","title":"The first implemented CP-ABE system","key":"BSW07","y":2007,"sub":"BSW implemented its CP-ABE construction and reported measurements, demonstrating that ciphertext-policy access control could be realized with then-available pairing libraries."},{"t":"abe","k":"result","id":"ABE-RESULT-2010-LOSSTW-FIRST-FULLY-SECURE-ABE-FOR-ARBITRARY-MONOTONE-FORMULAS","s":"lostw10-fully-secure-abe-for","title":"Fully secure ABE for arbitrary monotone formulas","key":"LOSTW10","y":2010,"sub":"LOSSTW constructed the first fully secure KP/CP-ABE for arbitrary monotone formulas using dual-system techniques in composite-order bilinear groups under static assumptions."},{"t":"abe","k":"result","id":"ABE-RESULT-2011-LW-MAABE-DECENTRALIZED-MULTI-AUTHORITY-ABE-WITHOUT-CENTRAL-AUTHORITY","s":"lw11a-decentralized-ma-abe","title":"Decentralized MA-ABE","key":"LW11a","y":2011,"sub":"Lewko and Waters constructed decentralized multi-authority ABE in which independent parties issue attributes and global user identities prevent cross-user collusion without a coordinating central authority."},{"t":"abe","k":"result","id":"ABE-RESULT-2011-WATERS-EXPRESSIVE-CP-ABE-IN-THE-STANDARD-MODEL","s":"waters11-standard-model-cp-abe","title":"Standard-model CP-ABE","key":"Waters11","y":2011,"sub":"Waters constructed CP-ABE for LSSS access structures in the standard model, with ciphertext and key components attached directly to policy rows and attributes."},{"t":"abe","k":"result","id":"ABE-RESULT-2011-LW-UNBOUNDED-REMOVED-SETUP-BOUND-ON-ABE-UNIVERSE-AND-ATTRIBUTE-SET-SIZE","s":"lw11b-unbounded-universe","title":"Unbounded universe","key":"LW11b","y":2011,"sub":"Lewko and Waters constructed KP-ABE whose public parameters do not impose an a-priori attribute universe or attribute-set-size bound, while supporting LSSS policies and delegation."},{"t":"abe","k":"result","id":"ABE-RESULT-2012-LW-FULL-SECURITY-FROM-SELECTIVE-PROOF-COMPONENTS","s":"lw12-adaptive-cp-abe-security","title":"Adaptive CP-ABE security assembled from selective proof components","key":"LW12","y":2012,"sub":"Lewko and Waters showed how selectively secure components could be embedded inside a dual-system proof to obtain fully secure CP-ABE with efficiency comparable to selective systems."},{"t":"abe","k":"result","id":"ABE-RESULT-2012-OT-ADAPTIVE-UNBOUNDED-ABE-FROM-DLIN","s":"ot12-adaptive-unbounded-abe","title":"Adaptive unbounded ABE","key":"OT12","y":2012,"sub":"Okamoto and Takashima constructed public-parameter-unbounded KP/CP-ABE for non-monotone access structures with adaptive payload-hiding security in the standard model under DLIN."},{"t":"abe","k":"result","id":"ABE-RESULT-2012-SSW-REVOCATION-INTRODUCED-REVOCABLE-STORAGE-ABE-AND-CIPHERTEXT-DELEGATION","s":"ssw12-revocable-storage-abe-with","title":"Revocable-storage ABE with public ciphertext delegation","key":"SSW12","y":2012,"sub":"Sahai, Seyalioglu, and Waters formalized revocable-storage ABE and introduced public ciphertext delegation so stored ciphertexts can be updated to independent encryptions under more restrictive policies."},{"t":"abe","k":"result","id":"ABE-RESULT-2012-OT-ADAPTIVE-UNBOUNDED-IPE-WITH-FULL-ATTRIBUTE-HIDING","s":"ot12-unbounded-ipe-with-adaptive","title":"Unbounded IPE with adaptive full attribute hiding","key":"OT12","y":2012,"sub":"Okamoto and Takashima constructed unbounded generalized inner-product encryption with adaptive full attribute hiding in the standard model under DLIN."},{"t":"abe","k":"result","id":"ABE-RESULT-2013-HW-FAST-PER-USER-EFFICIENCY-TRADEOFF","s":"hw13-a-per-user-kp","title":"A per-user KP-ABE tradeoff between key size and decryption work","key":"HW13","y":2013,"sub":"The Hohenberger-Waters construction exposes per-user choices between GPSW-like key size and the two-pairing endpoint without changing public parameters or encryption."},{"t":"abe","k":"result","id":"ABE-RESULT-2013-BNS-ARITH-DEPTH-DEPENDENT-SECRET-KEYS","s":"bns13-arithmetic-circuit-abe-keys","title":"Arithmetic-circuit ABE keys depend on depth, not gate count","key":"BNS13","y":2013,"sub":"The BNS arithmetic-circuit KP-ABE represents a decryption key by one low-norm matrix whose size depends on circuit depth rather than the number of gates or wires."},{"t":"abe","k":"result","id":"ABE-RESULT-2013-HW-FAST-CONSTANT-TWO-PAIRING-KP-ABE","s":"hw13-expressive-kp-abe-with","title":"Expressive KP-ABE with a two-pairing decryption path","key":"HW13","y":2013,"sub":"Hohenberger and Waters constructed expressive large-universe KP-ABE whose main decryption path uses two pairings, at the cost of larger user secret keys."},{"t":"abe","k":"result","id":"ABE-RESULT-2013-GVW-FIRST-GENERAL-CIRCUIT-ABE-FROM-LWE","s":"gvw13-general-circuit-abe","title":"General circuit ABE","key":"GVW13","y":2013,"sub":"Gorbunov, Vaikuntanathan, and Wee constructed the first ABE for arbitrary polynomial-size bounded-depth circuits from LWE."},{"t":"abe","k":"result","id":"ABE-RESULT-2013-BNS-ARITH-LWE-ABE-FOR-ARITHMETIC-CIRCUITS","s":"bns13-lwe-based-kp-abe","title":"LWE-based KP-ABE for arithmetic circuits","key":"BNS13","y":2013,"sub":"Boneh, Nikolaenko, and Segev constructed selectively secure KP-ABE for polynomial-size arithmetic circuits from LWE, with delegation."},{"t":"abe","k":"result","id":"ABE-RESULT-2013-RW-PRACTICAL-LARGE-UNIVERSE-CP-ABE","s":"rw13-practical-large-universe-cp","title":"Practical large-universe CP-ABE in prime-order groups","key":"RW13","y":2013,"sub":"Rouselakis and Waters constructed and implemented large-universe CP-ABE for monotone LSSS policies with constant-size public parameters in prime-order bilinear groups."},{"t":"abe","k":"result","id":"ABE-RESULT-2013-RW-EFFICIENT-LARGE-UNIVERSE-KP-ABE","s":"rw13-practical-large-universe-kp","title":"Practical large-universe KP-ABE with constant public parameters","key":"RW13","y":2013,"sub":"Rouselakis and Waters constructed large-universe KP-ABE for monotone LSSS policies in prime-order groups with constant-size public parameters and arbitrary attribute strings."},{"t":"abe","k":"result","id":"ABE-RESULT-2013-GGHSSW-FIRST-GENERAL-CIRCUIT-ABE-FROM-MULTILINEAR-MAPS","s":"gghsw13-the-first-arbitrary-circuit","title":"The first arbitrary-circuit ABE from candidate multilinear maps","key":"GGHSW13","y":2013,"sub":"GGHSSW constructed selectively secure KP- and CP-ABE for arbitrary polynomial-size circuits using candidate multilinear maps."},{"t":"abe","k":"result","id":"ABE-RESULT-2014-CW-SEMIADAPTIVE-CONSTANT-CIPHERTEXT-SEMI-ADAPTIVE-KPABE","s":"cw14-constant-ciphertext-semi-ada","title":"Constant-ciphertext semi-adaptive KP-ABE","key":"CW14","y":2014,"sub":"Chen and Wee constructed semi-adaptively secure KP-ABE with constant-size ciphertexts in composite-order groups under static assumptions."},{"t":"abe","k":"result","id":"ABE-RESULT-2014-BGGPS-LATTICE-ABE-FOR-ARITHMETIC-CIRCUITS-WITH-DEPTH-DEPENDENT-KEYS","s":"bgg14-arithmetic-circuit-abe","title":"Arithmetic-circuit ABE","key":"BGG+14","y":2014,"sub":"BGGPS used fully key-homomorphic encryption to construct selectively secure lattice ABE for arithmetic circuits whose secret-key size depends on depth rather than circuit size."},{"t":"abe","k":"result","id":"ABE-RESULT-2014-ATTRAPADUNG-INTRODUCED-PAIR-ENCODING-FRAMEWORK","s":"attrapadung14-pair-encoding-framework-for","title":"Pair-encoding framework for adaptively secure functional encryption","key":"Attrapadung14","y":2014,"sub":"Attrapadung introduced pair encoding schemes with doubly selective security and a generic dual-system compiler to adaptively secure functional encryption, including unbounded and constant-ciphertext ABE instantiations."},{"t":"abe","k":"result","id":"ABE-RESULT-2014-CW-SEMIADAPTIVE-INTRODUCED-SEMI-ADAPTIVE-ABE","s":"cw14-the-semi-adaptive-abe","title":"The semi-adaptive ABE security notion","key":"CW14","y":2014,"sub":"Chen and Wee formalized semi-adaptive KP-ABE security, where the adversary chooses the challenge attribute vector after setup but before making secret-key queries."},{"t":"abe","k":"result","id":"ABE-RESULT-2015-CGW-MODULAR-ADAPTIVE-ABE-FROM-PREDICATE-ENCODINGS","s":"cgw15-a-predicate-encoding-compile","title":"A predicate-encoding compiler for adaptive ABE","key":"CGW15","y":2015,"sub":"Chen, Gay, and Wee gave a modular compiler from suitable predicate encodings to adaptively secure ABE in prime-order groups under the k-linear assumption family."},{"t":"abe","k":"result","id":"ABE-RESULT-2016-BV-UNBOUNDED-ATTRIBUTE-LENGTH-AND-SEMI-ADAPTIVE-CIRCUIT-ABE-FROM-LWE","s":"bv16-unbounded-lattice-abe","title":"Unbounded lattice ABE","key":"BV16","y":2016,"sub":"Brakerski and Vaikuntanathan constructed LWE-based circuit ABE that fixes only a depth bound at setup, allows arbitrary polynomial attribute and input length, and achieves semi-adaptive security."},{"t":"abe","k":"result","id":"ABE-RESULT-2017-ABGW-AUTOMATED-ANALYSIS-AND-SYNTHESIS-OF-PAIRING-ABE","s":"abgw17-pair-encoding-synthesis","title":"Pair-encoding synthesis","key":"ABGW17","y":2017,"sub":"Ambrona, Barthe, Gay, and Wee formalized pair encodings and used symbolic tools to verify, attack, and synthesize pairing-based ABE in the algebraic and generic group setting."},{"t":"abe","k":"result","id":"ABE-RESULT-2017-FAME-FAST-CONCRETELY-EFFICIENT-CP-ABE","s":"ac17-fame","title":"FAME","key":"AC17","y":2017,"sub":"FAME constructed a compact and concretely efficient fully secure CP-ABE for general access structures under DLIN in asymmetric pairings and the random oracle model."},{"t":"abe","k":"result","id":"ABE-RESULT-2018-CGW-IPE-ADAPTIVE-FULL-ATTRIBUTE-HIDING-IPE-FROM-K-LIN","s":"cgw18-more-compact-adaptively-attr","title":"More compact adaptively attribute-hiding IPE","key":"CGW18","y":2018,"sub":"Chen, Gong, and Wee constructed adaptively secure fully attribute-hiding IPE in prime-order groups with improved public-parameter and key sizes under k-Lin and XDLIN tradeoffs."},{"t":"abe","k":"result","id":"ABE-RESULT-2018-CGKW-ADAPTIVE-UNBOUNDED-ABE-WITH-CONSTANT-PUBLIC-PARAMETERS","s":"cgkw18-unbounded-abe-via-bilinear","title":"Unbounded ABE via bilinear entropy expansion","key":"CGKW18","y":2018,"sub":"Chen, Gong, Kowalczyk, and Wee constructed adaptively secure unbounded KP/CP-ABE with constant-size public parameters under the MDDH and \\( k \\)-Lin family, with public parameters, keys, and ciphertexts smaller than Okam"},{"t":"abe","k":"result","id":"ABE-RESULT-2019-KW-CCA-BLACK-BOX-CPA-TO-CCA-TRANSFORM-FOR-ABE-AND-ONE-SIDED-PE","s":"kw19b-black-box-cca-transform","title":"Black-box CCA transform","key":"KW19b","y":2019,"sub":"Koppula and Waters gave a black-box transform from perfectly correct IND-CPA ABE or one-sided predicate encryption to CCA security using a hinting PRG."},{"t":"abe","k":"result","id":"ABE-RESULT-2019-KW-COMPACT-ADAPTIVE-MANY-USE-ABE-FOR-NC1","s":"kw19a-compact-adaptively-secure-ab","title":"Compact adaptively secure ABE for NC1","key":"KW19a","y":2019,"sub":"Kowalczyk and Wee constructed adaptively secure KP/CP-ABE for monotone NC1 under k-Lin, with each orientation linear in the short input side and independent of the opposite policy size."},{"t":"abe","k":"result","id":"ABE-RESULT-2019-AMY-DFA-UNBOUNDED-MACHINES-INPUTS-AND-QUERIES","s":"amy19-dfa-abe-with-unbounded","title":"DFA ABE with unbounded machines, inputs, and key queries","key":"AMY19","y":2019,"sub":"Agrawal, Maitra, and Yamada's DFA ABE supports unbounded input length, automaton size, and number of key requests without fixing those realized quantities at setup."},{"t":"abe","k":"result","id":"ABE-RESULT-2019-AMY-DFA-DFA-ABE-FROM-STATIC-DLIN","s":"amy19-dfa-based-kp-cp","title":"DFA-based KP/CP-ABE from static DLIN","key":"AMY19","y":2019,"sub":"Agrawal, Maitra, and Yamada constructed KP- and CP-ABE for deterministic finite automata from the static DLIN assumption."},{"t":"abe","k":"result","id":"ABE-RESULT-2019-TSABARY-FIRST-ADAPTIVE-LATTICE-ABE-BEYOND-IBE","s":"tsabary19-fully-adaptive-lattice-cp","title":"Fully adaptive lattice CP-ABE for constant-t CNF policies","key":"Tsabary19","y":2019,"sub":"Tsabary constructed fully secure LWE-based CP-ABE for constant-t CNF policies, together with a conforming single-key constrained PRF component."},{"t":"abe","k":"result","id":"ABE-RESULT-2020-LL-ADAPTIVE-ABP-ABE-WITH-ONE-CONSTANT-SIDE","s":"ll20b-adaptively-secure-abp-abe","title":"Adaptively secure ABP ABE with one constant-size side","key":"LL20b","y":2020,"sub":"Under k-Lin-family assumptions, the KP orientation has constant-size ciphertexts and the CP orientation has constant-size secret keys for arithmetic branching programs."},{"t":"abe","k":"result","id":"ABE-RESULT-2020-AT-ADAPTIVE-COMPLETELY-UNBOUNDED-FORMULA-ABE-FROM-MDDH","s":"at20-adaptively-secure-completely","title":"Adaptively secure, completely unbounded formula ABE from MDDH","key":"AT20","y":2020,"sub":"Dynamic predicate composition yields adaptively secure monotone and non-monotone formula ABE without setup-time bounds on the realized formula and attribute dimensions, under MDDH."},{"t":"abe","k":"result","id":"ABE-RESULT-2020-AY-OPTIMAL-BROADCAST-VIA-ALL-DIMENSION-INDEPENDENT-CPABE","s":"ay20a-circuit-size-independent-cp","title":"Circuit-size-independent CP-ABE yields optimal broadcast encryption","key":"AY20a","y":2020,"sub":"A CP-ABE component whose public key, secret keys, and ciphertexts are independent of supported circuit size is used to construct optimal broadcast encryption from pairings and LWE."},{"t":"abe","k":"result","id":"ABE-RESULT-2020-LL-EUROCRYPT-COMPACT-ADAPTIVE-KPABE-FOR-ABPS","s":"ll20a-compact-adaptively-secure-kp","title":"Compact adaptively secure KP-ABE for arithmetic branching programs","key":"LL20a","y":2020,"sub":"Lin and Luo constructed adaptively secure KP-ABE for arithmetic branching programs from k-Lin with ciphertext size independent of the ABP description size and secret keys linear in that description size."},{"t":"abe","k":"result","id":"ABE-RESULT-2020-AY-FH-NATURAL-FULL-FUNCTION-HIDING-CIRCUIT-ABE-IMPLIES-IO","s":"ay20b-natural-full-function-hiding","title":"Natural full function-hiding circuit ABE implies iO","key":"AY20b","y":2020,"sub":"Agrawal and Yamada prove that their natural full function-hiding notion for circuit ABE implies indistinguishability obfuscation, even for symmetric-key ABE."},{"t":"abe","k":"result","id":"ABE-RESULT-2020-AY-FH-WEAKENED-FUNCTION-HIDING-PE-FROM-LWE","s":"ay20b-weakened-function-hiding-pre","title":"Weakened function-hiding predicate encryption from LWE","key":"AY20b","y":2020,"sub":"A weakened function-hiding definition avoids the paper's iO implication and is instantiated for KP and CP orientations from subexponential LWE."},{"t":"abe","k":"result","id":"ABE-RESULT-2021-GLW-ADAPTIVE-ABE-FROM-SEARCH-BDH-VIA-DELETION","s":"glw21-adaptive-subset-abe-from","title":"Adaptive subset ABE from Search BDH via attribute deletion","key":"GLW21","y":2021,"sub":"Deletable attributes and deletion-conforming constrained PRFs compile selectively secure deletion KP-ABE into adaptively secure subset ABE from Search BDH."},{"t":"abe","k":"result","id":"ABE-RESULT-2021-DKW-FIRST-DECENTRALIZED-MAABE-FROM-LWE","s":"dkw21-lattice-ma-abe","title":"Lattice MA-ABE","key":"DKW21","y":2021,"sub":"A statically secure decentralized multi-authority ABE for DNF policies supports an unbounded number of authorities from subexponential-ratio LWE in the random-oracle model."},{"t":"abe","k":"result","id":"ABE-RESULT-2022-VA-GLUE-GENERALIZED-UNBOUNDED-EXPRESSIVE-ABE","s":"va22-completely-unbounded-large-u","title":"Completely unbounded large-universe CP-ABE with reusable labels","key":"VA22","y":2022,"sub":"GLUE gives a completely unbounded, large-universe CP-ABE family that supports attribute and label reuse and admits non-monotone extensions."},{"t":"abe","k":"result","id":"ABE-RESULT-2022-VA-GLUE-FLEXIBLE-ENCRYPTION-DECRYPTION-TRADEOFF","s":"va22-configurable-encryption-decr","title":"Configurable encryption–decryption tradeoffs in unbounded CP-ABE","key":"VA22","y":2022,"sub":"GLUE exposes partition parameters n_k and n_c that continuously trade encryption work and ciphertext structure against decryption and key costs within one completely unbounded CP-ABE family."},{"t":"abe","k":"result","id":"ABE-RESULT-2022-LLL-CONSTANT-SIZE-CIRCUIT-KPABE-KEYS","s":"lll22-constant-size-secret-keys","title":"Constant-size secret keys for circuit KP-ABE","key":"LLL22","y":2022,"sub":"Circuit KP-ABE secret keys contain three group elements and have size \\( \\mathrm{poly}(\\lambda) \\), independent of circuit size; ciphertexts still depend on attribute length and the maximum depth."},{"t":"abe","k":"result","id":"ABE-RESULT-2022-FABEO-FAME-LEVEL-EFFICIENCY-WITH-ADAPTIVE-MULTI-CHALLENGE-SECURITY","s":"rw22-fabeo","title":"FABEO","key":"RW22","y":2022,"sub":"FABEO combines FAME-like compact pairing operations with attribute multi-use and is the first KP/CP-ABE with optimal adaptive security against multiple challenge ciphertexts, proved in the generic bilinear group and rand"},{"t":"abe","k":"result","id":"ABE-RESULT-2022-AYY-MIABE-INITIATED-MIABE-AND-GAVE-TWO-INPUT-NC1-CONSTRUCTIONS","s":"ayy22-multi-input-abe","title":"Multi-input ABE","key":"AYY22","y":2022,"sub":"The first two-input KP-ABE for NC1 is secure against unbounded collusions and is constructed from LWE with pairings in the generic group model."},{"t":"abe","k":"result","id":"ABE-RESULT-2022-LLL-DOUBLE-SUCCINCT-FORMULA-CPABE","s":"lll22-formula-cp-abe-with","title":"Formula CP-ABE with both succinct keys and ciphertexts","key":"LLL22","y":2022,"sub":"Formula CP-ABE has constant-size secret keys and ciphertexts independent of the policy-formula size, while both may still depend on the attribute length."},{"t":"abe","k":"result","id":"ABE-RESULT-2022-WWW-MAABE-PLAIN-MODEL-MAABE-FOR-SUBSET-POLICIES","s":"www22-plain-model-lattice-ma","title":"Plain-model lattice MA-ABE for subset policies","key":"WWW22","y":2022,"sub":"Waters, Wee, and Wu give lattice multi-authority ABE for setup-unbounded subset policies from evasive LWE without a random oracle."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-JLL-CONSTANT-KEY-CIPHERTEXT-ABE","s":"jll23-abe-with-constant-size","title":"ABE with constant-size keys and ciphertexts from RAM PHFE","key":"JLL23","y":2023,"sub":"Jain, Lin, and Luo's nearly optimal RAM PHFE implies ABE with both secret keys and ciphertexts of size \\( \\mathrm{poly}(\\lambda) \\), together with decryption time matching the stated lower-bound tradeoff."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-ZLCW-LR-ATTRIBUTE-HIDING-ABE-UNDER-BOUNDED-KEY-LEAKAGE","s":"zlcw23-attribute-hiding-abe-under","title":"Attribute-hiding ABE under bounded secret-key leakage from predicate encodings and k-Lin","key":"ZLCW23","y":2023,"sub":"A Z_p-linear predicate encoding with the attribute-hiding and attribute-hiding-leakage-resilient properties compiles into ABE in prime-order bilinear groups that is (0, L_sk)-bounded-leakage secure and attribute-hiding u"},{"t":"abe","k":"result","id":"ABE-RESULT-2023-ZZGQ-REGPE-GENERIC-REGISTERED-ABE-FROM-PREDICATE-ENCODINGS","s":"zzgq23-black-box-registered-abe","title":"Black-box registered ABE compiler from predicate encodings","key":"ZZGQ23","y":2023,"sub":"A predicate encoding, MDDH, and a QA-NIZK with the required unbounded simulation soundness compile black-box into slotted registered ABE in prime-order bilinear groups."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-ARYY-CONSTANT-ARITY-MIABE-FOR-NC1-FROM-EVASIVE-LWE","s":"aryy23-constant-arity-miabe","title":"Constant-arity MIABE","key":"ARYY23","y":2023,"sub":"For every fixed constant arity, the paper constructs multi-input ABE for NC1 from LWE and evasive LWE, removing the earlier pairing/GGM component."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-DKW-FIRST-MAABE-SECURE-UNDER-ADAPTIVE-AUTHORITY-CORRUPTION","s":"dkw23-adaptive-authority-corruptio","title":"Adaptive authority corruption","key":"DKW23","y":2023,"sub":"The first decentralized MA-ABE security model and constructions allowing authority corruptions and user-key queries to occur adaptively are realized in pairing groups with a random oracle."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-HLL-CONSTANT-SIZE-GARBLING","s":"hll23-first-constant-size-reusable","title":"First constant-size reusable garbled circuits without iO","key":"HLL23","y":2023,"sub":"Under a circular-security assumption, reusable garbling for Boolean-output circuits has garbled-circuit and function-digest sizes independent of circuit depth and size, without using iO."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-HLL-UNBOUNDED-DEPTH-ABE","s":"hll23-unbounded-depth-abe","title":"Unbounded-depth ABE","key":"HLL23","y":2023,"sub":"Evasive circular LWE yields full collusion-resistant ABE for circuits whose depth and size are not predetermined at setup, with constant-size secret keys."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-JLL-RAM-PHFE-FROM-FE","s":"jll23-nearly-optimal-partially-hid","title":"Nearly optimal partially hiding FE for RAM from circuit FE","key":"JLL23","y":2023,"sub":"FE for circuits suffices for the first PHFE for RAM with constant-size function keys, rate-2 ciphertexts in the private input, and decryption linear in the instance RAM time plus description lengths."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-ZZGQ-REGPE-PRIME-ORDER-REGISTERED-ABE","s":"zzgq23-prime-order-registered-abe","title":"Prime-order registered ABE for span, inner-product, and ABP predicates","key":"ZZGQ23","y":2023,"sub":"Instantiating the predicate-encoding compiler gives prime-order registered ABE for read-once span programs, zero inner product, and read-once arithmetic span programs capturing ABPs."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-FWW-REGISTERED-ABE-FROM-PLAIN-WITNESS-ENCRYPTION-AND-LWE","s":"fww23-registered-abe-from-plain","title":"Registered ABE from plain witness encryption and LWE","key":"FWW23","y":2023,"sub":"Plain witness encryption for NP together with LWE yields registered ABE for general policies, transparent setup, and arbitrarily many users, with policy-selective standard-model security without corruptions."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-HLWW-INTRODUCED-REGISTERED-ABE-WITH-TRANSPARENT-CURATION","s":"hlww23-registered-abe","title":"Registered ABE","key":"HLWW23","y":2023,"sub":"Users generate their own keys and register public keys plus attributes with a deterministic transparent curator, which aggregates them into a master public key for ABE decryption."},{"t":"abe","k":"result","id":"ABE-RESULT-2023-JLL-SPACE-TIME-LOWER-BOUNDS","s":"jll23-unconditional-space-time-low","title":"Unconditional space–time lower bounds for PHFE","key":"JLL23","y":2023,"sub":"In the stated PHFE model, key size and decryption time cannot both be sublinear in function size, and ciphertext size and decryption time cannot both be sublinear in public-input size."},{"t":"abe","k":"result","id":"ABE-RESULT-2024-WW-ADAPTIVE-ABE-FROM-WITNESS-ENCRYPTION","s":"ww24a-adaptively-secure-abe-from","title":"Adaptively secure ABE from witness encryption","key":"WW24a","y":2024,"sub":"Witness encryption for NP, statistically sound NIZKs, statistically binding commitments, and one-way functions generically yield adaptively secure ABE."},{"t":"abe","k":"result","id":"ABE-RESULT-2024-BM-BLACK-BOX-LIMITS-ON-ADAPTIVE-ABE","s":"bm24-black-box-limits-on","title":"Black-box limits on proving adaptive security for checkable ABE","key":"BM24","y":2024,"sub":"No black-box reduction, even a rewinding one, from an intractability assumption with a polynomially bounded number of rounds can prove adaptive security of a pairwise-friendly ABE scheme whose keys are checkable (Theorem"},{"t":"abe","k":"result","id":"ABE-RESULT-2024-CW-UNBOUNDED-ATTRIBUTE-CIRCUIT-ABE-FROM-LWE","s":"cw24-unbounded-attribute-circuit","title":"Unbounded-attribute circuit ABE","key":"CW24","y":2024,"sub":"A black-box lattice construction gives semi-adaptively secure circuit ABE for attribute vectors of setup-unbounded length and unbounded collusions from plain LWE, while setup still fixes circuit depth."},{"t":"abe","k":"result","id":"ABE-RESULT-2024-VB-CCA-PREDICATE-EXTENSION-CPA-TO-CCA-COMPILER","s":"vb24-predicate-extension-cca","title":"Predicate-extension CCA","key":"VB24","y":2024,"sub":"Adding one coordinated attribute to key and ciphertext predicates makes generic CCA techniques apply to predicate encryption and yields a low-overhead pairing-based CP-ABE specialization."},{"t":"abe","k":"result","id":"ABE-RESULT-2024-WEE-CIRCUIT-ABE-WITH-KEY-AND-CIPHERTEXT-INDEPENDENT-OF-INPUT-AND-CIRCUIT-SIZE","s":"wee24-size-independent-circuit-abe","title":"Size-independent circuit ABE","key":"Wee24","y":2024,"sub":"From succinct LWE, circuit ABE has secret-key and ciphertext sizes \\( \\mathrm{poly}(\\mathrm{depth}, \\lambda) \\), independent of the circuit size and attribute-input length, under selective security."},{"t":"abe","k":"result","id":"ABE-RESULT-2024-AKY-PRFE-UNBOUNDED-DEPTH-KP-CP-ABE-FROM-NON-CIRCULAR-EVASIVE-LWE","s":"aky24a-kp-and-cp-abe","title":"KP- and CP-ABE for unbounded-depth circuits with \\( \\mathrm{poly}(\\lambda) \\)-size public keys, keys and ciphertexts from LWE and non-circular private-coin evasive LWE","key":"AKY24a","y":2024,"sub":"Under LWE and private-coin evasive LWE, with no circular assumption, there are very selectively secure KP-ABE (Theorem 6.1) and CP-ABE (Theorem 7.2) for circuits of unbounded depth with |mpk|, keys and ciphertexts of siz"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-AMY-TM-LATTICE-ABE-FOR-NL","s":"aky24-lattice-abe-for-nl","title":"Lattice ABE for NL Turing machines","key":"AKY24","y":2024,"sub":"Collusion-resistant lattice ABE supports NL Turing machines with unbounded input and machine descriptions, a dynamically chosen running-time bound, and input-specific decryption time under LWE, evasive LWE, and tensor LW"},{"t":"abe","k":"result","id":"ABE-RESULT-2024-AKY-PRFE-TURING-MACHINE-ABE-WITHOUT-CIRCULAR-TENSOR-LWE","s":"aky24a-lattice-abe-for-turing","title":"Lattice ABE for Turing machines from LWE and private-coin evasive LWE, without circular tensor LWE","key":"AKY24a","y":2024,"sub":"Instantiating the Agrawal–Kumari–Yamada (CRYPTO 2024) Turing-machine compiler with the paper's unbounded-depth KP- and CP-ABE gives very selectively secure ABE for Turing machines under LWE and evasive LWE, with \\( |\\mat"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-AMY-TM-LATTICE-ABE-FOR-TURING-MACHINES","s":"aky24-lattice-abe-for-arbitrary","title":"Lattice ABE for arbitrary Turing machines","key":"AKY24","y":2024,"sub":"Collusion-resistant lattice ABE supports arbitrary Turing machines with unbounded input and machine descriptions, dynamically chosen running time, and input-specific decryption time under LWE, evasive LWE, tensor LWE, an"},{"t":"abe","k":"result","id":"ABE-RESULT-2024-HLL-GENERAL-LATTICE-ABE-FRAMEWORK-VIA-NOISY-LSSS-AND-EVASIVE-IPFE","s":"hll24-lattice-abe-framework-from","title":"Lattice ABE framework from noisy LSSS and evasive IPFE","key":"HLL24","y":2024,"sub":"Noisy linear secret sharing combined with evasive inner-product FE gives a general lattice ABE framework, including succinct circuit CP-ABE and public-key ABE for DFA and logspace policies."},{"t":"abe","k":"result","id":"ABE-RESULT-2024-AKY-PRMIFE-MULTI-INPUT-PE-FROM-EVASIVE-LWE","s":"aky24b-multi-input-predicate-encryp","title":"Multi-input predicate encryption for bounded-depth circuits from evasive LWE, constant arity without tensor LWE","key":"AKY24b","y":2024,"sub":"Secret-key multi-input predicate encryption for functions of bounded polynomial depth exists for constant arity under LWE and private-coin evasive LWE (Theorem 4.6) and for polynomial arity under non-uniform κ-evasive LW"},{"t":"abe","k":"result","id":"ABE-RESULT-2024-GLWW-NEARLY-LINEAR-REGISTERED-ABE-CRS","s":"glww24-nearly-linear-rabe-crs","title":"Nearly-linear RABE CRS","key":"GLWW24","y":2024,"sub":"Progression-free sets reduce the registered-ABE CRS from quadratic in the user bound \\( N \\) to \\( N^{1+o(1)} \\); a separate static-security branch removes attribute-universe dependence, and together they give the first "},{"t":"abe","k":"result","id":"ABE-RESULT-2024-LYXXZPD-HRABE-TEE-ASSISTED-REVOCATION-WITHOUT-BULK-CIPHERTEXT-DELEGATION","s":"lyx24-tee-assisted-abe-revocation","title":"TEE-assisted ABE revocation without bulk ciphertext delegation","key":"LYX+24","y":2024,"sub":"Hardware-based revocable ABE uses a trusted execution environment to avoid periodically delegating every stored ciphertext and supports outsourced decryption under explicit selective collusion and TEE-leakage notions."},{"t":"abe","k":"result","id":"ABE-RESULT-2025-CHW-RABE-ADAPTIVE-DISTRIBUTED-BROADCAST-ENCRYPTION","s":"chw25-adaptive-distributed-broadca","title":"Adaptive distributed broadcast encryption from succinct LWE","key":"CHW25","y":2025,"sub":"In ROM, succinct LWE yields adaptively secure distributed broadcast encryption for an a-priori bounded user population, with ciphertext size polylogarithmic in that bound and independent of the recipient-set size."},{"t":"abe","k":"result","id":"ABE-RESULT-2025-WEE-ALMOST-OPTIMAL-CPABE","s":"wee25-almost-optimal-succinct-cp","title":"Almost-optimal succinct CP-ABE for bounded-depth circuits","key":"Wee25","y":2025,"sub":"Under succinct LWE, selectively secure CP-ABE for depth-d circuits has public keys, attribute secret keys, and policy ciphertexts whose sizes are independent of input length and circuit size up to factors polynomial in d"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-WEE-ALMOST-OPTIMAL-KPABE","s":"wee25-almost-optimal-kp-abe","title":"Almost-optimal KP-ABE","key":"Wee25","y":2025,"sub":"Under succinct LWE, selectively secure KP-ABE for depth-d circuits has public keys, ciphertexts, and circuit secret keys whose sizes are independent of input length and circuit size up to factors polynomial in d and the "},{"t":"abe","k":"result","id":"ABE-RESULT-2025-AMYY-ZEROIZING-COUNTEREXAMPLE-TO-EVASIVE-CIRCULAR-LWE","s":"amyy25-counterexample-to-the-evasiv","title":"Counterexample to the evasive circular LWE assumption behind unbounded-depth ABE","key":"AMYY25","y":2025,"sub":"The paper exhibits an efficient public-coin sampler for the evasive circular small-secret LWE assumption of Hsieh--Lin--Luo for which the precondition holds but the postcondition is broken (Theorem 3.8), together with co"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-CW-TM-LINEAR-TIME-ABE-FOR-TURING-MACHINES","s":"cw25-kp-abe-for-turing","title":"KP-ABE for Turing machines with \\( O(T) \\) encryption and ciphertexts and \\( O(1) \\) keys from public-coin circular evasive LWE","key":"CW25","y":2025,"sub":"Under public-coin circular small-secret evasive LWE and circular small-secret LWE, there is very selectively secure key-policy ABE for iterated computation, and hence for Turing machines, in which encryption for a time-T"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-SB-LUT-LOOKUP-TABLE-EVALUATION-OVER-BGG-ENCODINGS","s":"sb25-lookup-table-evaluation-over","title":"Lookup-table evaluation over BGG+ encodings","key":"SB25","y":2025,"sub":"Evaluates base-B lookup tables directly over key-homomorphic BGG+ encodings, providing a tunable mechanism for nonlinear operations whose larger base reduces repeated evaluation work at the cost of key-generation time an"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-LWW-MARABE-INTRODUCED-MULTI-AUTHORITY-REGISTERED-ABE","s":"lww25-multi-authority-rabe","title":"Multi-authority RABE","key":"LWW25","y":2025,"sub":"Introduces multi-authority registered ABE in which independently managed key curators jointly support cross-domain policies without retaining long-term issuer secrets; the pairing and iO branches have different user and "},{"t":"abe","k":"result","id":"ABE-RESULT-2025-HWW-ADAPTIVE-BE-SEMI-STATIC-TO-ADAPTIVE-BE-COMPILER","s":"hww25-plain-model-compiler-from","title":"Plain-model compiler from semi-static to adaptive broadcast encryption","key":"HWW25","y":2025,"sub":"A generic plain-model compiler combines semi-statically secure broadcast encryption with a publicly sampleable projective PRG to obtain adaptively secure broadcast encryption."},{"t":"abe","k":"result","id":"ABE-RESULT-2025-HWW-ADAPTIVE-BE-PUBLICLY-SAMPLEABLE-PROJECTIVE-PRG","s":"hww25-publicly-sampleable-projecti","title":"Publicly sampleable projective PRGs for adaptive broadcast encryption","key":"HWW25","y":2025,"sub":"Defines publicly sampleable projective PRGs and instantiates them from CDH, CBDH, LWE, and RSA-type assumptions; their projected seeds are succinct enough to drive the paper's semi-static-to-adaptive broadcast compiler."},{"t":"abe","k":"result","id":"ABE-RESULT-2025-WW-UNBOUNDED-RABE-UNBOUNDED-REGISTERED-ABE-FROM-SUCCINCT-LWE","s":"ww25-registered-abe-and-distribut","title":"Registered ABE and distributed broadcast for unbounded users from succinct LWE","key":"WW25","y":2025,"sub":"The paper constructs distributed broadcast encryption with \\( \\mathrm{poly}(\\lambda, \\log N) \\) public parameters, keys and ciphertexts for an unbounded number of users from succinct LWE (Theorem 4.4, selective security)"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-SB-LUT-RING-LWE-KP-ABE-FOR-NONLINEAR-OPERATIONS","s":"sb25-ring-lwe-kp-abe","title":"Ring-LWE KP-ABE for modulo-q nonlinear arithmetic","key":"SB25","y":2025,"sub":"The preprint applies direct lookup-table evaluation over BGG+ encodings to selectively secure Ring-LWE KP-ABE for modulo-q arithmetic circuits, reducing repeated decryption work through a base-dependent key-size tradeoff"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-KNP-SKL-COLLUSION-RESISTANT-ABE-SECURE-KEY-LEASING-FROM-LWE","s":"knp25-selective-abe-with-collusion","title":"Selective ABE with collusion-resistant secure key leasing from LWE","key":"KNP25","y":2025,"sub":"The preprint constructs selectively secure ABE with collusion-resistant secure key leasing from polynomially hard LWE, using quantum leased decryption keys; classical deletion certificates additionally require polynomial"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-WBWL-PE-SELECTIVE-FULLY-ATTRIBUTE-HIDING-BOUNDED-COLLUSION-CIRCUIT-PE","s":"wwlw25-selective-fully-attribute-hi","title":"Selective fully attribute-hiding circuit PE with bounded collusion","key":"WWLW25","y":2025,"sub":"Constructs lattice predicate encryption for polynomial-size bounded-depth circuits with selective fully attribute-hiding simulation security against a bounded number of colluding keys, with expansion linear in the collus"},{"t":"abe","k":"result","id":"ABE-RESULT-2025-CHW-RABE-REGISTERED-CIRCUIT-ABE","s":"chw25-registered-circuit-abe","title":"Registered circuit ABE","key":"CHW25","y":2025,"sub":"In the random-oracle model, succinct LWE yields attribute-selective registered KP-ABE for bounded-depth Boolean circuits whose ciphertext size is independent of attribute length and policy size, for an a-priori bounded u"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-CW-OPT-DMPE-ADAPTIVE-UNBOUNDED-BROADCAST","s":"cw26b-adaptive-unbounded-user-dist","title":"Adaptive unbounded-user distributed broadcast from decomposed LWE","key":"CW26b","y":2026,"sub":"In the plain model, the preprint specializes its techniques to adaptively secure distributed broadcast encryption for an a-priori unbounded user population with ciphertext size proportional to the two-thirds power of the"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-AMR-TREE-ENCODINGS-ADAPTIVE-DBE-IN-THE-PLAIN-MODEL","s":"amr26a-adaptively-secure-distribute","title":"Adaptively secure distributed broadcast in the plain model with polylogarithmic keys and ciphertexts","key":"AMR26a","y":2026,"sub":"From decomposed LWE, the preprint constructs an unbounded semi-statically secure flexible broadcast scheme with polylogarithmic parameters (Theorem 10) and, through the Hsieh--Waters--Wu compiler, adaptively secure distr"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-LZF-CONSTANT-CT-CONSTANT-SIZE-CIPHERTEXT-CP-ABE-FOR-NC1","s":"lzf26-constant-size-ciphertext-cp","title":"Constant-size ciphertext CP-ABE for NC1 from succinct LWE","key":"LZF26","y":2026,"sub":"The preprint constructs selectively secure lattice CP-ABE for NC1 from \\( \\mathrm{poly}(\\lambda) \\)-succinct LWE whose ciphertext size is independent of circuit size, input length, and depth up to hidden polynomial-in-se"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-AMR-DEPTH-UNBOUNDED-BOUNDED-SPACE-CP-ABE-FROM-DECOMPOSED-LWE","s":"amr26b-depth-unbounded-bounded-spac","title":"Depth-unbounded, bounded-space CP-ABE from decomposed LWE","key":"AMR26b","y":2026,"sub":"The preprint constructs selectively secure public-key ciphertext-policy ABE for Turing-machine policies with a space bound fixed at setup and no bound on running time or depth, secure against unbounded collusion under po"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-GY-EQUIVOCAL-BE-EQUIVOCAL-ENCRYPTION-SYSTEMS","s":"gy26b-equivocal-encryption-systems","title":"Equivocal encryption systems for adaptive lattice broadcast","key":"GY26b","y":2026,"sub":"Introduces equivocal encryption systems with indistinguishable real and fake modes that jointly sample fake keys and ciphertexts with trapdoors, allowing a challenge ciphertext to be explained later as an adaptively chos"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-GY-FBE-EQUIVOCAL-MATRIX-COMMITMENTS","s":"gy26a-equivocal-matrix-commitments","title":"Equivocal matrix commitments for dynamic broadcast systems","key":"GY26a","y":2026,"sub":"The preprint introduces equivocal matrix commitments that strengthen matrix commitments with fake-setup and adaptive equivocation capabilities, enabling the paper's flexible and identity-based broadcast compilers for unb"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-CWY-SILENT-THRESHOLD-LATTICE-SILENT-THRESHOLD-ENCRYPTION","s":"cwy26-lattice-silent-threshold-enc","title":"Lattice silent threshold encryption for super-constant thresholds","key":"CWY26","y":2026,"sub":"Under decomposed LWE in the random oracle model, the preprint constructs silent threshold encryption with transparent \\( \\mathrm{poly}(\\lambda, \\log N) \\) CRS and keys and ciphertexts of size \\( \\tilde O(T) + \\mathrm{pol"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-SWW-RABE-LINEAR-CRS-REGISTERED-ABE-FOR-MSPS","s":"sww26-linear-crs-registered-abe","title":"Linear-CRS registered ABE","key":"SWW26","y":2026,"sub":"Pairing-based registered ABE supports monotone span programs with a CRS linear in the user bound; static plain-model, adaptive ROM, and large-index stateless-key branches provide different and non-simultaneous security a"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-CW-OPT-DMPE-OPTIMAL-DNF-DMPE","s":"cw26b-optimal-dnf-dmpe-from","title":"Optimal DNF DMPE from decomposed LWE in ROM","key":"CW26b","y":2026,"sub":"In ROM, the preprint gives statically secure DNF distributed monotone-policy encryption from decomposed LWE whose public parameters, user keys, and ciphertext size are all independent of the DNF policy size."},{"t":"abe","k":"result","id":"ABE-RESULT-2026-GY-FBE-OPTIMAL-ADAPTIVE-FBE","s":"gy26a-optimal-adaptively-secure-fl","title":"Optimal adaptively secure flexible broadcast encryption","key":"GY26a","y":2026,"sub":"In ROM, the preprint constructs transparent-setup flexible broadcast encryption from decomposed LWE with adaptive security and all parameter sizes independent of the number of asynchronously registering users."},{"t":"abe","k":"result","id":"ABE-RESULT-2026-GY-FBE-OPTIMAL-ADAPTIVE-IBBE","s":"gy26a-optimal-adaptively-secure-id","title":"Optimal adaptively secure identity-based broadcast encryption","key":"GY26a","y":2026,"sub":"In ROM, the preprint constructs identity-based broadcast encryption from decomposed LWE with adaptive security and all parameter sizes independent of the number of users, for identities drawn from a super-polynomially la"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-GY-EQUIVOCAL-BE-OPTIMAL-ADAPTIVE-LATTICE-DBE","s":"gy26b-optimal-adaptively-secure-la","title":"Optimal adaptively secure lattice DBE","key":"GY26b","y":2026,"sub":"From a falsifiable lattice assumption, the paper constructs transparent-setup distributed broadcast encryption with adaptive security and parameter sizes independent of the user count, using either a succinct CRS in ROM "},{"t":"abe","k":"result","id":"ABE-RESULT-2026-CW-OPT-DMPE-PLAIN-MODEL-DMPE-TRADEOFFS","s":"cw26b-plain-model-k-dnf","title":"Plain-model k-DNF DMPE succinctness tradeoff","key":"CW26b","y":2026,"sub":"From decomposed LWE in the plain model, the preprint gives k-DNF DMPE with ciphertext size about k times the square root of the number of minterms, and a fully succinct branch only under a much weaker selective security "},{"t":"abe","k":"result","id":"ABE-RESULT-2026-WW-SILENT-PLAIN-MODEL-SILENT-THRESHOLD-CRYPTOGRAPHY-FOR-EXPRESSIVE-POLICIES","s":"ww26-plain-model-silent-threshold","title":"Plain-model silent threshold cryptography for expressive policies","key":"WW26","y":2026,"sub":"From pairing-based N-extended assumptions, the paper constructs plain-model silent threshold signatures and tag-based CCA-secure encryption for expressive access policies, with highlighted outputs of three and four group"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-GY-THRESHOLD-DMPE-STATIC-LATTICE-DMPE-FOR-THRESHOLDS","s":"gy26-statically-secure-lattice-dm","title":"Statically secure lattice DMPE for DNFs and threshold policies","key":"GY26","y":2026,"sub":"From decomposed LWE in the random oracle model, the preprint constructs statically secure distributed monotone-policy encryption for DNF policies with \\( \\mathrm{poly}(\\lambda, \\log N) \\) ciphertexts (Corollary 5.4) and "},{"t":"abe","k":"result","id":"ABE-RESULT-2026-CW-DMPE-SUCCINCT-DNF-DMPE-FROM-LATTICES","s":"cw26a-succinct-dnf-dmpe-from","title":"Succinct DNF DMPE from decomposed LWE","key":"CW26a","y":2026,"sub":"In ROM, decomposed LWE yields distributed monotone-policy encryption for DNF formulas with transparent setup, an unbounded user population, and ciphertext overhead polynomial in the security parameter and logarithm of th"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-AMYY-UNBOUNDED-DEPTH-ABE-FROM-DOUBLY-CIRCULAR-ASSUMPTION","s":"abm26-unbounded-depth-and-width","title":"Unbounded-depth and width ABE from a doubly circular assumption","key":"ABM+26","y":2026,"sub":"The preprint constructs ABE for unbounded-depth and unbounded-width circuits from a new doubly circular LWE and ElGamal-style assumption together with slotted-IPFE properties, and provides generic-group and restricted SX"},{"t":"abe","k":"result","id":"ABE-RESULT-2026-LZF-CONSTANT-CT-SUCCINCT-LWE-BROADCAST-ENCRYPTION","s":"lzf26-user-count-independent-broad","title":"User-count-independent broadcast ciphertexts from succinct LWE","key":"LZF26","y":2026,"sub":"Specializing the preprint's constant-ciphertext NC1 CP-ABE yields selectively secure lattice broadcast encryption from succinct LWE whose ciphertext size is independent of the number of users, while the CP-ABE public-par"},{"t":"abe","k":"assumption","id":"ASM-COMPOSITE-SD","s":"composite-sd","title":"Subgroup decision and related static assumptions in composite-order bilinear groups","key":null,"y":null,"sub":"Let \\( \\mathcal{G} \\) output \\( (N, \\mathbb{G}, \\mathbb{G}_T, e) \\) where \\( N = p_1 p_2 \\cdots p_n \\) is a product of distinct primes, \\( \\mathbb{G}, \\mathbb{G}_T \\) are cyclic of order \\( N \\), and \\( e : \\mathbb{G} \\t"},{"t":"abe","k":"assumption","id":"ASM-DBDH","s":"dbdh","title":"Decisional bilinear Diffie-Hellman (DBDH)","key":null,"y":null,"sub":"Let \\( e : \\mathbb{G} \\times \\mathbb{G} \\to \\mathbb{G}_T \\) be a symmetric bilinear map on groups of prime order \\( p \\) with generator \\( g \\)."},{"t":"abe","k":"assumption","id":"ASM-DLIN","s":"dlin","title":"Decision linear (DLIN)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} \\) be a cyclic group of prime order \\( p \\)."},{"t":"abe","k":"assumption","id":"ASM-EVASIVE-LWE","s":"evasive-lwe","title":"Evasive learning with errors (evasive LWE)","key":null,"y":null,"sub":"Let \\( B \\leftarrow \\mathbb{Z}_q^{n \\times m} \\) be uniform and let a sampler output a matrix \\( P \\in \\mathbb{Z}_q^{n \\times t} \\) and auxiliary input \\( \\mathsf{aux} \\)."},{"t":"abe","k":"assumption","id":"ASM-GGM","s":"ggm","title":"Generic group model (GGM), including the generic bilinear group model","key":null,"y":null,"sub":"In the generic group model a cyclic group of prime order \\( p \\) is accessed only through an oracle: group elements are represented by random labels (Shoup) or kept in a table the adversary cannot read (Maurer), and the "},{"t":"abe","k":"assumption","id":"ASM-KLIN","s":"klin","title":"k-linear assumption (k-Lin)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) have prime order \\( p \\) and write \\( [x] = g^{x} \\) (implicit notation)."},{"t":"abe","k":"assumption","id":"ASM-LWE","s":"lwe","title":"Learning with errors (LWE)","key":null,"y":null,"sub":"Fix a dimension \\( n \\), a modulus \\( q \\), a number of samples \\( m \\), and an error distribution \\( \\chi \\) over \\( \\mathbb{Z} \\), typically a discrete Gaussian of width \\( \\alpha q \\) with \\( \\alpha q > 2\\sqrt{n} \\)."},{"t":"abe","k":"assumption","id":"ASM-QBDHE","s":"qbdhe","title":"Decisional q-bilinear Diffie-Hellman exponent (q-BDHE)","key":null,"y":null,"sub":"Let \\( e : \\mathbb{G} \\times \\mathbb{G} \\to \\mathbb{G}_T \\) be a symmetric bilinear map on groups of prime order \\( p \\), let \\( g, h \\) be generators of \\( \\mathbb{G} \\), and write \\( g_i = g^{\\alpha^i} \\)."},{"t":"abe","k":"assumption","id":"ASM-QPBDHE","s":"qpbdhe","title":"Decisional q-parallel bilinear Diffie-Hellman exponent (q-parallel BDHE)","key":null,"y":null,"sub":"Let \\( e : \\mathbb{G} \\times \\mathbb{G} \\to \\mathbb{G}_T \\) be a symmetric bilinear map on groups of prime order \\( p \\) with generator \\( g \\)."},{"t":"abe","k":"assumption","id":"ASM-RLWE","s":"rlwe","title":"Ring learning with errors (Ring-LWE)","key":null,"y":null,"sub":"Let \\( K \\) be a number field of degree \\( n \\) with ring of integers \\( R \\) (the standard choice is the power-of-two cyclotomic ring \\( R = \\mathbb{Z}[x]/(x^n + 1) \\)), let \\( q \\) be a modulus and \\( R_q = R / qR \\)."},{"t":"abe","k":"assumption","id":"ASM-RW13-Q1","s":"rw13-q1","title":"Rouselakis–Waters q-1 assumption (q-1)","key":null,"y":null,"sub":"Let \\( (p, \\mathbb{G}, \\mathbb{G}_T, e) \\) be a symmetric bilinear group of prime order \\( p \\) with generator \\( g \\), and let \\( q \\) be a polynomial in the security parameter."},{"t":"abe","k":"assumption","id":"ASM-RW13-Q2","s":"rw13-q2","title":"Rouselakis–Waters q-2 assumption (q-2)","key":null,"y":null,"sub":"Let \\( (p, \\mathbb{G}, \\mathbb{G}_T, e) \\) be a symmetric bilinear group of prime order \\( p \\) with generator \\( g \\), and let \\( q \\) be a polynomial in the security parameter."},{"t":"abe","k":"assumption","id":"ASM-SUCCINCT-LWE","s":"succinct-lwe","title":"Succinct learning with errors (succinct LWE)","key":null,"y":null,"sub":"Fix \\( n, m, q \\), a number of blocks \\( \\ell \\) and a width \\( w \\)."},{"t":"he","k":"scheme","id":"he_paillier99","s":"he-paillier99","title":"Paillier additive homomorphic encryption","key":"Paillier99","y":1999,"sub":"Reference PHE row used to distinguish one-operation homomorphism from SHE, LHE, and FHE."},{"t":"he","k":"scheme","id":"he_gentry09","s":"he-gentry09","title":"Gentry ideal-lattice FHE","key":"Gentry09","y":2009,"sub":"Blueprint record rather than a recommended modern implementation."},{"t":"he","k":"scheme","id":"he_dghv10","s":"he-dghv10","title":"DGHV integer FHE","key":"DGHV10","y":2010,"sub":"Conceptually simple first-generation branch; retained for lineage rather than Pareto efficiency."},{"t":"he","k":"scheme","id":"he_bv11","s":"he-bv11","title":"Brakerski–Vaikuntanathan LWE FHE","key":"BV11","y":2011,"sub":"Key ancestor for BGV/BFV-style ciphertext dimension control."},{"t":"he","k":"scheme","id":"he_bfv12","s":"he-bfv12","title":"Fan–Vercauteren / BFV exact HE","key":"FV12","y":2012,"sub":"Standard exact-arithmetic counterpart to CKKS in many libraries."},{"t":"he","k":"scheme","id":"he_bgv12","s":"he-bgv12","title":"BGV leveled homomorphic encryption","key":"BGV12","y":2012,"sub":"Main exact packed leveled-HE reference family."},{"t":"he","k":"scheme","id":"he_scaleinv12","s":"he-scaleinv12","title":"Brakerski scale-invariant FHE","key":"Brakerski12","y":2012,"sub":"Alternative noise invariant showing that modulus switching is not conceptually necessary."},{"t":"he","k":"scheme","id":"he_gsw13","s":"he-gsw13","title":"GSW approximate-eigenvector FHE","key":"GSW13","y":2013,"sub":"Conceptual ancestor of RingGSW, FHEW, and TFHE external products."},{"t":"he","k":"scheme","id":"he_fhew15","s":"he-fhew15","title":"FHEW gate-bootstrapped FHE","key":"DM15","y":2015,"sub":"First widely cited subsecond gate-refresh point."},{"t":"he","k":"scheme","id":"he_tfhe16","s":"he-tfhe16","title":"TFHE fast gate bootstrapping","key":"CGGI16","y":2016,"sub":"Base TFHE record; circuit and programmable bootstrapping are tracked as later results."},{"t":"he","k":"scheme","id":"he_ckks17","s":"he-ckks17","title":"CKKS approximate leveled HE","key":"CKKS17","y":2017,"sub":"Base numerical HE record; returned precision is part of correctness."},{"t":"he","k":"scheme","id":"he_ckks_boot18","s":"he-ckks-boot18","title":"Bootstrapped CKKS","key":"CHKKS18a","y":2018,"sub":"First CKKS FHE refresh record; later high-precision and RNS works refine its cost and output quality."},{"t":"he","k":"scheme","id":"he_rns_ckks18","s":"he-rns-ckks18","title":"Full-RNS CKKS","key":"CHKKS18b","y":2018,"sub":"Implementation-oriented CKKS record separating the RNS representation advance from the first CKKS semantics."},{"t":"he","k":"problem","id":"HE-OP-001","s":"op-1","title":"Fully homomorphic encryption from LWE alone","key":null,"y":null,"sub":"Open problem · Can unbounded FHE, with keys independent of the circuit depth, be proved secure from LWE without assuming circular security? Every unbounded lattice scheme assumes its bootstrapping key is circularly secur"},{"t":"he","k":"problem","id":"HE-OP-002","s":"op-2","title":"Fully homomorphic encryption without lattices or bilinear maps","key":null,"y":null,"sub":"Open problem · Can FHE be built from assumptions that are neither lattice problems nor bilinear-map assumptions, for example sparse LPN with DDH or DCR? Without lattices or pairings only bounded-degree homomorphism is kn"},{"t":"he","k":"problem","id":"HE-OP-003","s":"op-3","title":"Compact multi-hop CCA1-secure FHE from LWE","key":null,"y":null,"sub":"Open problem · Is there FHE secure against non-adaptive chosen-ciphertext attacks whose outputs anyone can evaluate again, with ciphertexts that do not grow with the number of hops, from LWE in the standard model? Single"},{"t":"he","k":"problem","id":"HE-OP-007","s":"op-7","title":"Leveled FHE from LWE","key":null,"y":null,"sub":"Solved problem · Homomorphic encryption for circuits of any depth bound fixed at key generation, secure under LWE alone. Solved without bootstrapping or circular security."},{"t":"he","k":"problem","id":"HE-OP-008","s":"op-8","title":"Unbounded FHE from LWE and circular security","key":null,"y":null,"sub":"Solved problem · Unbounded FHE when the scheme may also assume that its own bootstrapping key is circularly secure. Solved by bootstrapping an LWE-based scheme."},{"t":"he","k":"problem","id":"HE-OP-009","s":"op-9","title":"Unbounded FHE without circular security from obfuscation","key":null,"y":null,"sub":"Solved problem · Unbounded FHE with no circular-security assumption, from sub-exponentially secure indistinguishability obfuscation and one-way functions with perfectly rerandomizable encryption such as ElGamal. Solved b"},{"t":"he","k":"problem","id":"HE-OP-010","s":"op-10","title":"FHE from LWE alone against uniform adversaries","key":null,"y":null,"sub":"Open problem · Unbounded FHE from LWE alone, without circular security, when security is required only against uniform adversaries, the model in which functional encryption already removes circular security."},{"t":"he","k":"problem","id":"HE-OP-011","s":"op-11","title":"FHE without circular security from functional encryption, uniform adversaries","key":null,"y":null,"sub":"Solved problem · Uniformly secure unbounded FHE from polynomially secure functional encryption and LWE, with no circular security and no sub-exponential hardness. Solved."},{"t":"he","k":"problem","id":"HE-OP-012","s":"op-12","title":"Circular security of a bootstrappable LWE scheme","key":null,"y":null,"sub":"Open problem · Prove from LWE that some bootstrappable scheme stays secure given an encryption of its own secret key. By the bootstrapping theorem this gives FHE from LWE alone."},{"t":"he","k":"problem","id":"HE-OP-013","s":"op-13","title":"Indistinguishability obfuscation from LWE","key":null,"y":null,"sub":"Open problem · Sub-exponentially secure indistinguishability obfuscation from LWE alone. With the obfuscation route to FHE, this gives FHE from LWE without circular security."},{"t":"he","k":"problem","id":"HE-OP-014","s":"op-14","title":"Polynomially secure functional encryption from LWE","key":null,"y":null,"sub":"Open problem · Polynomially secure semi-compact public-key functional encryption for all circuits from LWE. With the functional-encryption route, this gives uniformly secure FHE from LWE alone."},{"t":"he","k":"problem","id":"HE-OP-015","s":"op-15","title":"Somewhat homomorphic encryption without lattices or bilinear maps","key":null,"y":null,"sub":"Solved problem · Compact evaluation of polynomials of degree about \\( \\log \\lambda / \\log\\log \\lambda \\) from assumptions that use neither lattices nor bilinear maps. Solved from sparse LPN together with DDH or DCR."},{"t":"he","k":"problem","id":"HE-OP-016","s":"op-16","title":"Linearly homomorphic encryption without lattices or bilinear maps","key":null,"y":null,"sub":"Solved problem · Compact evaluation of linear functions only, from assumptions without lattices or bilinear maps. Solved by Paillier encryption under decisional composite residuosity."},{"t":"he","k":"problem","id":"HE-OP-017","s":"op-17","title":"Fully homomorphic encryption without lattices, bilinear maps allowed","key":null,"y":null,"sub":"Solved problem · FHE from assumptions without lattices when bilinear maps may be used. Solved through indistinguishability obfuscation from LPN over prime fields, DLIN, and \\( \\mathrm{NC}^0 \\) pseudorandom generators."},{"t":"he","k":"problem","id":"HE-OP-018","s":"op-18","title":"Bootstrappable somewhat homomorphic encryption without lattices or bilinear maps","key":null,"y":null,"sub":"Open problem · A scheme from such assumptions that correctly evaluates its own decryption circuit augmented by one NAND gate. By the bootstrapping theorem this gives leveled FHE without lattices or bilinear maps."},{"t":"he","k":"problem","id":"HE-OP-019","s":"op-19","title":"Single-hop CCA1-secure FHE from LWE","key":null,"y":null,"sub":"Solved problem · Compact CCA1-secure FHE whose evaluated ciphertexts need not be evaluated again, from circular-secure LWE in the standard model. Solved, with a notion stronger than CCA1."},{"t":"he","k":"problem","id":"HE-OP-020","s":"op-20","title":"Multi-hop CCA1-secure FHE from LWE with hop-linear ciphertexts","key":null,"y":null,"sub":"Solved problem · Multi-hop CCA1-secure FHE from LWE in the standard model when ciphertexts may grow linearly with the number of hops. Solved with mergeable succinct arguments."},{"t":"he","k":"problem","id":"HE-OP-021","s":"op-21","title":"Compact multi-hop CCA1-secure FHE from obfuscation","key":null,"y":null,"sub":"Solved problem · Multi-hop CCA1-secure FHE with ciphertexts independent of the number of hops, if sub-exponentially secure indistinguishability obfuscation is also assumed. Solved."},{"t":"he","k":"paper","id":"HE-PAPER-1978-RAD","s":"rad78","title":"On Data Banks and Privacy Homomorphisms","key":"RAD78","y":1978,"sub":"Ronald L. Rivest, Leonard Adleman, Michael L. Dertouzos · Foundations of Secure Computation"},{"t":"he","k":"paper","id":"HE-PAPER-1999-PAILLIER","s":"paillier99","title":"Public-Key Cryptosystems Based on Composite Degree Residuosity Classes","key":"Paillier99","y":1999,"sub":"Pascal Paillier · EUROCRYPT 1999"},{"t":"he","k":"paper","id":"HE-PAPER-2009-GENTRY","s":"gentry09","title":"Fully Homomorphic Encryption Using Ideal Lattices","key":"Gentry09","y":2009,"sub":"Craig Gentry · STOC 2009"},{"t":"he","k":"paper","id":"HE-PAPER-2010-DGHV","s":"dghv10","title":"Fully Homomorphic Encryption over the Integers","key":"DGHV10","y":2010,"sub":"Marten van Dijk, Craig Gentry, Shai Halevi, Vinod Vaikuntanathan · EUROCRYPT 2010"},{"t":"he","k":"paper","id":"HE-PAPER-2011-BV","s":"bv11","title":"Efficient Fully Homomorphic Encryption from (Standard) LWE","key":"BV11","y":2011,"sub":"Zvika Brakerski, Vinod Vaikuntanathan · FOCS 2011"},{"t":"he","k":"paper","id":"HE-PAPER-2012-BGV","s":"bgv12","title":"Fully Homomorphic Encryption without Bootstrapping","key":"BGV12","y":2012,"sub":"Zvika Brakerski, Craig Gentry, Vinod Vaikuntanathan · ITCS 2012"},{"t":"he","k":"paper","id":"HE-PAPER-2012-BRAKERSKI","s":"brakerski12","title":"Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP","key":"Brakerski12","y":2012,"sub":"Zvika Brakerski · CRYPTO 2012"},{"t":"he","k":"paper","id":"HE-PAPER-2012-FV","s":"fv12","title":"Somewhat Practical Fully Homomorphic Encryption","key":"FV12","y":2012,"sub":"Junfeng Fan, Frederik Vercauteren · IACR ePrint 2012/144"},{"t":"he","k":"paper","id":"HE-PAPER-2012-GHS-AES","s":"ghs12","title":"Homomorphic Evaluation of the AES Circuit","key":"GHS12","y":2012,"sub":"Craig Gentry, Shai Halevi, Nigel P. Smart · CRYPTO 2012"},{"t":"he","k":"paper","id":"HE-PAPER-2012-SV-SIMD","s":"sv12","title":"Fully Homomorphic SIMD Operations","key":"SV12","y":2012,"sub":"Nigel P. Smart, Frederik Vercauteren · Designs, Codes and Cryptography"},{"t":"he","k":"paper","id":"HE-PAPER-2013-GSW","s":"gsw13","title":"Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based","key":"GSW13","y":2013,"sub":"Craig Gentry, Amit Sahai, Brent Waters · CRYPTO 2013"},{"t":"he","k":"paper","id":"HE-PAPER-2015-CLTV","s":"cltv15","title":"Obfuscation of Probabilistic Circuits and Applications","key":"CLTV15","y":2015,"sub":"Ran Canetti, Huijia Lin, Stefano Tessaro, Vinod Vaikuntanathan · TCC 2015"},{"t":"he","k":"paper","id":"HE-PAPER-2015-FHEW","s":"dm15","title":"FHEW: Bootstrapping Homomorphic Encryption in Less Than a Second","key":"DM15","y":2015,"sub":"Léo Ducas, Daniele Micciancio · EUROCRYPT 2015"},{"t":"he","k":"paper","id":"HE-PAPER-2016-BDMW","s":"bdmw16","title":"FHE Circuit Privacy Almost For Free","key":"BDMW16","y":2016,"sub":"Florian Bourse, Rafaël Del Pino, Michele Minelli, Hoeteck Wee · CRYPTO 2016"},{"t":"he","k":"paper","id":"HE-PAPER-2016-DS","s":"ds16","title":"Sanitization of FHE Ciphertexts","key":"DS16","y":2016,"sub":"Léo Ducas, Damien Stehlé · EUROCRYPT 2016"},{"t":"he","k":"paper","id":"HE-PAPER-2016-PEIKERT-SURVEY","s":"peikert16","title":"A Decade of Lattice Cryptography","key":"Peikert16","y":2016,"sub":"Chris Peikert · Foundations and Trends in Theoretical Computer Science 10(4), 2016"},{"t":"he","k":"paper","id":"HE-PAPER-2016-TFHE","s":"cggi16","title":"Faster Fully Homomorphic Encryption: Bootstrapping in Less Than 0.1 Seconds","key":"CGGI16","y":2016,"sub":"Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, Malika Izabachène · ASIACRYPT 2016"},{"t":"he","k":"paper","id":"HE-PAPER-2017-CKKS","s":"ckks17","title":"Homomorphic Encryption for Arithmetic of Approximate Numbers","key":"CKKS17","y":2017,"sub":"Jung Hee Cheon, Andrey Kim, Miran Kim, Yongsoo Song · ASIACRYPT 2017"},{"t":"he","k":"paper","id":"HE-PAPER-2017-GKW","s":"gkw17","title":"Separating Semantic and Circular Security for Symmetric-Key Bit Encryption from the Learning with Errors Assumption","key":"GKW17","y":2017,"sub":"Rishab Goyal, Venkata Koppula, Brent Waters · EUROCRYPT 2017"},{"t":"he","k":"paper","id":"HE-PAPER-2017-HALEVI-SURVEY","s":"halevi17","title":"Homomorphic Encryption","key":"Halevi17","y":2017,"sub":"Shai Halevi · Tutorials on the Foundations of Cryptography (Y. Lindell, ed.), Springer, 2017"},{"t":"he","k":"paper","id":"HE-PAPER-2017-TFHE-CB","s":"cggi17","title":"Faster Packed Homomorphic Operations and Efficient Circuit Bootstrapping for TFHE","key":"CGGI17","y":2017,"sub":"Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, Malika Izabachène · ASIACRYPT 2017"},{"t":"he","k":"paper","id":"HE-PAPER-2018-BRAKERSKI-SURVEY","s":"brakerski18","title":"Fundamentals of Fully Homomorphic Encryption – A Survey","key":"Brakerski18","y":2018,"sub":"Zvika Brakerski · Electronic Colloquium on Computational Complexity, TR18-125 (2018)"},{"t":"he","k":"paper","id":"HE-PAPER-2018-CKKS-BOOT","s":"chkks18a","title":"Bootstrapping for Approximate Homomorphic Encryption","key":"CHKKS18a","y":2018,"sub":"Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, Yongsoo Song · EUROCRYPT 2018"},{"t":"he","k":"paper","id":"HE-PAPER-2018-RNS-CKKS","s":"chkks18b","title":"A Full RNS Variant of Approximate Homomorphic Encryption","key":"CHKKS18b","y":2018,"sub":"Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, Yongsoo Song · SAC 2018"},{"t":"he","k":"paper","id":"HE-PAPER-2020-HP-CKKS","s":"llk20","title":"High-Precision Bootstrapping for Approximate Homomorphic Encryption by Error Variance Minimization","key":"LLK+20","y":2020,"sub":"Yongwoo Lee, Joon-Woo Lee, Young-Sik Kim, Yongjune Kim, Jong-Seon No, HyungChul Kang · EUROCRYPT 2022"},{"t":"he","k":"paper","id":"HE-PAPER-2021-HJL","s":"hjl21","title":"Counterexamples to New Circular Security Assumptions Underlying iO","key":"HJL21","y":2021,"sub":"Sam Hopkins, Aayush Jain, Huijia Lin · CRYPTO 2021"},{"t":"he","k":"paper","id":"HE-PAPER-2021-LM","s":"lm21","title":"On the Security of Homomorphic Encryption on Approximate Numbers","key":"LM21","y":2021,"sub":"Baiyu Li, Daniele Micciancio · EUROCRYPT 2021 (LNCS 12696, pp. 648-677)"},{"t":"he","k":"paper","id":"HE-PAPER-2022-BI","s":"bi22","title":"Plug-and-play sanitization for TFHE","key":"BI22","y":2022,"sub":"Florian Bourse, Malika Izabachène · IACR ePrint 2022/1438"},{"t":"he","k":"paper","id":"HE-PAPER-2022-JLS","s":"jls22","title":"Indistinguishability Obfuscation from LPN over \\( \\mathbb{F}_p \\), DLIN, and PRGs in \\( \\mathrm{NC}^0 \\)","key":"JLS22","y":2022,"sub":"Aayush Jain, Huijia Lin, Amit Sahai · EUROCRYPT 2022"},{"t":"he","k":"paper","id":"HE-PAPER-2022-KLUCZNIAK","s":"kluczniak22","title":"Circuit Privacy for FHEW/TFHE-Style Fully Homomorphic Encryption in Practice","key":"Kluczniak22","y":2022,"sub":"Kamil Kluczniak · IACR ePrint 2022/1459"},{"t":"he","k":"paper","id":"HE-PAPER-2022-LMSS","s":"lmss22","title":"Securing Approximate Homomorphic Encryption Using Differential Privacy","key":"LMSS22","y":2022,"sub":"Baiyu Li, Daniele Micciancio, Mark Schultz, Jessica Sorrell · CRYPTO 2022 (LNCS, pp. 560-589)"},{"t":"he","k":"paper","id":"HE-PAPER-2023-ADG","s":"adg23","title":"Somewhat Homomorphic Encryption based on Random Codes","key":"ADG23","y":2023,"sub":"Carlos Aguilar-Melchor, Victor Dyseryn, Philippe Gaborit · IACR ePrint 2023/1798 (preprint)"},{"t":"he","k":"paper","id":"HE-PAPER-2023-BS","s":"bs23","title":"Bootstrapping Homomorphic Encryption via Functional Encryption","key":"BS23","y":2023,"sub":"Nir Bitansky, Tomer Solomon · ITCS 2023 (LIPIcs 251, 17:1-17:23)"},{"t":"he","k":"paper","id":"HE-PAPER-2023-OF","s":"of23","title":"SoK: Towards CCA Secure Fully Homomorphic Encryption","key":"OF23","y":2023,"sub":"Hiroki Okada, Kazuhide Fukushima · SECRYPT 2023, pages 793-798"},{"t":"he","k":"paper","id":"HE-PAPER-2024-CCPSS","s":"ccpss24","title":"Attacks Against the INDCPA-D Security of Exact FHE Schemes","key":"CCPSS24","y":2024,"sub":"Jung Hee Cheon, Hyeongmin Choe, Alain Passelègue, Damien Stehlé, Elias Suvanto · ACM CCS 2024"},{"t":"he","k":"paper","id":"HE-PAPER-2024-GNSJ","s":"gnsj24","title":"Key Recovery Attacks on Approximate Homomorphic Encryption with Non-Worst-Case Noise Flooding Countermeasures","key":"GNSJ24","y":2024,"sub":"Qian Guo, Denis Nabokov, Elias Suvanto, Thomas Johansson · USENIX Security 2024"},{"t":"he","k":"paper","id":"HE-PAPER-2024-TFHE-PROCESSOR","s":"tcbsy24","title":"Designing a General-Purpose 8-bit (T)FHE Processor Abstraction","key":"TCBSY24","y":2024,"sub":"Daphné Trama, Pierre-Emmanuel Clet, Aymen Boudguiga, Renaud Sirdey, Nicolas Ye · TCHES 2025"},{"t":"he","k":"paper","id":"HE-PAPER-2025-BCMNT","s":"bcmnt25","title":"Accurate and Composable Noise Estimates for CKKS with Application to Exact HE Computation","key":"BCMNT25","y":2025,"sub":"Jean-Philippe Bossuat, Anamaria Costache, Christian Mouchet, Lea Nürnberger, Juan Ramón Troncoso-Pastoriza · IACR Communications in Cryptology 2025"},{"t":"he","k":"paper","id":"HE-PAPER-2025-CHKV","s":"chkv25","title":"Somewhat Homomorphic Encryption from Linear Homomorphism and Sparse LPN","key":"CHKV25","y":2025,"sub":"Henry Corrigan-Gibbs, Alexandra Henzinger, Yael Tauman Kalai, Vinod Vaikuntanathan · EUROCRYPT 2025"},{"t":"he","k":"paper","id":"HE-PAPER-2025-HMS-BFV","s":"hms25","title":"Ciphertext-Simulatable HE from BFV with Randomized Evaluation","key":"HMS25","y":2025,"sub":"Intak Hwang, Seonhong Min, Yongsoo Song · IACR ePrint 2025/203 (preprint)"},{"t":"he","k":"paper","id":"HE-PAPER-2025-HMSS","s":"hmss25","title":"Practical TFHE Ciphertext Sanitization for Oblivious Circuit Evaluation","key":"HMSS25","y":2025,"sub":"Intak Hwang, Seonhong Min, Jinyeong Seo, Yongsoo Song · ACM CCS 2025"},{"t":"he","k":"paper","id":"HE-PAPER-2025-KS","s":"ks25","title":"On Circuit Private, Multikey and Threshold Approximate Homomorphic Encryption","key":"KS25","y":2025,"sub":"Kamil Kluczniak, Giacomo Santato · IACR Communications in Cryptology 2(1), 2025"},{"t":"he","k":"paper","id":"HE-PAPER-2025-OGILVIE","s":"ogilvie25","title":"IND-CPA-D and KR-D Security With Reduced Noise from the HintLWE Problem","key":"Ogilvie25","y":2025,"sub":"Tabitha Ogilvie · ASIACRYPT 2025"},{"t":"he","k":"paper","id":"HE-PAPER-2025-YYS","s":"yys25","title":"Fully Homomorphic Encryption with Chosen-Ciphertext Security from LWE","key":"YYS25","y":2025,"sub":"Rupeng Yang, Zuoxia Yu, Willy Susilo · CRYPTO 2025"},{"t":"he","k":"paper","id":"HE-PAPER-2026-ABMP","s":"abmp26","title":"Application-Aware Approximate Homomorphic Encryption: Configuring FHE for Practical Use","key":"ABMP26","y":2026,"sub":"Andreea Alexandru, Ahmad Al Badawi, Daniele Micciancio, Yuriy Polyakov · IACR Communications in Cryptology 2026"},{"t":"he","k":"paper","id":"HE-PAPER-2026-BBPS","s":"bbps26","title":"Mergeable SNARGs for Trapdoor Languages and Their Applications","key":"BBPS26","y":2026,"sub":"Zvika Brakerski, Maya Farber Brodsky, Omer Paneth, Tomer Solomon · IACR ePrint 2026/678 (preprint)"},{"t":"he","k":"result","id":"HE-RESULT-1978-RAD-INTRODUCED-PRIVACY-HOMOMORPHISM-PROGRAM","s":"rad78-privacy-homomorphisms","title":"Privacy homomorphisms","key":"RAD78","y":1978,"sub":"Rivest, Adleman, and Dertouzos formulate encrypted data processing as privacy homomorphisms that permit selected operations without exposing plaintexts."},{"t":"he","k":"result","id":"HE-RESULT-1999-PAILLIER-PRACTICAL-ADDITIVELY-HOMOMORPHIC-PUBLIC-KEY-ENCRYPTION","s":"paillier99-unbounded-plaintext-addition","title":"Unbounded plaintext addition in a public-key encryption scheme","key":"Paillier99","y":1999,"sub":"Paillier encryption lets ciphertext multiplication realize addition of plaintexts, giving an efficient public-key scheme with an unbounded additive homomorphism."},{"t":"he","k":"result","id":"HE-RESULT-2009-GENTRY-FIRST-FULLY-HOMOMORPHIC-ENCRYPTION","s":"gentry09-first-fhe","title":"First FHE","key":"Gentry09","y":2009,"sub":"Gentry constructs the first fully homomorphic encryption scheme, enabling evaluation of arbitrary circuits by combining an ideal-lattice somewhat homomorphic scheme with bootstrapping."},{"t":"he","k":"result","id":"HE-RESULT-2009-GENTRY-INTRODUCED-BOOTSTRAPPING-BLUEPRINT","s":"gentry09-bootstrapping-blueprint","title":"Bootstrapping blueprint","key":"Gentry09","y":2009,"sub":"A scheme that can homomorphically evaluate a suitable augmented form of its own decryption circuit can refresh noisy ciphertexts and be promoted from bounded-depth homomorphism to FHE."},{"t":"he","k":"result","id":"HE-RESULT-2010-DGHV-CONCEPTUALLY-SIMPLE-INTEGER-FHE-FROM-AGCD","s":"dghv10-integer-fhe","title":"Integer FHE","key":"DGHV10","y":2010,"sub":"DGHV builds a somewhat homomorphic scheme over the integers, whose ciphertexts are near-multiples of a secret odd integer and whose security reduces to approximate GCD, and turns it into FHE by squashing its decryption c"},{"t":"he","k":"result","id":"HE-RESULT-2011-BV-DIMENSION-MODULUS-REDUCTION-WITHOUT-SQUASHING","s":"bv11-dimension-modulus-reduction","title":"Dimension–modulus reduction","key":"BV11","y":2011,"sub":"BV's dimension-modulus reduction converts an evaluated LWE ciphertext with long dimension n and modulus q into one with short dimension k and modulus p, so the decryption circuit has depth \\( O(\\log k + \\log\\log p) \\) an"},{"t":"he","k":"result","id":"HE-RESULT-2011-BV-LWE-SHE-WITH-RELINEARIZATION","s":"bv11-lwe-she-relinearization","title":"LWE SHE + relinearization","key":"BV11","y":2011,"sub":"Brakerski and Vaikuntanathan construct LWE-based somewhat homomorphic encryption and use relinearization to return post-multiplication ciphertexts to a controlled dimension."},{"t":"he","k":"result","id":"HE-RESULT-2012-BGV-LEVELED-FHE-WITHOUT-BOOTSTRAPPING","s":"bgv12-predetermined-depth-fhe","title":"Predetermined-depth FHE","key":"BGV12","y":2012,"sub":"BGV evaluates any predetermined polynomial-size circuit without bootstrapping by selecting a depth-dependent modulus chain, at per-gate computation \\( \\tilde O(\\lambda \\cdot L^3) \\) for RLWE where previous FHE schemes al"},{"t":"he","k":"result","id":"HE-RESULT-2012-BGV-MODULUS-SWITCHING-NOISE-MANAGEMENT","s":"bgv12-iterated-modulus-switching","title":"Iterated modulus switching","key":"BGV12","y":2012,"sub":"BGV applies the preceding BV modulus-switching technique iteratively, moving ciphertexts through a decreasing modulus chain so multiplication noise is rescaled at each level of a predetermined-depth computation."},{"t":"he","k":"result","id":"HE-RESULT-2012-BRAKERSKI-SCALE-INVARIANT-FHE-WITH-LINEAR-NOISE-GROWTH","s":"brakerski12-scale-invariant-fhe","title":"Scale-invariant FHE","key":"Brakerski12","y":2012,"sub":"Brakerski's scale-invariant tensoring multiplies the ciphertext noise by a polynomial factor per multiplication instead of squaring it, giving an LWE scheme that uses one modulus of any form, needs no modulus switching, "},{"t":"he","k":"result","id":"HE-RESULT-2012-FV-RLWE-EXACT-ARITHMETIC-SCHEME-WITH-RELINEARIZATION","s":"fv12-bfv-exact-arithmetic","title":"BFV exact arithmetic","key":"FV12","y":2012,"sub":"Fan and Vercauteren port Brakerski's scale-invariant scheme to RLWE with plaintext ring \\( R_t \\). The result is a somewhat homomorphic scheme for exact modular arithmetic whose relinearised multiplication comes in two v"},{"t":"he","k":"result","id":"HE-RESULT-2012-GHS-AES-END-TO-END-EVALUATION-OF-AES-WITH-PACKED-LHE","s":"ghs12-packed-aes-evaluation","title":"Packed AES evaluation","key":"GHS12","y":2012,"sub":"Gentry, Halevi, and Smart combine packed leveled HE, CRT representation, key switching, and circuit planning to carry out an end-to-end homomorphic AES evaluation."},{"t":"he","k":"result","id":"HE-RESULT-2012-SV-SIMD-CIPHERTEXT-SLOT-PACKING-AND-PARALLEL-RECRYPTION","s":"sv12-simd-slot-packing","title":"SIMD slot packing","key":"SV12","y":2012,"sub":"Smart and Vercauteren select plaintext-ring parameters that encode many field elements as slots, evaluate one circuit across them, and use the SIMD structure to parallelize recryption."},{"t":"he","k":"result","id":"HE-RESULT-2013-GSW-APPROXIMATE-EIGENVECTOR-GSW-CIPHERTEXTS","s":"gsw13-approximate-eigenvector-ciph","title":"Approximate-eigenvector ciphertexts","key":"GSW13","y":2013,"sub":"GSW represents LWE ciphertexts as matrices for which the secret key is an approximate eigenvector, so homomorphic addition and multiplication are essentially matrix addition and multiplication and, without bootstrapping,"},{"t":"he","k":"result","id":"HE-RESULT-2013-GSW-MULTIPLICATION-WITHOUT-RELINEARIZATION","s":"gsw13-ciphertext-multiplication-wi","title":"Ciphertext multiplication without post-product relinearization","key":"GSW13","y":2013,"sub":"The GSW approximate-eigenvector invariant lets homomorphic multiplication stay in the same matrix ciphertext form without the post-product relinearization step used by BV-style schemes."},{"t":"he","k":"result","id":"HE-RESULT-2012-GHS-AES-REALIZED-PACKED-BGV-AES-PROTOTYPE","s":"ghs12-paper-described-packed-bgv","title":"Paper-described packed-BGV AES prototype","key":"GHS12","y":2015,"sub":"The paper realizes its packed leveled-HE AES pipeline in a research prototype combining CRT representation, SIMD slots, key switching, and circuit-specific modulus planning."},{"t":"he","k":"result","id":"HE-RESULT-2015-FHEW-REALIZED-FHEW-GATE-BOOTSTRAP-PROTOTYPE","s":"dm15-fhew-reference-prototype-for","title":"FHEW reference prototype for bootstrapped binary gates","key":"DM15","y":2015,"sub":"The FHEW research prototype realizes the paper's LWE/GSW-style gate-refresh path used for its reported subsecond binary operation."},{"t":"he","k":"result","id":"HE-RESULT-2015-FHEW-SUBSECOND-SINGLE-GATE-BOOTSTRAPPING","s":"dm15-sub-second-fhew-gate","title":"Sub-second FHEW gate bootstrap","key":"DM15","y":2015,"sub":"FHEW computes a binary gate homomorphically and refreshes the result in less than a second on a personal computer, measured at 0.69 seconds on one 3 GHz core, where bootstrapping in HElib took about six minutes per batch"},{"t":"he","k":"result","id":"HE-RESULT-2016-TFHE-EXTERNAL-PRODUCT-TFHE-BOOTSTRAPPING","s":"cggi16-tfhe-external-product","title":"TFHE external product","key":"CGGI16","y":2016,"sub":"TFHE reformulates the FHEW refresh path around an external product between LWE and RingGSW-style ciphertexts, changing both the bootstrap kernel and evaluation-key profile."},{"t":"he","k":"result","id":"HE-RESULT-2016-TFHE-REALIZED-TFHE-EXTERNAL-PRODUCT-PROTOTYPE","s":"cggi16-tfhe-prototype-for-the","title":"TFHE prototype for the external-product bootstrap kernel","key":"CGGI16","y":2016,"sub":"The TFHE prototype realizes the LWE–RingGSW external-product kernel used in the paper's sub-tenth-second gate-refresh measurement."},{"t":"he","k":"result","id":"HE-RESULT-2016-TFHE-SUB-TENTH-SECOND-GATE-REFRESH","s":"cggi16-reported-sub-0-1","title":"Reported sub-0.1-second TFHE gate refresh","key":"CGGI16","y":2016,"sub":"The TFHE prototype reports bootstrapping below 0.1 seconds for its single-gate refresh setting while reducing the evaluation-key size relative to the cited FHEW point."},{"t":"he","k":"result","id":"HE-RESULT-2017-CKKS-APPROXIMATE-ARITHMETIC-WITH-RESCALING","s":"ckks17-approximate-arithmetic-resca","title":"Approximate arithmetic + rescaling","key":"CKKS17","y":2017,"sub":"CKKS encodes approximate real or complex values in packed RLWE ciphertexts and rescales ciphertext modulus and plaintext scale together after multiplication, losing at most one more bit of precision than unencrypted appr"},{"t":"he","k":"result","id":"HE-RESULT-2017-TFHE-CB-TFHE-CIRCUIT-BOOTSTRAPPING-AND-PACKED-OPERATIONS","s":"cggi17-lwe-ringgsw-circuit-bootstra","title":"LWE→RingGSW circuit bootstrap","key":"CGGI17","y":2017,"sub":"The TFHE follow-up gives a circuit-bootstrap procedure that converts an encrypted bit in an LWE ciphertext into a low-noise RingGSW ciphertext reusable as input to leveled homomorphic circuits, in 137 milliseconds where "},{"t":"he","k":"result","id":"HE-RESULT-2017-TFHE-CB-TFHE-PACKED-LEVELED-OPERATIONS","s":"cggi17-packed-tfhe-lookup-automata","title":"Packed TFHE lookup/automata circuits","key":"CGGI17","y":2017,"sub":"The paper packs several values into each TRLWE ciphertext of TFHE's leveled mode: horizontal and vertical packing speed up lookup tables and cut the ciphertext expansion factor from between 64000 and 384000 to almost 64,"},{"t":"he","k":"result","id":"HE-RESULT-2018-CKKS-BOOT-FIRST-CKKS-BOOTSTRAPPING-VIA-APPROXIMATE-MODULAR-REDUCTION","s":"chkks18a-ckks-bootstrapping","title":"CKKS bootstrapping","key":"CHKKS18a","y":2018,"sub":"Cheon et al. extend leveled CKKS to FHE by homomorphically approximating the modular-reduction step of decryption in the native packed approximate representation."},{"t":"he","k":"result","id":"HE-RESULT-2018-CKKS-BOOT-REALIZED-PACKED-CKKS-REFRESH-PROTOTYPE","s":"chkks18a-prototype-for-packed-ckks","title":"Prototype for packed CKKS refresh in the native approximate representation","key":"CHKKS18a","y":2018,"sub":"The paper-described CKKS prototype realizes coefficient/slot transforms and approximate modular reduction for refreshing packed approximate ciphertexts."},{"t":"he","k":"result","id":"HE-RESULT-2018-RNS-CKKS-FULL-RNS-CKKS-WITH-WORD-SIZE-ARITHMETIC","s":"chkks18b-word-size-rns-ckks","title":"Word-size RNS CKKS","key":"CHKKS18b","y":2018,"sub":"The full-RNS CKKS variant performs core polynomial arithmetic and approximate modulus switching entirely with residue-number-system and NTT-friendly word-size operations."},{"t":"he","k":"result","id":"HE-RESULT-2018-RNS-CKKS-REALIZED-FULL-RNS-CKKS-WORD-KERNELS","s":"chkks18b-implementation-pattern-for-f","title":"Implementation pattern for full-RNS CKKS word-size kernels","key":"CHKKS18b","y":2018,"sub":"The full-RNS CKKS work realizes approximate HE operations through RNS and NTT-friendly machine-word kernels rather than multiprecision core arithmetic."},{"t":"he","k":"result","id":"HE-RESULT-2020-HP-CKKS-DIRECT-MODULAR-REDUCTION-APPROXIMATION-FOR-HIGH-PRECISION-CKKS-BOOTSTRAP","s":"llk20-higher-precision-ckks-refres","title":"Higher-precision CKKS refresh","key":"LLK+20","y":2020,"sub":"Lee et al. design a direct polynomial approximation of modular reduction for CKKS bootstrapping that is optimal in error variance and depth, with a lazy baby-step giant-step algorithm to evaluate it; at about 31-bit prec"},{"t":"he","k":"result","id":"HE-RESULT-2024-TFHE-PROCESSOR-GENERAL-PURPOSE-EIGHT-BIT-PROCESSOR-FROM-PROGRAMMABLE-BOOTSTRAPPING","s":"tcbsy24-encrypted-8-bit-processor","title":"Encrypted 8-bit processor","key":"TCBSY24","y":2024,"sub":"Trama et al. represent an encrypted byte as two basis-16 digits and organize programmable lookup and key-switching patterns into more than fifty reusable 8-bit instructions."},{"t":"he","k":"result","id":"HE-RESULT-2024-TFHE-PROCESSOR-REALIZED-ENCRYPTED-EIGHT-BIT-PROCESSOR-PROTOTYPE","s":"tcbsy24-prototype-realizing-the-encr","title":"Prototype realizing the encrypted 8-bit TFHE instruction set","key":"TCBSY24","y":2024,"sub":"The paper-described processor prototype implements its programmable-bootstrap-based 8-bit instructions and evaluates instruction- and program-level workloads."},{"t":"he","k":"assumption","id":"ASM-AGCD","s":"agcd","title":"Approximate greatest common divisor (AGCD)","key":null,"y":null,"sub":"Fix bit lengths \\( \\eta \\) (secret), \\( \\rho \\) (noise) and \\( \\gamma \\) (samples) with \\( \\rho < \\eta < \\gamma \\)."},{"t":"he","k":"assumption","id":"ASM-CIRCULAR-SECURITY","s":"circular-security","title":"Circular security (key-dependent message security for key cycles)","key":null,"y":null,"sub":"Let \\( (\\mathsf{Gen}, \\mathsf{Enc}, \\mathsf{Dec}) \\) be a public-key encryption scheme and let \\( (pk_i, sk_i) \\leftarrow \\mathsf{Gen} \\) for \\( i = 1, \\dots, n \\)."},{"t":"he","k":"assumption","id":"ASM-DCR","s":"dcr","title":"Decisional composite residuosity (DCR)","key":null,"y":null,"sub":"Let \\( N = pq \\) be an RSA modulus."},{"t":"he","k":"assumption","id":"ASM-GAPSVP","s":"gapsvp","title":"Worst-case approximate lattice problems (GapSVP and SIVP)","key":null,"y":null,"sub":"Let \\( \\mathcal{L} \\subset \\mathbb{R}^n \\) be a lattice given by a basis, let \\( \\lambda_1(\\mathcal{L}) \\) be the length of a shortest nonzero vector and \\( \\lambda_n(\\mathcal{L}) \\) the smallest \\( r \\) such that \\( \\ma"},{"t":"he","k":"assumption","id":"ASM-IDEAL-SVP","s":"ideal-svp","title":"Worst-case approximate SVP on ideal lattices (Ideal-SVP)","key":null,"y":null,"sub":"Let \\( K \\) be a number field of degree \\( n \\) with ring of integers \\( \\mathcal{O}_K \\), embedded in \\( \\mathbb{R}^n \\) by the canonical (or coefficient) embedding."},{"t":"he","k":"assumption","id":"ASM-LWE","s":"lwe","title":"Learning with errors (LWE)","key":null,"y":null,"sub":"Fix a dimension \\( n \\), a modulus \\( q \\), a number of samples \\( m \\), and an error distribution \\( \\chi \\) over \\( \\mathbb{Z} \\), typically a discrete Gaussian of width \\( \\alpha q \\) with \\( \\alpha q > 2\\sqrt{n} \\)."},{"t":"he","k":"assumption","id":"ASM-RLWE","s":"rlwe","title":"Ring learning with errors (Ring-LWE)","key":null,"y":null,"sub":"Let \\( K \\) be a number field of degree \\( n \\) with ring of integers \\( R \\) (the standard choice is the power-of-two cyclotomic ring \\( R = \\mathbb{Z}[x]/(x^n + 1) \\)), let \\( q \\) be a modulus and \\( R_q = R / qR \\)."},{"t":"he","k":"assumption","id":"ASM-SSSP","s":"sssp","title":"Sparse subset sum problem (SSSP)","key":null,"y":null,"sub":"Given a set of \\( \\Theta \\) rational numbers (or integers modulo \\( M \\)) \\( a_1, \\dots, a_\\Theta \\) and a target \\( t \\), decide whether (or find) a subset \\( S \\) of small size \\( |S| = \\theta \\ll \\Theta \\) with \\[ \\su"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-1982-YAO-2PC","s":"yao82-two-party-sfe","title":"Two-party SFE","key":"Yao82","y":1982,"sub":"Yao formulates and gives protocols for two parties to compute functions of private inputs while limiting what each party learns, establishing secure two-party computation as a general cryptographic task."},{"t":"mpc","k":"paper","id":"MPC-PAPER-1982-YAO","s":"yao82","title":"Protocols for Secure Computations","key":"Yao82","y":1982,"sub":"Andrew C. Yao · FOCS 1982"},{"t":"mpc","k":"paper","id":"MPC-PAPER-1986-CLEVE","s":"cleve86","title":"Limits on the Security of Coin Flips when Half the Processors Are Faulty","key":"Cleve86","y":1986,"sub":"Richard Cleve · STOC 1986"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-1987-GMW-COMPILER","s":"gmw87-general-mpc-compiler","title":"General MPC compiler","key":"GMW87","y":1987,"sub":"Goldreich, Micali, and Wigderson give a general circuit-based method for secure multiparty computation and separate passive evaluation from compilation techniques that enforce security against stronger adversarial behavi"},{"t":"mpc","k":"paper","id":"MPC-PAPER-1987-GMW","s":"gmw87","title":"How to Play ANY Mental Game","key":"GMW87","y":1987,"sub":"Oded Goldreich, Silvio Micali, Avi Wigderson · STOC 1987"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-1988-BGW-THRESHOLDS","s":"bgw88-mpc-threshold-frontier","title":"MPC threshold frontier","key":"BGW88","y":1988,"sub":"BGW establishes unconditional general MPC over private channels for passive corruption below one half and Byzantine corruption below one third, together with matching threshold limitations in its model."},{"t":"mpc","k":"paper","id":"MPC-PAPER-1988-BGW","s":"bgw88","title":"Completeness Theorems for Non-Cryptographic Fault-Tolerant Distributed Computation","key":"BGW88","y":1988,"sub":"Michael Ben-Or, Shafi Goldwasser, Avi Wigderson · STOC 1988"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-BGW-ACTIVE","s":"bgw-active-mpc","title":"BGW active MPC","key":null,"y":1988,"sub":"Private channels and broadcast are part of this row's model; removing or emulating them changes the construction."},{"t":"mpc","k":"result","id":"MPC-CONTRIB-1990-BMR-CONSTANT","s":"bmr90-constant-round-bmr","title":"Constant-round BMR","key":"BMR90","y":1990,"sub":"Beaver, Micali, and Rogaway construct constant-round multiparty computation by distributing garbled-circuit preparation so that the online interaction does not grow with circuit depth."},{"t":"mpc","k":"paper","id":"MPC-PAPER-1990-BMR","s":"bmr90","title":"The Round Complexity of Secure Protocols","key":"BMR90","y":1990,"sub":"Donald Beaver, Silvio Micali, Phillip Rogaway · STOC 1990"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-BMR-PASSIVE","s":"bmr-passive-mpc","title":"BMR passive MPC","key":null,"y":1990,"sub":"The original mechanism establishes the constant-round line; BMR+SPDZ changes its enforcement and preprocessing layers."},{"t":"mpc","k":"result","id":"MPC-CONTRIB-1991-BEAVER-TRIPLES","s":"beaver91-beaver-triples","title":"Beaver triples","key":"Beaver91","y":1991,"sub":"Beaver's circuit-randomization method uses input-independent correlated multiplication values so arithmetic products can be opened and completed online with lightweight interaction once the correlations are available."},{"t":"mpc","k":"paper","id":"MPC-PAPER-1991-BEAVER","s":"beaver91","title":"Efficient Multiparty Protocols Using Circuit Randomization","key":"Beaver91","y":1991,"sub":"Donald Beaver · CRYPTO 1991"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-1993-ASYNC-FEASIBILITY","s":"bcg93-asynchronous-mpc","title":"Asynchronous MPC","key":"BCG93","y":1993,"sub":"Ben-Or, Canetti, and Goldreich establish general secure computation in a completely asynchronous private-channel network with optimal resilience below one third for fail-stop faults and below one fourth for Byzantine fau"},{"t":"mpc","k":"paper","id":"MPC-PAPER-1993-ASYNC","s":"bcg93","title":"Asynchronous Secure Computation","key":"BCG93","y":1993,"sub":"Michael Ben-Or, Ran Canetti, Oded Goldreich · STOC 1993"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-1995-PROACTIVE-REFRESH","s":"hjky95-periodic-share-refresh-preve","title":"Periodic share refresh prevents mobile corruptions from accumulating secrets","key":"HJKY95","y":1995,"sub":"Proactive secret sharing periodically rerandomizes distributed shares without changing the protected secret, preventing an adversary that compromises different parties in different epochs from accumulating a reconstructi"},{"t":"mpc","k":"paper","id":"MPC-PAPER-1995-PROACTIVE","s":"hjky95","title":"Proactive Secret Sharing or: How to Cope With Perpetual Leakage","key":"HJKY95","y":1995,"sub":"Amir Herzberg, Stanislaw Jarecki, Hugo Krawczyk, Moti Yung · CRYPTO 1995"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-1996-ADAPTIVE-NCE","s":"cfgn96-adaptive-security-over-insec","title":"Adaptive security over insecure channels","key":"CFGN96","y":1996,"sub":"Canetti, Feige, Goldreich, and Naor use non-committing encryption to obtain computational MPC over insecure channels against adaptive corruptions of non-erasing parties under the paper's threshold and trapdoor assumption"},{"t":"mpc","k":"paper","id":"MPC-PAPER-1996-ADAPTIVE","s":"cfgn96","title":"Adaptively Secure Multi-party Computation","key":"CFGN96","y":1996,"sub":"Ran Canetti, Uriel Feige, Oded Goldreich, Moni Naor · STOC 1996"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2000-CDM-LSSS","s":"cdm00-multiplicative-lsss-mpc","title":"Multiplicative LSSS MPC","key":"CDM00","y":2000,"sub":"Cramer, Damgård, and Maurer construct general MPC from multiplicative linear secret-sharing schemes, extending polynomial-threshold sharing to access structures whose multiplication and robustness conditions are stated a"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2000-CDM","s":"cdm00","title":"General Secure Multi-party Computation from any Linear Secret-Sharing Scheme","key":"CDM00","y":2000,"sub":"Ronald Cramer, Ivan Damgard, Ueli Maurer · EUROCRYPT 2000"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2000-IK","s":"ik00","title":"Randomizing Polynomials: A New Representation with Applications to Round-Efficient Secure Computation","key":"IK00","y":2000,"sub":"Yuval Ishai, Eyal Kushilevitz · FOCS 2000"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2001-UC-COMPOSITION","s":"canetti01-uc-composition-contract","title":"UC composition contract","key":"Canetti01","y":2001,"sub":"Canetti defines universally composable security through an external environment and proves a composition theorem that preserves protocol security when secure subroutines are replaced inside arbitrary surrounding executio"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2001-UC","s":"canetti01","title":"Universally Composable Security: A New Paradigm for Cryptographic Protocols","key":"Canetti01","y":2001,"sub":"Ran Canetti · FOCS 2001"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2003-IKNP-OTEXT","s":"iknp03-iknp-ot-extension","title":"IKNP OT extension","key":"IKNP03","y":2003,"sub":"IKNP extends a small number of base oblivious transfers into a large batch using primarily symmetric-key operations, reducing the public-key cost of OT-intensive secure computation."},{"t":"mpc","k":"paper","id":"MPC-PAPER-2003-IKNP","s":"iknp03","title":"Extending Oblivious Transfers Efficiently","key":"IKNP03","y":2003,"sub":"Yuval Ishai, Joe Kilian, Kobbi Nissim, Erez Petrank · CRYPTO 2003"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-GMW-PASSIVE","s":"gmw-passive-boolean-mpc","title":"GMW passive Boolean MPC","key":null,"y":2003,"sub":"GMW typically favors low AND depth; Yao typically favors constant rounds with cost per non-XOR gate."},{"t":"mpc","k":"paper","id":"MPC-PAPER-2004-IK","s":"ik04","title":"On the Hardness of Information-Theoretic Multiparty Computation","key":"IK04","y":2004,"sub":"Yuval Ishai, Eyal Kushilevitz · EUROCRYPT 2004"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2008-FREEXOR","s":"ks08-free-xor","title":"Free-XOR","key":"KS08","y":2008,"sub":"Free-XOR correlates the two labels on every wire through one global offset so XOR gates require neither garbled ciphertexts nor cryptographic operations, concentrating garbling cost on non-XOR gates."},{"t":"mpc","k":"paper","id":"MPC-PAPER-2008-FREEXOR","s":"ks08","title":"Improved Garbled Circuit: Free XOR Gates and Applications","key":"KS08","y":2008,"sub":"Vladimir Kolesnikov, Thomas Schneider · ICALP 2008"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2008-GHKL","s":"ghkl08","title":"Complete Fairness in Secure Two-Party Computation","key":"GHKL08","y":2008,"sub":"S. Dov Gordon, Carmit Hazay, Jonathan Katz, Yehuda Lindell · STOC 2008"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2009-PRACTICAL2PC","s":"pssw09-practical-2pc-codesign","title":"Practical 2PC codesign","key":"PSSW09","y":2009,"sub":"Pinkas, Schneider, Smart, and Williams shrink garbled tables, pairing Free-XOR with garbled row reduction and halving every gate table when Free-XOR is not used, and integrate circuit design, garbling, oblivious transfer"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2010-FAIR-FUNCTIONS","s":"gk09-boolean-or-and-three","title":"Boolean OR and three-party majority admit complete fairness without an honest majority","key":"GK09","y":2009,"sub":"Gordon and Katz construct completely fair protocols tolerating any \\( t<n \\) corruptions for n-party Boolean OR and three-party majority under suitable cryptographic assumptions, while proving that the latter requires su"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2009-MNS","s":"mns09","title":"An Optimally Fair Coin Toss","key":"MNS09","y":2009,"sub":"Tal Moran, Moni Naor, Gil Segev · TCC 2009"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2009-PRACTICAL2PC","s":"pssw09","title":"Secure Two-Party Computation Is Practical","key":"PSSW09","y":2009,"sub":"Benny Pinkas, Thomas Schneider, Nigel P. Smart, Stephen C. Williams · ASIACRYPT 2009"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2010-FAIR","s":"gk09","title":"Complete Fairness in Multi-Party Computation Without an Honest Majority","key":"GK09","y":2009,"sub":"S. Dov Gordon, Jonathan Katz · TCC 2009"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2010-TASTY-MIXED-COMPILER","s":"hkssw10-typed-he-and-garbled","title":"Typed HE and garbled values support mixed-protocol description and generation","key":"HKSSW10","y":2010,"sub":"TASTY provides a typed protocol-description language and runtime that generate and execute semi-honest two-party computations combining additively homomorphic encryption and garbled circuits, with explicit conversions be"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2010-BOO","s":"boo10","title":"Protocols for Multiparty Coin Toss with a Dishonest Majority","key":"BOO10","y":2010,"sub":"Amos Beimel, Eran Omri, Ilan Orlov · CRYPTO 2010"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2010-TASTY","s":"hkssw10","title":"TASTY: Tool for Automating Secure Two-partY computations","key":"HKSSW10","y":2010,"sub":"Wilko Henecka, Stefan Kögl, Ahmad-Reza Sadeghi, Thomas Schneider, Immo Wehrenberg · ACM CCS 2010"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2011-SPDZ-AUTH","s":"dpsz12-authenticated-share-mpc","title":"Authenticated-share MPC","key":"DPSZ12","y":2012,"sub":"SPDZ combines somewhat-homomorphic-encryption preprocessing with information-theoretic MACs under one secret-shared global key, obtaining an online phase whose work and communication are linear in \\( n \\) and that is sta"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2012-TINYOT-AUTHBITS","s":"nnob12-tinyot-authenticated-bits","title":"TinyOT authenticated bits","key":"NNOB12","y":2012,"sub":"TinyOT builds actively secure Boolean two-party computation from OT-generated authenticated bits and shares, making XOR local and using amortized consistency checks instead of a generic malicious compiler or garbled-circ"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2011-SPDZ","s":"dpsz12","title":"Multiparty Computation from Somewhat Homomorphic Encryption","key":"DPSZ12","y":2012,"sub":"Ivan Damgard, Valerio Pastro, Nigel P. Smart, Sarah Zakarias · CRYPTO 2012"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2012-AJW","s":"ajw12","title":"Multiparty Computation with Low Communication, Computation and Interaction via Threshold FHE","key":"AJW12","y":2012,"sub":"Gilad Asharov, Abhishek Jain, Daniel Wichs · IACR ePrint 2011/613; EUROCRYPT 2012"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2012-TINYOT","s":"nnob12","title":"A New Approach to Practical Active-Secure Two-Party Computation","key":"NNOB12","y":2012,"sub":"Jesper Buus Nielsen, Peter Sebastian Nordholt, Claudio Orlandi, Sai Sheshank Burra · CRYPTO 2012"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-SPDZ-SHE","s":"spdz-she-preprocessing","title":"SPDZ · SHE preprocessing","key":null,"y":2012,"sub":"The name “SPDZ” alone is insufficient for implementation or benchmark comparison because several offline phases can feed the online protocol."},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-TINYOT","s":"tinyot","title":"TinyOT","key":null,"y":2012,"sub":"TinyOT is placed in the Boolean-sharing and authenticated-preprocessing threads, not in the garbled-circuit thread."},{"t":"mpc","k":"paper","id":"MPC-PAPER-2013-IKMOP","s":"ikmop13","title":"On the Power of Correlated Randomness in Secure Computation","key":"IKMOP13","y":2013,"sub":"Yuval Ishai, Eyal Kushilevitz, Sigurd Meldgaard, Claudio Orlandi, Anat Paskin-Cherniavsky · TCC 2013"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2014-KSS-PROTOCOL-SELECTION","s":"kss14-conversion-aware-cost-models","title":"Conversion-aware cost models drive automatic HE and garbled-circuit assignment","key":"KSS14","y":2014,"sub":"For a specified single-static-assignment intermediate program and forecast cost model, Kerschbaum, Schneider, and Schröpfer formulate assignment of operations to HE-assisted arithmetic sharing or garbled circuits with co"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2014-ASHAROV","s":"asharov14","title":"Towards Characterizing Complete Fairness in Secure Two-Party Computation","key":"Asharov14","y":2014,"sub":"Gilad Asharov · TCC 2014"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2014-HT","s":"ht14","title":"An Almost-Optimally Fair Three-Party Coin-Flipping Protocol","key":"HT14","y":2014,"sub":"Iftach Haitner, Eliad Tsfadia · STOC 2014"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2014-KSS","s":"kss14","title":"Automatic Protocol Selection in Secure Two-Party Computations","key":"KSS14","y":2014,"sub":"Florian Kerschbaum, Thomas Schneider, Axel Schröpfer · ACNS 2014"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2015-ABY-MIXED","s":"dsz15-aby-mixed-protocols","title":"ABY mixed protocols","key":"DSZ15","y":2015,"sub":"ABY provides a two-party framework whose computation can move through explicit conversion gates among arithmetic sharing, Boolean sharing, and Yao garbling, allowing each subcomputation to use a domain-specific cost prof"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2015-BMR-SPDZ","s":"lpsy15-bmr-spdz","title":"BMR + SPDZ","key":"LPSY15","y":2015,"sub":"Lindell, Pinkas, Smart, and Yanai use actively secure arithmetic MPC to prepare a BMR garbled circuit, obtaining malicious dishonest-majority MPC whose online phase takes two rounds and is dominated by local garbled-circ"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2015-HALFGATES","s":"zre15-half-gates","title":"Half-gates","key":"ZRE15","y":2015,"sub":"Half-gates decomposes a garbled AND into evaluator and garbler halves, reaching two ciphertexts per AND gate while remaining compatible with the Free-XOR wire-label invariant."},{"t":"mpc","k":"paper","id":"MPC-PAPER-2015-ABMO","s":"abmo15","title":"Complete Characterization of Fairness in Secure Two-Party Computation of Boolean Functions","key":"ABMO15","y":2015,"sub":"Gilad Asharov, Amos Beimel, Nikolaos Makriyannis, Eran Omri · TCC 2015"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2015-ABY","s":"dsz15","title":"ABY — A Framework for Efficient Mixed-Protocol Secure Two-Party Computation","key":"DSZ15","y":2015,"sub":"Daniel Demmler, Thomas Schneider, Michael Zohner · NDSS 2015"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2015-BMR-SPDZ","s":"lpsy15","title":"Efficient Constant Round Multi-Party Computation Combining BMR and SPDZ","key":"LPSY15","y":2015,"sub":"Yehuda Lindell, Benny Pinkas, Nigel P. Smart, Avishay Yanai · CRYPTO 2015"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2015-HALFGATES","s":"zre15","title":"Two Halves Make a Whole: Reducing Data Transfer in Garbled Circuits Using Half Gates","key":"ZRE15","y":2015,"sub":"Samee Zahur, Mike Rosulek, David Evans · EUROCRYPT 2015"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-ABY-PASSIVE","s":"aby","title":"ABY","key":null,"y":2015,"sub":"ABY is compared as a mixed configuration, not as a fourth sharing type competing with its A/B/Y components."},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-BMR-SPDZ","s":"bmr-spdz","title":"BMR + SPDZ","key":null,"y":2015,"sub":"The arithmetic protocol protects circuit preparation; the online phase is a multiparty garbled-circuit evaluation."},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-YAO-PASSIVE","s":"yao-passive-2pc","title":"Yao passive 2PC","key":null,"y":2015,"sub":"This configuration makes the familiar optimized passive garbling stack explicit instead of attributing all later optimizations to “Yao.”"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2016-MASCOT-TRIPLES","s":"kos16-mascot-triples","title":"MASCOT triples","key":"KOS16","y":2016,"sub":"MASCOT generates actively secure authenticated arithmetic triples from oblivious transfer, multiplication, and consistency checks, replacing SPDZ's somewhat-homomorphic-encryption preprocessing while preserving its onlin"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2016-AO","s":"ao16","title":"Almost-Optimally Fair Multiparty Coin-Tossing with Nearly Three-Quarters Malicious","key":"AO16","y":2016,"sub":"Bar Alon, Eran Omri · TCC 2016-B"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2016-DNPR","s":"dnpr16","title":"On the Communication Required for Unconditionally Secure Multiplication","key":"DNPR16","y":2016,"sub":"Ivan Damgård, Jesper Buus Nielsen, Antigoni Polychroniadou, Michael Raskin · CRYPTO 2016"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2016-MASCOT","s":"kos16","title":"MASCOT: Faster Malicious Arithmetic Secure Computation with Oblivious Transfer","key":"KOS16","y":2016,"sub":"Marcel Keller, Emmanuela Orsini, Peter Scholl · CCS 2016"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-MASCOT-SPDZ","s":"mascot-spdz-online","title":"MASCOT + SPDZ online","key":null,"y":2016,"sub":"The online layer is shared, but the correlation source and preprocessing checks are not."},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2017-EMP-M2PC","s":"wmk17-single-execution-malicious-g","title":"Single-execution malicious garbled 2PC reduces setup and circuit-processing cost","key":"WMK17","y":2017,"sub":"Wang, Malozemoff, and Katz optimize malicious garbled-circuit two-party computation for a single execution by reducing public-key work and improving oblivious-transfer and circuit-processing bottlenecks, with an open imp"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2017-APPLEBAUM-RE","s":"applebaum17","title":"Garbled Circuits as Randomized Encodings of Functions: a Primer","key":"Applebaum17","y":2017,"sub":"Benny Applebaum · Tutorials on the Foundations of Cryptography (Springer, 2017), pp. 1-44"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2017-BHLT","s":"bhlt17","title":"Fair Coin Flipping: Tighter Analysis and the Many-Party Case","key":"BHLT17","y":2017,"sub":"Niv Buchbinder, Iftach Haitner, Nissan Levi, Eliad Tsfadia · SODA 2017"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2017-DM","s":"dm17","title":"Designing Fully Secure Protocols for Secure Two-Party Computation of Constant-Domain Functions","key":"DM17","y":2017,"sub":"Vanesa Daza, Nikolaos Makriyannis · TCC 2017"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2017-EMP-M2PC","s":"wmk17","title":"Faster Secure Two-Party Computation in the Single-Execution Setting","key":"WMK17","y":2017,"sub":"Xiao Wang, Alex J. Malozemoff, Jonathan Katz · EUROCRYPT 2017"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2017-VAIKUNTANATHAN","s":"vaikuntanathan17","title":"Some Open Problems in Information-Theoretic Cryptography","key":"Vaikuntanathan17","y":2017,"sub":"Vinod Vaikuntanathan · FSTTCS 2017 (invited paper)"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2018-ABY3-REPLICATED","s":"mr18-aby3-replicated-sharing","title":"ABY3 replicated sharing","key":"MR18","y":2018,"sub":"ABY3 constructs a three-party mixed-protocol framework from replicated ring sharing and explicit arithmetic, binary, and Yao-style conversions, with the passive configuration separated from stronger variants."},{"t":"mpc","k":"paper","id":"MPC-PAPER-2018-ABY3","s":"mr18","title":"ABY3: A Mixed Protocol Framework for Machine Learning","key":"MR18","y":2018,"sub":"Payman Mohassel, Peter Rindal · CCS 2018"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2018-BHMO","s":"bhmo18","title":"Tighter Bounds on Multi-Party Coin Flipping via Augmented Weak Martingales and Differentially Private Sampling","key":"BHMO18","y":2018,"sub":"Amos Beimel, Iftach Haitner, Nikolaos Makriyannis, Eran Omri · FOCS 2018"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-ABY3-PASSIVE","s":"aby3-passive","title":"ABY3 passive","key":null,"y":2018,"sub":"“ABY3” does not imply malicious security in this row."},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2019-PCG-SILENT","s":"bcg19-silent-pcg-correlations","title":"Silent PCG correlations","key":"BCG+19","y":2019,"sub":"Boyle, Couteau, Gilboa, Ishai, Kohl, and Scholl formalize pseudorandom correlation generators and construct silent OT-style expansion, replacing communication and stored correlated randomness with short seeds and local c"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2019-COUTEAU","s":"couteau19","title":"A Note on the Communication Complexity of Multiparty Computation in the Correlated Randomness Model","key":"Couteau19","y":2019,"sub":"Geoffroy Couteau · EUROCRYPT 2019"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2019-PCG","s":"bcg19","title":"Efficient Pseudorandom Correlation Generators: Silent OT Extension and More","key":"BCG+19","y":2019,"sub":"Elette Boyle, Geoffroy Couteau, Niv Gilboa, Yuval Ishai, Lisa Kohl, Peter Scholl · CRYPTO 2019"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2019-SOK-COMPILERS","s":"hhnz19","title":"SoK: General Purpose Compilers for Secure Multi-Party Computation","key":"HHNZ19","y":2019,"sub":"Marcella Hastings, Brett Hemenway, Daniel Noble, Steve Zdancewic · IEEE Symposium on Security and Privacy 2019"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2020-MOTION-MULTIPARTY","s":"bdst20-motion-framework","title":"MOTION framework","key":"BDST20","y":2020,"sub":"MOTION provides an asynchronous modular software architecture that combines multiple sharing protocols and conversions for two or more parties under full-threshold passive security."},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2020-MPSPDZ-FRAMEWORK","s":"keller20-mp-spdz-framework","title":"MP-SPDZ framework","key":"Keller20","y":2020,"sub":"MP-SPDZ provides a high-level compiler and virtual-machine architecture that realizes multiple arithmetic and binary MPC protocol families while keeping backend selection and protocol-specific costs explicit."},{"t":"mpc","k":"paper","id":"MPC-PAPER-2020-MOTION","s":"bdst20","title":"MOTION — A Framework for Mixed-Protocol Multi-Party Computation","key":"BDST20","y":2020,"sub":"Lennart Braun, Daniel Demmler, Thomas Schneider, Oleksandr Tkachenko · IACR ePrint 2020/1137"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2020-MPSPDZ","s":"keller20","title":"MP-SPDZ: A Versatile Framework for Multi-Party Computation","key":"Keller20","y":2020,"sub":"Marcel Keller · CCS 2020"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-MOTION-PASSIVE","s":"motion-passive","title":"MOTION passive","key":null,"y":2020,"sub":"It binds the paper's stated security model to the mechanisms realized by the implementation, while the immutable repository remains a separate object."},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2021-POPLAR-INCREMENTAL-DPF","s":"bbcgi21-incremental-distributed-poin","title":"Incremental distributed point functions share one non-zero tree path with keys linear in the input length","key":"BBCGI21","y":2021,"sub":"An incremental DPF secret-shares, between two servers, the values on the nodes of a depth-n binary tree whose only non-zero nodes lie on one root-to-leaf path. BBCGI21 construct one from a pseudorandom generator with key"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2021-POPLAR-MALICIOUS-SKETCHING","s":"bbcgi21-two-server-check-that","title":"Two-server check that shared client vectors have weight at most one, private against a malicious server","key":"BBCGI21","y":2021,"sub":"Two servers holding additive shares of a client vector in \\( \\mathbb{F}^{m} \\) check that it is a 0/1 vector with at most one non-zero entry, keeping client privacy against one malicious server up to additive attacks (Pr"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2021-THREE-HALVES","s":"rr21-three-halves-garbling","title":"Three-Halves garbling","key":"RR21","y":2021,"sub":"RR21 constructs garbling for general Boolean circuits with free XOR gates and \\( 1.5\\lambda + 5 \\) bits per AND gate using slicing and dicing, under the RTCCR hash assumption in Theorem 3. A gate-hiding variant costs \\( "},{"t":"mpc","k":"paper","id":"MPC-PAPER-2021-POPLAR","s":"bbcgi21","title":"Lightweight Techniques for Private Heavy Hitters","key":"BBCGI21","y":2021,"sub":"Dan Boneh, Elette Boyle, Henry Corrigan-Gibbs, Niv Gilboa, Yuval Ishai · IEEE Symposium on Security and Privacy 2021"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2021-THREE-HALVES","s":"rr21","title":"Three Halves Make a Whole? Beating the Half-Gates Lower Bound for Garbled Circuits","key":"RR21","y":2021,"sub":"Mike Rosulek, Lawrence Roy · CRYPTO 2021"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2023-AKP-FOUR-ROUND-STATISTICAL","s":"akp23-four-round-statistical-mpc","title":"Four-round statistical MPC with GOD and exponential depth-dependent work","key":"AKP23","y":2023,"sub":"Every functionality represented by a Boolean circuit of size S and depth D has a four-round statistically secure MPC protocol with GOD against static active rushing unbounded corruption of \\( t < n/2 \\) parties, with err"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2023-AKP","s":"akp23","title":"The Round Complexity of Statistical MPC with Optimal Resiliency","key":"AKP23","y":2023,"sub":"Benny Applebaum, Eliran Kachlon, Arpita Patra · STOC 2023"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2024-FOLEAGE-F4","s":"bbc24-foleage-preprocessing","title":"FOLEAGE preprocessing","key":"BBC+24","y":2024,"sub":"FOLEAGE constructs multiparty Boolean-triple preprocessing from an F4-OLE pseudorandom correlation generator, with semi-honest security against up to \\( n-1 \\) corruptions, generating triples among \\( n \\) parties with \\"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2024-HPMPC-NETWORK","s":"hsw24-topology-aware-trio-and","title":"Topology-aware Trio and Quad tolerate all but two low-bandwidth links","key":"HSW+24","y":2024,"sub":"HP-MPC redistributes Trio and Quad communication so all but two links may have arbitrarily low bandwidth and all but one may have arbitrarily high latency, without increasing the protocols' total per-multiplication commu"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2024-HPMPC-REDUCED-LOCAL-WORK","s":"hsw24-trio-and-quad-reduce","title":"Trio and Quad reduce per-gate local arithmetic without extra communication","key":"HSW+24","y":2024,"sub":"By reducing correlations among party shares, Trio and Quad require up to half as many basic local instructions per gate as the paper's related baselines while retaining total communication of three and five ring elements"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2024-HPMPC-TRIO-QUAD-MASKED","s":"hsw24-trio-and-quad-use","title":"Trio and Quad use masked sharing at three and four parties","key":"HSW+24","y":2024,"sub":"HP-MPC constructs Trio, a three-party protocol with one passive corruption, and Quad, a four-party protocol with one malicious corruption, using paper-specific masked-sharing semantics and total communication of three an"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2024-FOLEAGE","s":"bbc24","title":"FOLEAGE: F4OLE-Based Multi-Party Computation for Boolean Circuits","key":"BBC+24","y":2024,"sub":"Maxime Bombar, Dung Bui, Geoffroy Couteau, Alain Couvreur, Clement Ducros, Sacha Servan-Schreiber · ASIACRYPT 2024"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2024-HPMPC","s":"hsw24","title":"High-Throughput Secure Multiparty Computation with an Honest Majority in Various Network Settings","key":"HSW+24","y":2024,"sub":"Christopher Harth-Kitzerow, Ajith Suresh, Yongqin Wang, Hossein Yalame, Georg Carle, Murali Annavaram · USENIX Security 2024"},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-HPMPC-3PC","s":"hp-mpc-3pc","title":"HP-MPC 3PC","key":null,"y":2024,"sub":"The protocol row stores the construction; the >billion-gate observations belong to a specific implementation and environment."},{"t":"mpc","k":"scheme","id":"MPC-PROTOCOL-HPMPC-4PC","s":"hp-mpc-4pc","title":"HP-MPC 4PC","key":null,"y":2024,"sub":"Party count and adversary behavior change together, so the 3PC and 4PC variants remain distinct configurations."},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2025-CDPP-SIMD-GOD","s":"cdpp25-statistical-god-with-constan","title":"Statistical GOD with constant communication overhead across \\( \\Theta(n^{7}) \\) SIMD evaluations","key":"CDPP25","y":2025,"sub":"With \\( n = 3t+1 \\) and synchronous private authenticated channels, the current CDPP manuscript gives statistically secure MPC with GOD and \\( O(D) \\) expected rounds against malicious adaptive unbounded corruption; for "},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2025-JRR-FREE-XOR-BOUND","s":"jrr25-garbled-gate-lower-bound","title":"Garbled-gate lower bound","key":"JRR25","y":2025,"sub":"JRR25 Theorem 26 gives a \\( 1.5\\lambda - \\mathrm{negl}(\\lambda) \\) garbled-gate size lower bound for the class of AND gates with input/output bit flips, under Definition 12 input-to-output syntax, λ-bit labels with the c"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2025-CDPP","s":"cdpp25","title":"Statistical MPC with a Constant Communication Overhead","key":"CDPP25","y":2025,"sub":"Ashish Choudhury, Ivan Damgård, Shravani Patil, Arpita Patra · IACR ePrint 2025/1555"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2025-JRR-GARBLING-BOUNDS","s":"jrr25","title":"Lower Bounds for Garbled Circuits from Shannon-Type Information Inequalities","key":"JRR25","y":2025,"sub":"Jake Januzelli, Mike Rosulek, Lawrence Roy · CRYPTO 2025"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2026-BEP-CONSTANT-OVERHEAD-ABORT","s":"bep26-active-crt-based-mpc","title":"Active CRT-based MPC keeps leading computation and communication linear with abort","key":"BEP26","y":2026,"sub":"For any fixed \\( 0 < \\varepsilon < 1/2 \\) and fields with \\( \\log |\\mathbb{F}| = \\Omega(n^{2} \\log n) \\), BEP gives statistically secure MPC with abort for general arithmetic circuits against \\( t < (1/2-\\varepsilon)n \\)"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2026-GHJY-SIPPRF-STACKED-GARBLING","s":"ghjy26-stacked-garbling-whose-input","title":"Stacked garbling whose input-routing cost no longer scales with branches times input length","key":"GHJY26","y":2026,"sub":"GHJY26 Theorem 10 gives a garbling scheme from black-box one-way functions that selects one of \\( B = 2^{n} = \\mathrm{poly}(\\lambda) \\) Boolean branches of size C with a common I-bit input, with total garbled size \\( O(I"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2026-IKR-MULTIPARTY-SVMT-PCF","s":"ikr26-prf-based-multiparty-scalar","title":"PRF-based multiparty scalar-vector triples with exponential party-dependent key cost","key":"IKR26","y":2026,"sub":"IKR construct a k-party PCF for additive shares of a scalar x, vector a, and xa using only PRFs; if each scalar share lies in a common support S, each party holds \\( k|S|^{k-1}-(k-1)|S|^{k-2}+2k-2 \\) PRF keys and evaluat"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2026-IKR-SMALL-VOLE-PCF","s":"ikr26-secret-projection-recovers-s","title":"Secret projection recovers small-scalar VOLE PCFs from PRFs","key":"IKR26","y":2026,"sub":"IKR derive a two-party PCF for VOLE over a finite field \\( \\mathbb{F} \\) with scalar in \\( X \\subseteq \\mathbb{F} \\) from any PRF; the direct construction assigns \\( |X| \\) keys to the sender and \\( |X|-1 \\) to the recei"},{"t":"mpc","k":"result","id":"MPC-CONTRIB-2026-LS-BATCHED-GARBLING","s":"ls26-layer-batched-rom-garbling","title":"Layer-batched ROM garbling separates circuit-size cost from statistical error","key":"LS26","y":2026,"sub":"LS26 Theorem 1 gives Boolean-circuit garbling of size \\( O(|C| \\log T + D\\kappa^{2} \\log T) \\) bits and input encoding \\( O(W_I \\log T) \\) bits in the programmable random-oracle model, with error \\( 2^{-\\kappa} \\) agains"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2026-BEP","s":"bep26","title":"Actively Secure MPC with \\( O(|C|) \\) Computation and Communication via CRT","key":"BEP26","y":2026,"sub":"Alexander Bienstock, Daniel Escudero, Antigoni Polychroniadou · CRYPTO 2026"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2026-GHJY-STACKED-GARBLING","s":"ghjy26","title":"Suffix-Invariant Programmable PRFs and Applications to Stacked Garbling","key":"GHJY26","y":2026,"sub":"Vipul Goyal, David Heath, Abhishek Jain, Yibin Yang · CRYPTO 2026"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2026-IKR-PCF","s":"ikr26","title":"Compressing Correlations via Secret Replication: PCFs from Symmetric Cryptography","key":"IKR26","y":2026,"sub":"Yuval Ishai, Hugo Krawczyk, Tal Rabin · ITC 2026"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2026-IT-CONSTANT-ROUND","s":"apprv26","title":"Constant-round MPC protocols with Fall-back Security","key":"APPRV26","y":2026,"sub":"Anasuya Acharya, Aditya Patankar, Arpita Patra, Divya Ravi, Raghavendra Vernekar · IACR ePrint 2026/1768"},{"t":"mpc","k":"paper","id":"MPC-PAPER-2026-LS-GARBLING","s":"ls26","title":"Breaking the \\( \\Omega(|C|\\kappa) \\) Barrier on Garbled Circuit Size in the Random Oracle Model","key":"LS26","y":2026,"sub":"Junru Li, Yifan Song · CRYPTO 2026"},{"t":"mpc","k":"problem","id":"MPC-OP-001","s":"op-1","title":"Efficient constant-round information-theoretic MPC for general circuits","key":null,"y":null,"sub":"Open problem · Can unconditionally secure MPC evaluate every polynomial-size circuit in a constant number of rounds with polynomial work? Known constant-round information-theoretic protocols cost exponentially in circuit"},{"t":"mpc","k":"problem","id":"MPC-OP-005","s":"op-5","title":"The \\( 1.5\\lambda \\) bound for strongly secure gates with unrestricted queries","key":null,"y":null,"sub":"Open problem · The garbled-gate lower bound required only for schemes meeting the strong security notion of Januzelli, Rosulek and Roy, with no restriction on evaluator queries. Open."},{"t":"mpc","k":"problem","id":"MPC-OP-006","s":"op-6","title":"Constant-round information-theoretic MPC for log-space functions","key":null,"y":null,"sub":"Solved problem · Constant-round information-theoretic MPC with polynomial work, for functions with polynomial-size branching programs. Solved by randomizing polynomials of degree three."},{"t":"mpc","k":"problem","id":"MPC-OP-007","s":"op-7","title":"Four-round statistical MPC with work exponential in depth","key":null,"y":null,"sub":"Solved problem · Constant-round information-theoretic MPC when running time may grow exponentially with circuit depth and the number of parties. Solved in four rounds, even against active adversaries."},{"t":"mpc","k":"problem","id":"MPC-OP-008","s":"op-8","title":"Constant-round information-theoretic MPC against one passive corruption","key":null,"y":null,"sub":"Open problem · Constant-round information-theoretic MPC for all circuits with polynomial work, when only one party is passively corrupted, as with three parties. Open: even here no constant-round protocol avoids cost exp"},{"t":"mpc","k":"problem","id":"MPC-OP-009","s":"op-9","title":"Constant-round MPC from one-way functions","key":null,"y":null,"sub":"Solved problem · Constant-round MPC for all circuits with polynomial work, when security may rest on a one-way function. Solved by having the parties jointly garble the circuit."},{"t":"mpc","k":"problem","id":"MPC-OP-010","s":"op-10","title":"Constant-degree statistical randomized encodings for all circuits","key":null,"y":null,"sub":"Open problem · Polynomial-size perfect or statistical randomized encodings of constant degree for every polynomial-size circuit. Constant-degree encodings can be evaluated in constant rounds, so this would give constant-"},{"t":"mpc","k":"problem","id":"MPC-OP-011","s":"op-11","title":"Information-theoretic MPC with communication sublinear in circuit size","key":null,"y":null,"sub":"Open problem · Can unconditionally secure MPC communicate asymptotically less than the size of the circuit it evaluates? Without trusted setup, every known information-theoretic protocol communicates in proportion to cir"},{"t":"mpc","k":"problem","id":"MPC-OP-012","s":"op-12","title":"Sublinear-communication MPC with trusted correlated randomness","key":null,"y":null,"sub":"Open problem · Without an honest majority, can information-theoretic MPC communicate less than the circuit size when a trusted dealer gives the parties input-independent correlated randomness of polynomial size? Settled "},{"t":"mpc","k":"problem","id":"MPC-OP-013","s":"op-13","title":"Sublinear-communication MPC for layered circuits with correlated randomness","key":null,"y":null,"sub":"Solved problem · With trusted correlated randomness, layered circuits of size s can be evaluated with \\( O(s/\\log\\log s) \\) communication. Solved by Couteau."},{"t":"mpc","k":"problem","id":"MPC-OP-014","s":"op-14","title":"Input-linear communication from exponential correlated randomness","key":null,"y":null,"sub":"Solved problem · With correlated randomness of unbounded size, any functionality can be computed with communication linear in each party's input length. Solved with one-time truth tables."},{"t":"mpc","k":"problem","id":"MPC-OP-015","s":"op-15","title":"Communication independent of circuit size from LWE and circular security","key":null,"y":null,"sub":"Solved problem · Communication sublinear in circuit size for all circuits when security may rest on LWE and a circular-security assumption. Solved by threshold fully homomorphic encryption with bootstrapping, whose commu"},{"t":"mpc","k":"problem","id":"MPC-OP-016","s":"op-16","title":"Optimal size of garbled AND gates with free XOR","key":null,"y":null,"sub":"Open problem · Must every garbled AND gate compatible with free XOR have about \\( 1.5\\lambda \\) bits in the random-oracle model, the size of three-halves garbling? Matching lower bounds are known only for restricted clas"},{"t":"mpc","k":"problem","id":"MPC-OP-017","s":"op-17","title":"\\( 1.5\\lambda \\) lower bound with non-adaptive, coordinated evaluator queries","key":null,"y":null,"sub":"Solved problem · The strongly secure garbled-gate lower bound when the evaluator's oracle queries are non-adaptive and coordinated. Proved by Januzelli, Rosulek and Roy, matching three-halves garbling."},{"t":"mpc","k":"problem","id":"MPC-OP-018","s":"op-18","title":"Optimally fair coin flipping for three or more parties","key":null,"y":null,"sub":"Open problem · Without an honest majority, can a constant number of parties flip a coin in \\( r \\) rounds with bias \\( O(1/r) \\), matching Cleve's lower bound? This is known for two parties and for fewer than two-thirds "},{"t":"mpc","k":"problem","id":"MPC-OP-019","s":"op-19","title":"Optimally fair two-party coin flipping","key":null,"y":null,"sub":"Solved problem · Optimally fair coin flipping for two parties. Solved: assuming oblivious transfer, an \\( r \\)-round protocol has bias \\( O(1/r) \\), matching Cleve's lower bound."},{"t":"mpc","k":"problem","id":"MPC-OP-020","s":"op-20","title":"Optimally fair coin flipping with fewer than two-thirds corrupted","key":null,"y":null,"sub":"Solved problem · Coin flipping with bias \\( O(1/r) \\) when fewer than two thirds of a constant number of parties are corrupted. Solved with bias \\( O(2^{2^{k+1}}/r') \\) for \\( (n+k)/2 \\) corrupted parties, where \\( r' = "},{"t":"mpc","k":"problem","id":"MPC-OP-021","s":"op-21","title":"Optimally fair three-party coin flipping","key":null,"y":null,"sub":"Open problem · Coin flipping with bias \\( O(1/r) \\) for three parties, two of them possibly corrupted. Open: the best bias is \\( O(\\sqrt{\\log r}/r) \\), and whether the extra factor is needed is unknown."},{"t":"mpc","k":"problem","id":"MPC-OP-022","s":"op-22","title":"Coin flipping within a polylogarithmic factor of optimal bias","key":null,"y":null,"sub":"Open problem · Coin flipping for any constant number of parties, all but one possibly corrupted, with bias at most a polylogarithmic factor above \\( 1/r \\). Open for four or more parties against all but one corrupted; se"},{"t":"mpc","k":"problem","id":"MPC-OP-023","s":"op-23","title":"Three-party coin flipping within a polylogarithmic factor","key":null,"y":null,"sub":"Solved problem · Three parties, two possibly corrupted, with bias allowed a polylogarithmic factor above \\( 1/r \\). Solved with bias \\( O(\\log^{3} r / r) \\), later improved to \\( O(\\sqrt{\\log r}/r) \\)."},{"t":"mpc","k":"problem","id":"MPC-OP-024","s":"op-24","title":"Near-optimal coin flipping with fewer than three-quarters corrupted","key":null,"y":null,"sub":"Solved problem · A constant number of parties, fewer than three quarters corrupted, with bias allowed a polylogarithmic factor above \\( 1/r \\). Solved with bias \\( O(\\log^{3} r / r) \\)."},{"t":"mpc","k":"problem","id":"MPC-OP-025","s":"op-25","title":"Beating \\( 1/\\sqrt{r} \\) bias for every constant number of parties","key":null,"y":null,"sub":"Solved problem · Any constant number of parties against all but one corrupted, when the bias may be polynomially above \\( 1/r \\). Solved with bias about \\( r^{-1/2-1/(2^{n-1}-2)} \\), improving the majority protocol's \\( "},{"t":"mpc","k":"problem","id":"MPC-OP-026","s":"op-26","title":"Characterizing two-party functions computable with complete fairness","key":null,"y":null,"sub":"Open problem · Which two-party functions with finite domains and ranges can be computed with complete fairness when one of the two parties may be malicious? Settled for Boolean functions with a common output; open for di"},{"t":"mpc","k":"problem","id":"MPC-OP-027","s":"op-27","title":"Complete fairness for asymmetric Boolean two-party functions","key":null,"y":null,"sub":"Open problem · The characterization for Boolean functions in which the two parties may receive different output bits. Open: known sufficient and necessary conditions leave a gap."},{"t":"mpc","k":"problem","id":"MPC-OP-028","s":"op-28","title":"Complete fairness for symmetric Boolean two-party functions","key":null,"y":null,"sub":"Solved problem · The characterization for Boolean functions whose output is the same for both parties. Solved: such a function is fair exactly when an all-one or all-zero vector lies in an affine span of the rows or colu"},{"t":"mpc","k":"problem","id":"MPC-OP-029","s":"op-29","title":"Complete fairness for Boolean functions without an embedded XOR","key":null,"y":null,"sub":"Solved problem · The characterization for functions with no embedded XOR. Solved: all such functions over polynomial-size domains, including AND, OR and the millionaires' problem, can be computed with complete fairness."},{"t":"pir","k":"assumption","id":"PIR-ASSUMPTION-BFV-BGV-STYLE-HOMOMORPHIC-ENCRYPTION","s":"bfv-bgv-style-homomorphic","title":"BFV/BGV-style homomorphic encryption","key":null,"y":null,"sub":"Assumption used by one or more PIR construction records: BFV/BGV-style homomorphic encryption."},{"t":"pir","k":"assumption","id":"PIR-ASSUMPTION-HOMOMORPHIC-ENCRYPTION-ASSUMPTION","s":"homomorphic-encryption-assum","title":"Homomorphic-encryption assumption","key":null,"y":null,"sub":"Assumption used by one or more PIR construction records: Homomorphic-encryption assumption."},{"t":"pir","k":"assumption","id":"PIR-ASSUMPTION-INHERITED-FROM-THE-CLASSIC-PIR-BACKEND","s":"inherited-from-the-classic","title":"Inherited from the classic PIR backend","key":null,"y":null,"sub":"Assumption used by one or more PIR construction records: Inherited from the classic PIR backend."},{"t":"pir","k":"assumption","id":"PIR-ASSUMPTION-LHE-OR-FHE-FROM-STANDARD-ASSUMPTIONS","s":"lhe-or-fhe-from","title":"LHE or FHE from standard assumptions","key":null,"y":null,"sub":"Assumption used by one or more PIR construction records: LHE or FHE from standard assumptions."},{"t":"pir","k":"assumption","id":"PIR-ASSUMPTION-NO-COMPUTATIONAL-ASSUMPTION-NON-COLLUSION-IS-A-DEPLOYMENT-ASSUMPTION","s":"no-computational-assumption","title":"No computational assumption; non-collusion is a deployment assumption","key":null,"y":null,"sub":"Assumption used by one or more PIR construction records: No computational assumption; non-collusion is a deployment assumption."},{"t":"pir","k":"assumption","id":"PIR-ASSUMPTION-NO-COMPUTATIONAL-ASSUMPTION-SERVER-NON-COLLUSION-REQUIRED","s":"no-computational-assumption-2","title":"No computational assumption; server non-collusion required","key":null,"y":null,"sub":"Assumption used by one or more PIR construction records: No computational assumption; server non-collusion required."},{"t":"pir","k":"assumption","id":"PIR-ASSUMPTION-VARIANT-DEPENDENT-SINGLE-SERVER-COMPUTATIONAL-ASSUMPTIONS","s":"variant-dependent-single-ser","title":"Variant-dependent; single-server computational assumptions","key":null,"y":null,"sub":"Assumption used by one or more PIR construction records: Variant-dependent; single-server computational assumptions."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-1998-CGKS-2S","s":"cgks95-cgks-two-server-information","title":"CGKS two-server information-theoretic PIR","key":"CGKS95","y":1995,"sub":"Two-server information-theoretic PIR. The database is a three-dimensional cube; each server gets a random subcube, returns its XOR, and through a covering code also returns the XORs three other servers of the eight-serve"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-1997-KO","s":"ko97-ko97-single-server-cpir","title":"KO97 single-server CPIR","key":"KO97","y":1997,"sub":"The first single-server PIR, from quadratic residuosity. The client sends residues with a non-residue at its column, the server multiplies along each row of the database matrix, and the scheme recurses to retrieve the wa"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-1999-CMS","s":"cms99-cms99-polylogarithmic-commun","title":"CMS99 polylogarithmic-communication CPIR","key":"CMS99","y":1999,"sub":"Single-server PIR with polylogarithmic communication. Each index maps to a pseudorandom prime; the client sends a modulus whose totient hides its index's prime, the server raises a base to the primes of the set bits in t"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2005-GR","s":"gr05-gentry-ramzan-constant-rate","title":"Gentry–Ramzan constant-rate PBR","key":"GR05","y":2005,"sub":"Single-server private block retrieval at constant rate. The server encodes the database as one integer congruent to each block modulo a small prime power; the client sends a group whose order hides its block's prime powe"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2014-DPF","s":"gi14-dpf-based-two-server","title":"DPF-based two-server PIR","key":"GI14","y":2014,"sub":"Two-server binary computational PIR from a distributed point function. The client splits the point function at its index into two keys built by recursively compressing a truth-table sharing with PRG seeds; each server XO"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2018-SEALPIR","s":"acls18-sealpir-compressed-query-cpi","title":"SealPIR compressed-query CPIR","key":"ACLS18","y":2018,"sub":"Single-server PIR from FV encryption on XPIR's recursive protocol. The client encodes its index as a monomial in one ciphertext per dimension, and the server obliviously expands it into the selection vector with substitu"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2020-CK-OFFLINE","s":"ck20-ck20-two-server-statistical","title":"CK20 two-server statistical","key":"CK20","y":2020,"sub":"The two-server offline/online PIR of Corrigan-Gibbs and Kogan with statistical privacy: an offline server sends parities of about √N log N shifted random sets, and the online server answers a punctured set in sublinear t"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2020-CK-OFFLINE-1S","s":"ck20-ck20-single-server","title":"CK20 single-server","key":"CK20","y":2020,"sub":"The single-server CK20 scheme: the client obtains the two-server hint without revealing its sets, using linearly homomorphic encryption, an FFT over shifts and batch PIR, then runs the online phase with the same server."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2020-CK-OFFLINE-MULTI","s":"ck20-ck20-two-server-multi","title":"CK20 two-server multi-query","key":"CK20","y":2020,"sub":"The multi-query CK20 scheme: after each read the client punctures a fresh set containing the read index and asks the left server for its parity, so one offline phase serves unboundedly many adaptive queries."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2021-CHECKLIST","s":"kc21-checklist","title":"Checklist","key":"KC21","y":2021,"sub":"Checklist's two-server offline/online PIR refines CK20 with a rare-case query that sends sets containing the index, so correctness error is negligible without λ parallel runs and online time and communication fall by a f"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2021-CHECKLIST-WATERFALL","s":"kc21-checklist-waterfall","title":"Checklist waterfall","key":"KC21","y":2021,"sub":"Checklist's dynamic layer splits a key-value database into \\( \\log N \\) buckets of doubling size, so a change forces hint regeneration only for small, cheap buckets and costs \\( O(\\log N) \\) amortized hint work per updat"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2021-MULPIR","s":"alp21-mulpir","title":"MulPIR","key":"ALP+21","y":2021,"sub":"SealPIR's recursion with homomorphic multiplication. After the first dimension the server multiplies by the encrypted selection bits of the others instead of splitting ciphertexts into plaintexts, so the response stays o"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2021-OPTIMIZED-SEALPIR","s":"alp21-optimized-sealpir-compressed","title":"Optimized SealPIR (compressed queries and responses)","key":"ALP+21","y":2021,"sub":"SealPIR with compressed ciphertexts. The client packs all selection vectors into one expandable plaintext and sends seeded secret-key ciphertexts; the server switches the response to a smaller modulus and drops its low b"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2021-SACM","s":"sacm21-sacm21-near-optimal-two","title":"SACM21 near-optimal two-server preprocessing PIR","key":"SACM21","y":2021,"sub":"SACM21 builds privately puncturable pseudorandom sets with fast membership from LWE-based privately puncturable PRFs, giving two-server preprocessing PIR with polylogarithmic online bandwidth and near-√N online time."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2022-CHK","s":"chk22-chk22-fhe","title":"CHK22 (FHE)","key":"CHK22","y":2022,"sub":"Single-server PIR with sublinear amortized server time: under fully homomorphic encryption the client fetches parities of secret pseudorandom sets, then queries punctured sets, consuming backup sets."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2022-CHK-LHE","s":"chk22-chk22-lhe","title":"CHK22 (LHE)","key":"CHK22","y":2022,"sub":"Single-server PIR with sublinear amortized time from linearly homomorphic encryption: a multi-query two-server offline/online scheme is compiled to one server by computing its linear offline step under encryption."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2022-INCREMENTAL-CK","s":"mzra22-incremental-ck-two-server","title":"Incremental CK two-server offline/online PIR","key":"MZRA22","y":2022,"sub":"Incremental CK makes CK20's hint updatable: incremental pseudorandom sets from PRPs let a client resample a hypergeometric share of each set into appended indices, so hint work after m changes scales with m log N rather "},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2022-SPIRAL","s":"mw22-spiral-fhe-composition-pir","title":"Spiral FHE-composition PIR","key":"MW22","y":2022,"sub":"Single-server PIR that composes Regev and GSW lattice encryption. A query is one packed Regev encoding that the server expands, converts to matrix Regev and GSW encodings, and uses to scan the first dimension and fold th"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2022-SPIRALPACK","s":"mw22-spiralpack","title":"SpiralPack","key":"MW22","y":2022,"sub":"Spiral at plaintext dimension one over \\( \\ell^2 \\) sub-databases, whose scalar responses the server packs into one matrix Regev encoding with published packing keys: a higher rate and a cheaper scan for larger public pa"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2022-SPIRALSTREAM","s":"mw22-spiralstream","title":"SpiralStream","key":"MW22","y":2022,"sub":"Streaming variant of Spiral: the client uploads every Regev encoding instead of one packed encoding, so the server skips query expansion, noise stays lower, and one query is reused across many databases."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2022-SPIRALSTREAMPACK","s":"mw22-spiralstreampack","title":"SpiralStreamPack","key":"MW22","y":2022,"sub":"SpiralPack in the streaming setting: the client uploads every Regev encoding, the server skips expansion, and the scalar responses of \\( \\ell^2 \\) sub-databases are packed into one matrix Regev encoding."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2023-DEPIR","s":"lmw23-ring-lwe-unkeyed-doubly","title":"Ring-LWE unkeyed doubly efficient PIR","key":"LMW23","y":2023,"sub":"Unkeyed doubly efficient PIR from Ring-LWE: the database becomes a low-degree polynomial preprocessed for fast evaluation, which the server evaluates on an algebraic SHE encryption of the index digits."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2023-DEPIR-UPDATABLE","s":"lmw23-lmw23-updatable-depir","title":"LMW23 updatable DEPIR","key":"LMW23","y":2023,"sub":"Updatable unkeyed DEPIR: updates enter a log N-level hierarchy of DEPIR-preprocessed sorted lists, and one round of RAM-FHE binary search reads every level."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2023-DOUBLEPIR","s":"hhcmv23-doublepir-recursive-client-h","title":"DoublePIR recursive client-hint protocol","key":"HHCMV23","y":2023,"sub":"SimplePIR applied twice: the server runs a second SimplePIR over the first-level hint and answer, so the client fetches the one hint row it needs online and keeps only a hint independent of the database size."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2023-LP-NEAR-OPTIMAL","s":"lp23a-lp23-near-optimal-single","title":"LP23 near-optimal single-server preprocessing PIR","key":"LP23a","y":2023,"sub":"Single-server preprocessing PIR with polylogarithmic amortized bandwidth and about √N server time: adaptable pseudorandom sets let one key drop and add an element, and FHE runs the offline server."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2023-SIMPLEPIR","s":"hhcmv23-simplepir-client-hint-protoc","title":"SimplePIR client-hint protocol","key":"HHCMV23","y":2023,"sub":"Single-server PIR from secret-key Regev encryption over a square database matrix. The database times the public LWE matrix is one hint that all clients download once; each query is then one matrix-vector product the serv"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2023-TREEPIR","s":"lp23b-treepir-ddh","title":"TreePIR (DDH)","key":"LP23b","y":2023,"sub":"TreePIR builds hint sets from weak privately puncturable PRFs (GGM trees), so a punctured key reduces the query to fetching one of √N parities; recursing with a DDH-based single-server PIR makes online bandwidth polyloga"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2023-TREEPIR-PRG","s":"lp23b-treepir","title":"TreePIR","key":"LP23b","y":2023,"sub":"TreePIR as specified in Figure 6: hint sets from GGM-based weak privately puncturable PRFs, and each server returns all √N candidate parities for a punctured key, so only a PRG is needed."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2023-ZLTS","s":"zlts23-zlts23-optimal-single-server","title":"ZLTS23 optimal single-server preprocessing PIR","key":"ZLTS23","y":2023,"sub":"Single-server preprocessing PIR with polylogarithmic bandwidth and about √N server time in one round trip: the server computes set parities under FHE, and programmable-PRF sets support resampling and adding an element."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2024-PIANO","s":"zpsz24-piano-prf-only-client","title":"Piano PRF-only client-preprocessing PIR","key":"ZPSZ24","y":2024,"sub":"Single-server preprocessing PIR from PRFs alone: the client streams the database to build PRF-keyed set parities, then queries a set with the target replaced by a stored replacement index."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2024-SINGLEPASS","s":"lp24-singlepass-client-preprocess","title":"SinglePass client-preprocessing PIR","key":"LP24","y":2024,"sub":"SinglePass splits the database into s partitions and has the server hint the XOR along s random permutations, so preprocessing is one pass with no λ factor and swaps after each query keep the permutations hidden."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2024-THORPIR","s":"fllp24-thorpir-homomorphic-shuffle","title":"ThorPIR homomorphic-shuffle preprocessing PIR","key":"FLLP24","y":2024,"sub":"Single-server client-preprocessing PIR with sublinear offline bandwidth: the server permutes database chunks under BFV with a constant-depth Thorp shuffle, and each hint XORs one element per chunk."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2024-YPIR","s":"mw24-ypir-silent-preprocessing-pr","title":"YPIR silent-preprocessing protocol","key":"MW24","y":2024,"sub":"DoublePIR without the offline hint: the server packs the full DoublePIR response, hint part included, into a few RLWE encodings with an LWE-to-RLWE packing key that the client sends with each query."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2024-YPIR-SP","s":"mw24-ypir-sp-large-record","title":"YPIR+SP large-record variant","key":"MW24","y":2024,"sub":"YPIR's packing applied to the SimplePIR answer instead of the DoublePIR answer: the server packs the returned row of LWE encodings into RLWE encodings, so large records come back without a client hint."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2025-DISTRIBUTIONAL","s":"lhc25-distributional-pir-over-simp","title":"Distributional PIR over SimplePIR","key":"LHC25","y":2025,"sub":"A compiler from batch PIR to distributional PIR: with probability \\( \\kappa_w \\) the client queries the whole database, otherwise only the \\( K \\) most popular records, so expected server work follows the popularity skew"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2025-LLFMP-DORAM","s":"llfmp25-llfmp-doram-based-pir","title":"LLFMP DORAM-based PIR","key":"LLFMP25","y":2025,"sub":"Multi-server PIR from distributed ORAM: servers that may communicate hold a secret-shared ORAM of the database and jointly read the client's secret-shared index."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2025-LLFMP-MULTISERVER-DEPIR","s":"llfmp25-llfmp-multi-server-depir","title":"LLFMP multi-server DEPIR","key":"LLFMP25","y":2025,"sub":"Information-theoretic multi-server DEPIR: each server preprocesses the database polynomial for fast evaluation and answers one point on a random line through the index; the client interpolates."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2025-LLFMP-RECURSIVE","s":"llfmp25-llfmp-recursive-depir","title":"LLFMP recursive dePIR","key":"LLFMP25","y":2025,"sub":"Information-theoretic multi-server PIR with fewer servers: each server also returns derivatives of the database polynomial up to order L, so fewer points determine the client's line polynomial."},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2026-ZIPPIR","s":"adk26-zippir-lwe-to-paillier","title":"ZipPIR LWE-to-Paillier compression protocol","key":"ADK26","y":2026,"sub":"SimplePIR whose hint never reaches the client: the server compresses the hint row into Paillier ciphertexts under an encrypted LWE key, splitting each Paillier evaluation into an offline random part it computes alone and"},{"t":"pir","k":"scheme","id":"PIR-CONSTRUCTION-2026-ZIPPIR-CLIENT-STORAGE","s":"adk26-zippir-with-client-storage","title":"ZipPIR with client storage","key":"ADK26","y":2026,"sub":"ZipPIR in the stateful model: the client downloads and stores the server-computed Paillier hint for each query it will make, so online responses shrink to the answer alone."},{"t":"pir","k":"problem","id":"PIR-OP-002","s":"op-2","title":"Doubly efficient PIR from LWE","key":null,"y":null,"sub":"Open problem · Can one server answer PIR queries in time \\( N^{1-\\varepsilon} \\) after public preprocessing, with no keys and no reference string, under plain LWE? Ring-LWE gives polylogarithmic time; plain LWE gives onl"},{"t":"pir","k":"problem","id":"PIR-OP-003","s":"op-3","title":"Communication complexity of two-server information-theoretic PIR","key":null,"y":null,"sub":"Open problem · Can two non-colluding servers give information-theoretic PIR with polylogarithmic communication? The best scheme uses \\( 2^{\\tilde O(\\sqrt{\\log n})} \\) bits, and the best lower bound for every one-round sc"},{"t":"pir","k":"problem","id":"PIR-OP-006","s":"op-6","title":"Two-server PIR with subpolynomial communication","key":null,"y":null,"sub":"Solved problem · Two-server information-theoretic PIR with \\( n^{o(1)} \\) communication. Solved by Dvir and Gopi, who brought matching-vector schemes from three or four servers down to two."},{"t":"pir","k":"problem","id":"PIR-OP-007","s":"op-7","title":"Two-server PIR with polynomially sublinear communication","key":null,"y":null,"sub":"Solved problem · Two-server information-theoretic PIR with \\( n^{c} \\) communication for a constant \\( c < 1 \\). Solved in the paper that introduced PIR, with about \\( 12\\cdot n^{1/3} \\) bits."},{"t":"pir","k":"problem","id":"PIR-OP-008","s":"op-8","title":"Two-server PIR below the Dvir–Gopi bound","key":null,"y":null,"sub":"Open problem · Two-server information-theoretic PIR with communication \\( 2^{o(\\sqrt{\\log n\\cdot\\log\\log n})} \\), asymptotically below the Dvir–Gopi scheme. Open; three servers already go below this bound."},{"t":"pir","k":"problem","id":"PIR-OP-009","s":"op-9","title":"Three-server PIR below the Dvir–Gopi bound","key":null,"y":null,"sub":"Solved problem · Three-server information-theoretic PIR with communication \\( 2^{o(\\sqrt{\\log n\\cdot\\log\\log n})} \\). Solved with \\( 2^{\\tilde O((\\log n)^{1/3})} \\) bits by combining matching vectors, derivatives and spa"},{"t":"pir","k":"problem","id":"PIR-OP-010","s":"op-10","title":"Three-server PIR with subpolynomial communication","key":null,"y":null,"sub":"Solved problem · Three-server information-theoretic PIR with \\( n^{o(1)} \\) communication. Solved by Efremenko's matching-vector codes, after Yekhanin had reached it under a conjecture on Mersenne primes."},{"t":"pir","k":"problem","id":"PIR-OP-011","s":"op-11","title":"Polylogarithmic PIR with a constant number of servers","key":null,"y":null,"sub":"Open problem · Information-theoretic PIR with \\( \\mathrm{polylog}(n) \\) communication and some constant number of non-colluding servers. Open: for every fixed number of servers the best schemes are still superpolylogarit"},{"t":"pir","k":"problem","id":"PIR-OP-012","s":"op-12","title":"Polylogarithmic PIR with logarithmically many servers","key":null,"y":null,"sub":"Solved problem · Information-theoretic PIR with \\( \\mathrm{polylog}(n) \\) communication when the number of servers may grow like \\( \\log n \\). Solved in the paper that introduced PIR."},{"t":"pir","k":"problem","id":"PIR-OP-013","s":"op-13","title":"Doubly efficient PIR from Ring-LWE","key":null,"y":null,"sub":"Solved problem · Unkeyed single-server DEPIR when Ring-LWE may replace plain LWE. Solved with polylogarithmic online time and communication after \\( N^{1+\\varepsilon} \\) preprocessing."},{"t":"pir","k":"problem","id":"PIR-OP-014","s":"op-14","title":"Barely doubly efficient PIR from LWE","key":null,"y":null,"sub":"Open problem · Unkeyed DEPIR from plain LWE in the standard model with server time \\( N/\\log^{c} N \\) for a constant \\( c > 0 \\). Open: the known LWE scheme needs a common reference string."},{"t":"pir","k":"problem","id":"PIR-OP-015","s":"op-15","title":"Doubly efficient PIR from LWE with a reference string","key":null,"y":null,"sub":"Open problem · Unkeyed DEPIR from plain LWE with online server time \\( N^{1-\\varepsilon} \\) when a common reference string is allowed. Open: the known construction saves only a \\( \\log^{2} N \\) factor."},{"t":"pir","k":"problem","id":"PIR-OP-016","s":"op-16","title":"Barely doubly efficient PIR from LWE with a reference string","key":null,"y":null,"sub":"Solved problem · Unkeyed DEPIR from plain LWE with server time \\( N/\\log^{c} N \\) when a common reference string is allowed. Solved in 2026 by preprocessing the SimplePIR matrix–vector product."},{"t":"pir","k":"problem","id":"PIR-OP-017","s":"op-17","title":"Secret-key doubly efficient PIR from LWE","key":null,"y":null,"sub":"Open problem · DEPIR from plain LWE with server time \\( N^{1-\\varepsilon} \\) when preprocessing may use a secret key shared with the clients. Open: secret-key schemes rest on Ring-LWE or on new code-based assumptions."},{"t":"pir","k":"problem","id":"PIR-OP-018","s":"op-18","title":"Secret-key doubly efficient PIR from new code-based assumptions","key":null,"y":null,"sub":"Solved problem · Secret-key single-server DEPIR for unboundedly many queries under new assumptions about secretly permuted codes. Solved in 2017 with polylogarithmic online work."},{"t":"pir","k":"problem","id":"PIR-OP-019","s":"op-19","title":"Doubly efficient PIR with near-linear storage","key":null,"y":null,"sub":"Open problem · Can one server answer PIR queries in polylogarithmic time after public preprocessing while storing only \\( N\\cdot\\mathrm{polylog}(N) \\) bits? The Ring-LWE scheme stores \\( N^{1+\\varepsilon} \\) bits, and th"},{"t":"pir","k":"problem","id":"PIR-OP-020","s":"op-20","title":"Single-server PIR deployable for private DNS","key":null,"y":null,"sub":"Open problem · Can one server answer private lookups on a DNS-scale database of 100 GB, for clients that hold no key or hint, with at most one core-second of server computation per query and at most ten times the databas"},{"t":"pir","k":"paper","id":"PIR-PAPER-1998-CGKS","s":"cgks95","title":"Private Information Retrieval","key":"CGKS95","y":1995,"sub":"Benny Chor, Oded Goldreich, Eyal Kushilevitz, Madhu Sudan · Journal of the ACM 45(6); preliminary FOCS 1995"},{"t":"pir","k":"paper","id":"PIR-PAPER-1997-KO","s":"ko97","title":"Replication Is Not Needed: Single Database, Computationally-Private Information Retrieval","key":"KO97","y":1997,"sub":"Eyal Kushilevitz, Rafail Ostrovsky · FOCS 1997"},{"t":"pir","k":"paper","id":"PIR-PAPER-1999-CMS","s":"cms99","title":"Computationally Private Information Retrieval with Polylogarithmic Communication","key":"CMS99","y":1999,"sub":"Christian Cachin, Silvio Micali, Markus Stadler · EUROCRYPT 1999"},{"t":"pir","k":"paper","id":"PIR-PAPER-2000-BIM","s":"bim00","title":"Reducing the Servers' Computation in Private Information Retrieval: PIR with Preprocessing","key":"BIM00","y":2000,"sub":"Amos Beimel, Yuval Ishai, Tal Malkin · CRYPTO 2000"},{"t":"pir","k":"paper","id":"PIR-PAPER-2005-GR","s":"gr05","title":"Single-Database Private Information Retrieval with Constant Communication Rate","key":"GR05","y":2005,"sub":"Craig Gentry, Zulfikar Ramzan · ICALP 2005"},{"t":"pir","k":"paper","id":"PIR-PAPER-2005-WDW","s":"wdw05","title":"Improved Lower Bounds for Locally Decodable Codes and Private Information Retrieval","key":"WdW05","y":2005,"sub":"Stephanie Wehner, Ronald de Wolf · ICALP 2005, LNCS 3580, pp. 1424-1436"},{"t":"pir","k":"paper","id":"PIR-PAPER-2006-RY","s":"ry06","title":"An \\( \\Omega(n^{1/3}) \\) Lower Bound for Bilinear Group Based Private Information Retrieval","key":"RY06","y":2006,"sub":"Alexander Razborov, Sergey Yekhanin · FOCS 2006, pp. 739-748; Theory of Computing 3 (2007), article 12, pp. 221-238"},{"t":"pir","k":"paper","id":"PIR-PAPER-2008-YEKHANIN","s":"yekhanin08","title":"Towards 3-Query Locally Decodable Codes of Subexponential Length","key":"Yekhanin08","y":2008,"sub":"Sergey Yekhanin · Journal of the ACM 55(1), 2008, pp. 1-16"},{"t":"pir","k":"paper","id":"PIR-PAPER-2009-EFREMENKO","s":"efremenko09","title":"3-Query Locally Decodable Codes of Subexponential Length","key":"Efremenko09","y":2009,"sub":"Klim Efremenko · STOC 2009, pp. 39-44"},{"t":"pir","k":"paper","id":"PIR-PAPER-2014-GI-DPF","s":"gi14","title":"Distributed Point Functions and Their Applications","key":"GI14","y":2014,"sub":"Niv Gilboa, Yuval Ishai · EUROCRYPT 2014"},{"t":"pir","k":"paper","id":"PIR-PAPER-2016-DG","s":"dg16","title":"2-Server PIR with Subpolynomial Communication","key":"DG16","y":2016,"sub":"Zeev Dvir, Sivakanth Gopi · Journal of the ACM 63(4), 2016; preliminary STOC 2015"},{"t":"pir","k":"paper","id":"PIR-PAPER-2017-BIPW","s":"bipw17","title":"Can We Access a Database Both Locally and Privately?","key":"BIPW17","y":2017,"sub":"Elette Boyle, Yuval Ishai, Rafael Pass, Mary Wootters · TCC 2017; IACR ePrint 2017/567"},{"t":"pir","k":"paper","id":"PIR-PAPER-2017-CHR","s":"chr17","title":"Towards Doubly Efficient Private Information Retrieval","key":"CHR17","y":2017,"sub":"Ran Canetti, Justin Holmgren, Silas Richelson · TCC 2017; IACR ePrint 2017/568"},{"t":"pir","k":"paper","id":"PIR-PAPER-2018-SEALPIR","s":"acls18","title":"PIR with Compressed Queries and Amortized Query Processing","key":"ACLS18","y":2018,"sub":"Sebastian Angel, Hao Chen, Kim Laine, Srinath Setty · IEEE Symposium on Security and Privacy 2018"},{"t":"pir","k":"paper","id":"PIR-PAPER-2020-CK","s":"ck20","title":"Private Information Retrieval with Sublinear Online Time","key":"CK20","y":2020,"sub":"Henry Corrigan-Gibbs, Dmitry Kogan · EUROCRYPT 2020"},{"t":"pir","k":"paper","id":"PIR-PAPER-2021-ALI-TRADEOFFS","s":"alp21","title":"Communication–Computation Trade-offs in PIR","key":"ALP+21","y":2021,"sub":"Asra Ali, Tancrède Lepoint, Sarvar Patel, Mariana Raykova, Phillipp Schoppmann, Karn Seth, Kevin Yeo · USENIX Security 2021"},{"t":"pir","k":"paper","id":"PIR-PAPER-2021-CHECKLIST","s":"kc21","title":"Private Blocklist Lookups with Checklist","key":"KC21","y":2021,"sub":"Dmitry Kogan, Henry Corrigan-Gibbs · USENIX Security 2021"},{"t":"pir","k":"paper","id":"PIR-PAPER-2021-SACM","s":"sacm21","title":"Puncturable Pseudorandom Sets and Private Information Retrieval with Near-Optimal Online Bandwidth and Time","key":"SACM21","y":2021,"sub":"Elaine Shi, Waqar Aqeel, Balakrishnan Chandrasekaran, Bruce M. Maggs · CRYPTO 2021"},{"t":"pir","k":"paper","id":"PIR-PAPER-2022-CHK","s":"chk22","title":"Single-Server Private Information Retrieval with Sublinear Amortized Time","key":"CHK22","y":2022,"sub":"Henry Corrigan-Gibbs, Alexandra Henzinger, Dmitry Kogan · EUROCRYPT 2022"},{"t":"pir","k":"paper","id":"PIR-PAPER-2022-INCREMENTAL","s":"mzra22","title":"Incremental Offline/Online PIR","key":"MZRA22","y":2022,"sub":"Yiping Ma, Ke Zhong, Tal Rabin, Sebastian Angel · USENIX Security 2022"},{"t":"pir","k":"paper","id":"PIR-PAPER-2022-PY-LIMITS","s":"py22","title":"Limits of Preprocessing for Single-Server PIR","key":"PY22","y":2022,"sub":"Giuseppe Persiano, Kevin Yeo · SODA 2022"},{"t":"pir","k":"paper","id":"PIR-PAPER-2022-SPIRAL","s":"mw22","title":"Spiral: Fast, High-Rate Single-Server PIR via FHE Composition","key":"MW22","y":2022,"sub":"Samir Jordan Menon, David J. Wu · IEEE Symposium on Security and Privacy 2022"},{"t":"pir","k":"paper","id":"PIR-PAPER-2023-LMW-DEPIR","s":"lmw23","title":"Doubly Efficient Private Information Retrieval and Fully Homomorphic RAM Computation from Ring LWE","key":"LMW23","y":2023,"sub":"Wei-Kai Lin, Ethan Mook, Daniel Wichs · STOC 2023"},{"t":"pir","k":"paper","id":"PIR-PAPER-2023-LP-NEAR-OPTIMAL","s":"lp23a","title":"Near-Optimal Private Information Retrieval with Preprocessing","key":"LP23a","y":2023,"sub":"Arthur Lazzaretti, Charalampos Papamanthou · TCC 2023"},{"t":"pir","k":"paper","id":"PIR-PAPER-2023-SIMPLEPIR","s":"hhcmv23","title":"One Server for the Price of Two: Simple and Fast Single-Server Private Information Retrieval","key":"HHCMV23","y":2023,"sub":"Alexandra Henzinger, Matthew M. Hong, Henry Corrigan-Gibbs, Sarah Meiklejohn, Vinod Vaikuntanathan · USENIX Security 2023"},{"t":"pir","k":"paper","id":"PIR-PAPER-2023-TREEPIR","s":"lp23b","title":"TreePIR: Sublinear-Time and Polylog-Bandwidth Private Information Retrieval from DDH","key":"LP23b","y":2023,"sub":"Arthur Lazzaretti, Charalampos Papamanthou · CRYPTO 2023"},{"t":"pir","k":"paper","id":"PIR-PAPER-2023-YEO","s":"yeo23","title":"Lower Bounds for (Batch) PIR with Private Preprocessing","key":"Yeo23","y":2023,"sub":"Kevin Yeo · EUROCRYPT 2023"},{"t":"pir","k":"paper","id":"PIR-PAPER-2023-ZLTS","s":"zlts23","title":"Optimal Single-Server Private Information Retrieval","key":"ZLTS23","y":2023,"sub":"Mingxun Zhou, Wei-Kai Lin, Yiannis Tselekounis, Elaine Shi · EUROCRYPT 2023"},{"t":"pir","k":"paper","id":"PIR-PAPER-2024-GKS","s":"gks24","title":"Improved PIR Schemes using Matching Vectors and Derivatives","key":"GKS24","y":2024,"sub":"Fatemeh Ghasemi, Swastik Kopparty, Madhu Sudan · arXiv 2411.11611 (also IACR ePrint 2024/1885 and ECCC TR24-183); later bibliographies list STOC 2025"},{"t":"pir","k":"paper","id":"PIR-PAPER-2024-GZS","s":"gzs24","title":"Efficient Pre-processing PIR Without Public-Key Cryptography","key":"GZS24","y":2024,"sub":"Ashrujit Ghoshal, Mingxun Zhou, Elaine Shi · EUROCRYPT 2024, Part VI, LNCS 14656, pp. 210-240"},{"t":"pir","k":"paper","id":"PIR-PAPER-2024-ISW","s":"isw24","title":"PIR with Client-Side Preprocessing: Information-Theoretic Constructions and Lower Bounds","key":"ISW24","y":2024,"sub":"Yuval Ishai, Elaine Shi, Daniel Wichs · CRYPTO 2024, Part IX, LNCS 14928, pp. 148-182"},{"t":"pir","k":"paper","id":"PIR-PAPER-2024-OPPW-PRACTICAL-DEPIR","s":"oppw24","title":"Towards Practical Doubly-Efficient Private Information Retrieval","key":"OPPW24","y":2024,"sub":"Hiroki Okada, Rachel Player, Simon Pohmann, Christian Weinert · Financial Cryptography and Data Security (FC) 2024"},{"t":"pir","k":"paper","id":"PIR-PAPER-2024-PIANO","s":"zpsz24","title":"Piano: Extremely Simple, Single-Server PIR with Sublinear Server Computation","key":"ZPSZ24","y":2024,"sub":"Mingxun Zhou, Andrew Park, Elaine Shi, Wenting Zheng · IEEE Symposium on Security and Privacy 2024"},{"t":"pir","k":"paper","id":"PIR-PAPER-2024-SINGLEPASS","s":"lp24","title":"Single Pass Client-Preprocessing Private Information Retrieval","key":"LP24","y":2024,"sub":"Arthur Lazzaretti, Charalampos Papamanthou · USENIX Security 2024"},{"t":"pir","k":"paper","id":"PIR-PAPER-2024-THORPIR","s":"fllp24","title":"ThorPIR: Single Server PIR via Homomorphic Thorp Shuffles","key":"FLLP24","y":2024,"sub":"Ben Fisch, Arthur Lazzaretti, Zeyu Liu, Charalampos Papamanthou · ACM CCS 2024"},{"t":"pir","k":"paper","id":"PIR-PAPER-2024-YPIR","s":"mw24","title":"YPIR: High-Throughput Single-Server PIR with Silent Preprocessing","key":"MW24","y":2024,"sub":"Samir Jordan Menon, David J. Wu · USENIX Security 2024"},{"t":"pir","k":"paper","id":"PIR-PAPER-2025-DISTRIBUTIONAL","s":"lhc25","title":"Distributional Private Information Retrieval","key":"LHC25","y":2025,"sub":"Ryan Lehmkuhl, Alexandra Henzinger, Henry Corrigan-Gibbs · USENIX Security 2025"},{"t":"pir","k":"paper","id":"PIR-PAPER-2025-LLFMP-MULTISERVER-DEPIR","s":"llfmp25","title":"Multi-server Doubly Efficient PIR in the Classical Model and Beyond","key":"LLFMP25","y":2025,"sub":"Arthur Lazzaretti, Zeyu Liu, Ben Fisch, Peihan Miao, Charalampos Papamanthou · TCC 2025"},{"t":"pir","k":"paper","id":"PIR-PAPER-2025-LMW-BLACKBOX","s":"lmw25","title":"Black Box Crypto Is Useless for Doubly Efficient PIR","key":"LMW25","y":2025,"sub":"Wei-Kai Lin, Ethan Mook, Daniel Wichs · EUROCRYPT 2025"},{"t":"pir","k":"paper","id":"PIR-PAPER-2025-WR","s":"wr25","title":"Single-Server Client Preprocessing PIR with Tight Space-Time Trade-off","key":"WR25","y":2025,"sub":"Zhikun Wang, Ling Ren · EUROCRYPT 2025, Part VI, LNCS 15606, pp. 94-122"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-CIJMRX-SK-DEPIR","s":"cij26","title":"Doubly-Efficient Secret-Key PIR with Low Storage Overhead","key":"CIJ+26","y":2026,"sub":"Caicai Chen, Yuval Ishai, Aayush Jain, Tamer Mour, Alon Rosen, Chaoping Xing · IACR ePrint 2026/1480"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-GK","s":"gk26","title":"Fourier Sparsity of Delta Functions and Matching Vector PIRs","key":"GK26","y":2026,"sub":"Fatemeh Ghasemi, Swastik Kopparty · ITCS 2026 (per the arXiv comments); arXiv 2512.09941"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-HPY","s":"hpy26","title":"Lower Bounds for PIR with Preprocessing from Blackbox Cryptography","key":"HPY26","y":2026,"sub":"Alexander Hoover, Giuseppe Persiano, Kevin Yeo · FOCS 2026 (to appear, per arXiv comments); arXiv 2607.06451"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-INSPIRE","s":"apsy26","title":"InsPIRe: Communication-Efficient PIR with Server-side Preprocessing","key":"APSY26","y":2026,"sub":"Rasoul Akhavan Mahdavi, Sarvar Patel, Joon Young Seo, Kevin Yeo · IEEE S&P 2026, pp. 1463-1482"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-LEE-BARELY-DEPIR-LWE","s":"lee26a","title":"Barely Doubly-Efficient SimplePIR","key":"Lee26a","y":2026,"sub":"Keewoo Lee · CRYPTO 2026 (per the ePrint record); IACR ePrint 2025/1305"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-LEE-BARELY-DEPIR-QR","s":"lee26c","title":"Barely Doubly-Efficient PIR from Quadratic Residuosity","key":"Lee26c","y":2026,"sub":"Keewoo Lee · IACR ePrint 2026/2034"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-LEE-TWO-SERVER-LB","s":"lee26b","title":"Information-theoretic two-server PIR requires \\( (6 - o(1))\\log n \\) bits of communication","key":"Lee26b","y":2026,"sub":"Keewoo Lee · IACR ePrint 2026/1959"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-VIA","s":"lwz26","title":"VIA: Communication-Efficient Single-Server Private Information Retrieval","key":"LWZ26","y":2026,"sub":"Chenyang Liu, Xukun Wang, Zhifang Zhang · IEEE S&P 2026 (per the ePrint publication note); IACR ePrint 2025/2074"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-XZO-DEPIR","s":"xzo26","title":"Towards Making Doubly-Efficient PIR Practical","key":"XZO+26","y":2026,"sub":"Pan Xiao, Heng Zhang, Rending Ouyang, Cong Zhang, Jian Liu, Kui Ren, Chun Chen · ASIACRYPT 2026 (per the ePrint record); IACR ePrint 2026/243"},{"t":"pir","k":"paper","id":"PIR-PAPER-2026-ZIPPIR","s":"adk26","title":"ZipPIR: High-Throughput Single-Server PIR without Client-side Storage","key":"ADK26","y":2026,"sub":"Rasoul Akhavan Mahdavi, Abdulrahman Diaa, Florian Kerschbaum · USENIX Security 2026"},{"t":"pir","k":"result","id":"PIR-RESULT-1998-CGKS-DEFINED-INFORMATION-THEORETIC-PIR","s":"cgks95-information-theoretic-pir","title":"Information-theoretic PIR","key":"CGKS95","y":1995,"sub":"The work defines private information retrieval and gives sublinear-communication protocols when the database is replicated across non-colluding servers with information-theoretic query privacy."},{"t":"pir","k":"result","id":"PIR-RESULT-1998-CGKS-TWO-SERVER-N-ONE-THIRD-COMMUNICATION","s":"cgks95-o-n-1-3","title":"\\( O(N^{1/3}) \\) communication for two-server PIR","key":"CGKS95","y":1995,"sub":"The CGKS construction gives information-theoretic PIR over two replicated non-colluding servers with total communication \\( O(N^{1/3}) \\) for an \\( N \\)-bit database."},{"t":"pir","k":"result","id":"PIR-RESULT-1997-KO-FIRST-NONTRIVIAL-SINGLE-SERVER-CPIR","s":"ko97-single-server-cpir","title":"Single-server CPIR","key":"KO97","y":1997,"sub":"Under quadratic residuosity, a single database can answer computationally private queries with \\( O(N^{\\varepsilon}) \\) communication for every fixed \\( \\varepsilon > 0 \\)."},{"t":"pir","k":"result","id":"PIR-RESULT-1997-KO-QUADRATIC-RESIDUOSITY-N-EPSILON-COMMUNICATION","s":"ko97-o-n-varepsilon-communication","title":"\\( O(N^{\\varepsilon}) \\) communication for single-server CPIR","key":"KO97","y":1997,"sub":"For every fixed \\( \\varepsilon > 0 \\), the quadratic-residuosity construction gives single-server computational PIR with \\( O(N^{\\varepsilon}) \\) communication."},{"t":"pir","k":"result","id":"PIR-RESULT-1999-CMS-POLYLOGARITHMIC-SINGLE-SERVER-COMMUNICATION","s":"cms99-single-server-cpir-with","title":"Single-server CPIR with polylog communication","key":"CMS99","y":1999,"sub":"Under the Phi assumptions, two-round single-server CPIR has communication polylogarithmic in the database size, \\( \\mathrm{polylog}(N) \\), while server work stays linear in \\( N \\)."},{"t":"pir","k":"result","id":"PIR-RESULT-2000-BIM-FORMALIZED-PIR-WITH-PREPROCESSING","s":"bim00-preprocessing-pir-model","title":"Preprocessing PIR model","key":"BIM00","y":2000,"sub":"The model permits a server to preprocess a static database into auxiliary state before queries, separating preprocessing space and work from online query time."},{"t":"pir","k":"result","id":"PIR-RESULT-2000-BIM-LINEAR-WORK-BARRIER-WITHOUT-PREPROCESSING","s":"bim00-linear-work-barrier","title":"Linear-work barrier","key":"BIM00","y":2000,"sub":"In the scoped ordinary-PIR model, reducing online server work below a linear database scan requires preprocessing or another change to the access model."},{"t":"pir","k":"result","id":"PIR-RESULT-2005-GR-CONSTANT-RATE-SINGLE-DATABASE-BLOCK-RETRIEVAL","s":"gr05-constant-rate-private-blocks","title":"Constant-rate private blocks","key":"GR05","y":2005,"sub":"Single-database private block retrieval achieves \\( O(\\lambda+d) \\) communication and therefore constant rate for sufficiently large retrieved blocks."},{"t":"pir","k":"result","id":"PIR-RESULT-2005-GR-HIDDEN-SMOOTH-SUBGROUP-ENCODING","s":"gr05-hidden-smooth-subgroup-block","title":"Hidden-smooth-subgroup block encoding","key":"GR05","y":2005,"sub":"Hidden smooth subgroups and Chinese-remainder block encoding let a short response carry an entire private block rather than one database bit."},{"t":"pir","k":"result","id":"PIR-RESULT-2014-GI-DPF-COMPACT-TWO-SERVER-PIR-QUERIES","s":"gi14-compact-two-server-pir","title":"Compact two-server PIR queries from DPF keys","key":"GI14","y":2014,"sub":"A client can encode its desired index as two short DPF keys; each non-colluding server evaluates one key across the database, and combining their answer shares recovers the selected bit."},{"t":"pir","k":"result","id":"PIR-RESULT-2014-GI-DPF-INTRODUCED-DISTRIBUTED-POINT-FUNCTIONS","s":"gi14-introduced-distributed-point","title":"Introduced distributed point functions for compact selector sharing","key":"GI14","y":2014,"sub":"A distributed point function splits a point function into short keys whose local evaluations combine to the original function, enabling compact two-server PIR queries."},{"t":"pir","k":"result","id":"PIR-RESULT-2018-SEALPIR-PROBABILISTIC-BATCH-CODES-AMORTIZE-PROCESSING","s":"acls18-probabilistic-batch-codes-fo","title":"Probabilistic batch codes for amortized PIR processing","key":"ACLS18","y":2018,"sub":"SealPIR introduces probabilistic batch codes to amortize server computation across multiple requests from the same client, reporting up to a 40-fold speedup over processing those queries separately in the paper's setting"},{"t":"pir","k":"result","id":"PIR-RESULT-2018-SEALPIR-SEALPIR-COMPRESSED-RLWE-QUERIES","s":"acls18-compressed-rlwe-queries","title":"Compressed RLWE queries","key":"ACLS18","y":2018,"sub":"SealPIR compresses the client's lattice-HE query and homomorphically expands it at the server, reporting up to a 274-fold query-size reduction in the paper's settings."},{"t":"pir","k":"result","id":"PIR-RESULT-2020-CK-OPTIMAL-OFFLINE-ONLINE-TRADEOFF","s":"ck20-optimal-offline-online-trade","title":"Optimal offline/online tradeoff","key":"CK20","y":2020,"sub":"In the CK20 model with an unencoded database and no additional server state, any offline/online PIR satisfies \\( C\\cdot T = \\tilde\\Omega(N) \\), for \\( C \\) the number of bits the client downloads in the offline phase (th"},{"t":"pir","k":"result","id":"PIR-RESULT-2020-CK-SUBLINEAR-ONLINE-LOOKUPS-WITHOUT-EXTRA-SERVER-STORAGE","s":"ck20-sublinear-online-work","title":"Sublinear online work","key":"CK20","y":2020,"sub":"A query-independent offline client fetch enables sublinear online database lookups without increasing server storage, with statistical two-server and computational single-server variants."},{"t":"pir","k":"result","id":"PIR-RESULT-2021-ALI-TRADEOFFS-MULPIR-MULTIPLICATIVE-RECURSION-TRADEOFF","s":"alp21-mulpir-recursive-multiplicat","title":"MulPIR recursive multiplication","key":"ALP+21","y":2021,"sub":"MulPIR uses multiplicative homomorphism in recursive PIR response generation to reduce communication at the price of increased server computation for large database entries."},{"t":"pir","k":"result","id":"PIR-RESULT-2021-ALI-TRADEOFFS-OPTIMIZED-SEALPIR-COMPRESSION","s":"alp21-optimized-sealpir-compressio","title":"Optimized SealPIR compression trade-off","key":"ALP+21","y":2021,"sub":"Optimized SealPIR combines compression and a new oblivious expansion to reduce SealPIR communication while preserving essentially the same computation cost in the reported evaluation."},{"t":"pir","k":"result","id":"PIR-RESULT-2021-CHECKLIST-LOGARITHMIC-AMORTIZED-UPDATES","s":"kc21-logarithmic-updates","title":"Logarithmic updates","key":"KC21","y":2021,"sub":"A bucketed dynamic layer reduces amortized blocklist update work to logarithmic cost instead of rerunning linear preprocessing after each change."},{"t":"pir","k":"result","id":"PIR-RESULT-2021-CHECKLIST-PRACTICAL-SUBLINEAR-TWO-SERVER-LOOKUPS","s":"kc21-checklist-practice-bridge","title":"Checklist practice bridge","key":"KC21","y":2021,"sub":"Checklist implements a two-server private blocklist system whose online PIR server work is sublinear after client-specific preprocessing and evaluates it in a Firefox Safe Browsing setting."},{"t":"pir","k":"result","id":"PIR-RESULT-2021-SACM-NEAR-OPTIMAL-TWO-SERVER-PREPROCESSING-PIR","s":"sacm21-near-optimal-two-server","title":"Near-optimal two-server preprocessing","key":"SACM21","y":2021,"sub":"Under LWE, two-server private-preprocessing PIR supports unbounded queries with near-square-root online computation and client storage, polylogarithmic bandwidth, one round trip, and no extra server storage."},{"t":"pir","k":"result","id":"PIR-RESULT-2021-SACM-PRIVATELY-PUNCTURABLE-PSEUDORANDOM-SETS","s":"sacm21-privately-puncturable-pseudo","title":"Privately puncturable pseudorandom sets","key":"SACM21","y":2021,"sub":"The paper generalizes privately puncturable pseudorandom sets and constructs the mechanism used to refresh private-preprocessing PIR hints without extra per-client server storage."},{"t":"pir","k":"result","id":"PIR-RESULT-2022-CHK-ADAPTIVE-SINGLE-SERVER-SUBLINEAR-AMORTIZED-PIR","s":"chk22-adaptive-single-server-amort","title":"Adaptive single-server amortization","key":"CHK22","y":2022,"sub":"The first single-server PIR simultaneously achieves adaptive multi-query access, sublinear amortized server time, and sublinear additional storage under standard assumptions."},{"t":"pir","k":"result","id":"PIR-RESULT-2022-CHK-ADAPTIVE-STORAGE-TIME-LOWER-BOUND","s":"chk22-adaptive-storage-time-bound","title":"Adaptive storage–time bound","key":"CHK22","y":2022,"sub":"In the paper's adaptive multi-query model with an unmodified database, \\( ST = \\Omega(N) \\), for \\( S \\) the client storage and \\( T \\) the amortized online server time, matching the best FHE-based trade-off up to logari"},{"t":"pir","k":"result","id":"PIR-RESULT-2022-CHK-TWO-SERVER-TO-SINGLE-SERVER-COMPILATION","s":"chk22-homomorphic-single-server-co","title":"Homomorphic single-server compiler","key":"CHK22","y":2022,"sub":"The construction compiles a two-server scheme with a single-server online phase into single-server multi-query PIR using homomorphic evaluation of the offline interaction."},{"t":"pir","k":"result","id":"PIR-RESULT-2022-INCREMENTAL-HINT-UPDATES-PROPORTIONAL-TO-CHANGES","s":"mzra22-incremental-hint-updates","title":"Incremental hint updates","key":"MZRA22","y":2022,"sub":"Incremental offline/online PIR lets a client and the offline server update an existing two-server client hint after appends, in-place edits, and deletions instead of rerunning preprocessing; in the CK-based construction,"},{"t":"pir","k":"result","id":"PIR-RESULT-2022-INCREMENTAL-INCREMENTAL-PSEUDORANDOM-SETS","s":"mzra22-incremental-pseudorandom-set","title":"Incremental pseudorandom sets that extend their range while changing few elements","key":"MZRA22","y":2022,"sub":"An incremental pseudorandom set represents a size-\\( s \\) set by a key and short auxiliary information; an Add step extends its range from \\( [N] \\) to \\( [N+m] \\) so that the set is pseudorandom over the new range while"},{"t":"pir","k":"result","id":"PIR-RESULT-2022-PY-LIMITS-PUBLIC-PREPROCESSING-STORAGE-TIME-LOWER-BOUND","s":"py22-public-hint-storage-time","title":"Public-hint storage–time bound","key":"PY22","y":2022,"sub":"In the paper's cell-probe model, computational single-server PIR with a public preprocessing hint satisfies \\( tr = \\Omega(N\\log N) \\), for \\( r \\) the hint length in bits and \\( t \\) the expected number of probes, over "},{"t":"pir","k":"result","id":"PIR-RESULT-2022-SPIRAL-REGEV-GSW-CIPHERTEXT-TRANSLATION","s":"mw22-regev-gsw-translation","title":"Regev→GSW translation","key":"MW22","y":2022,"sub":"Spiral translates compact Regev-style query ciphertexts into GSW-style ciphertexts inside the server computation, enabling new query-size, response-rate, and throughput trade-offs."},{"t":"pir","k":"result","id":"PIR-RESULT-2022-SPIRAL-SPIRALSTREAM-HIGH-RATE-THROUGHPUT","s":"mw22-spiralstreampack-high-rate-t","title":"SpiralStreamPack high-rate throughput","key":"MW22","y":2022,"sub":"In the paper's streaming setting with more than one million records, SpiralStreamPack reports 1.9 GB/s server throughput and response rate 0.81, compared with 200 MB/s and rate 0.24 for previous protocols."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-LMW-DEPIR-FIRST-UNKEYED-DEPIR-FROM-RING-LWE","s":"lmw23-unkeyed-depir","title":"Unkeyed DEPIR","key":"LMW23","y":2023,"sub":"Under Ring-LWE, deterministic public server preprocessing of near-linear size and time supports single-server PIR queries with polylogarithmic online server time and communication."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-LMW-DEPIR-POLYLOG-ONLINE-TIME-AND-COMMUNICATION","s":"lmw23-polylogarithmic-online-time","title":"Polylogarithmic online time and communication for unkeyed DEPIR","key":"LMW23","y":2023,"sub":"For any constant \\( \\varepsilon > 0 \\), LMW23 preprocesses an \\( N \\)-record database in \\( O(N^{1+\\varepsilon}) \\) time and space so each unkeyed DEPIR query has \\( \\mathrm{polylog}(N) \\) server time and communication, "},{"t":"pir","k":"result","id":"PIR-RESULT-2023-LP-NEAR-OPTIMAL-ADAPTABLE-PSEUDORANDOM-SETS","s":"lp23a-adaptable-pseudorandom-sets","title":"Adaptable pseudorandom sets","key":"LP23a","y":2023,"sub":"Adaptable pseudorandom sets give a succinct key whose represented set supports a prespecified logarithmic number of additions or removals while retaining the paper's security guarantees for intermediate keys."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-LP-NEAR-OPTIMAL-SINGLE-SERVER-PREPROCESSING-FRONTIER","s":"lp23a-independent-near-optimal-pir","title":"Independent near-optimal PIR","key":"LP23a","y":2023,"sub":"An independent single-server client-preprocessing construction achieves near-square-root amortized server time and polylogarithmic amortized bandwidth."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-SIMPLEPIR-DOUBLEPIR-COMPRESSED-HINT","s":"hhcmv23-doublepir-compressed-hint","title":"DoublePIR compressed hint","key":"HHCMV23","y":2023,"sub":"In the paper's 1 GB setting, DoublePIR reduces SimplePIR's reusable client hint from 121 MB to 16 MB while reporting 345 KB per query and 7.4 GB/s per core."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-SIMPLEPIR-SIMPLEPIR-MEMORY-BANDWIDTH-LWE-MATVEC","s":"hhcmv23-memory-bound-lwe-matvec","title":"Memory-bound LWE matvec","key":"HHCMV23","y":2023,"sub":"SimplePIR restructures single-server LWE PIR around a matrix-vector product and reusable client hint, reporting roughly 10 GB/s per core on a 1 GB database in the paper's setting."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-TREEPIR-DDH-BASED-SUBLINEAR-TIME-POLYLOG-BANDWIDTH-PIR","s":"lp23b-treepir-from-ddh","title":"TreePIR from DDH","key":"LP23b","y":2023,"sub":"TreePIR obtains two-server client-preprocessing PIR with sublinear amortized server time and polylogarithmic bandwidth under DDH."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-TREEPIR-WEAK-PRIVATELY-PUNCTURABLE-PRF","s":"lp23b-weak-privately-puncturable-p","title":"Weak privately puncturable PRF","key":"LP23b","y":2023,"sub":"TreePIR introduces weak privately puncturable pseudorandom functions to realize the targeted two-server PIR costs from DDH."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-YEO-OMV-BARRIER-FOR-GENERAL-PIR-LOWER-BOUNDS","s":"yeo23-omv-barrier-for-general","title":"OMV barrier for general PIR lower bounds","key":"Yeo23","y":2023,"sub":"Stronger lower bounds for two-server preprocessing PIR in more general computational models would imply the online matrix-vector conjecture, exposing a barrier to current lower-bound techniques."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-YEO-TIGHT-PRIVATE-PREPROCESSING-STORAGE-TIME-LOWER-BOUND","s":"yeo23-tight-hint-probe-bound","title":"Tight hint–probe bound","key":"Yeo23","y":2023,"sub":"In the standard PIR model with replications, PIR with private preprocessing on a constant number of servers, with error at most \\( 1/15 \\) and privacy against a PPT adversary corrupting one server, satisfies \\( tr = \\Ome"},{"t":"pir","k":"result","id":"PIR-RESULT-2023-ZLTS-OPTIMAL-SINGLE-SERVER-PREPROCESSING-PIR","s":"zlts23-near-optimal-single-server","title":"Near-optimal single-server bandwidth","key":"ZLTS23","y":2023,"sub":"Under LWE, single-server client-preprocessing PIR reaches polylogarithmic bandwidth with near-square-root amortized server/client computation and client storage for unbounded adaptive queries."},{"t":"pir","k":"result","id":"PIR-RESULT-2023-ZLTS-PRIVATELY-PROGRAMMABLE-PSEUDORANDOM-SETS","s":"zlts23-programmable-pr-sets","title":"Programmable PR sets","key":"ZLTS23","y":2023,"sub":"The paper develops privately programmable pseudorandom sets, built from programmable PRFs, to batch and homomorphically realize the refresh operations of the two-server starting point."},{"t":"pir","k":"result","id":"PIR-RESULT-2024-PIANO-PRACTICAL-SINGLE-SERVER-SUBLINEAR-TIME-PIR","s":"zpsz24-practical-single-server-subl","title":"Practical single-server sublinear PIR","key":"ZPSZ24","y":2024,"sub":"The paper's open-source Go implementation reports concretely practical sublinear online server work for single-server client-preprocessing PIR on databases as large as 100 GB."},{"t":"pir","k":"result","id":"PIR-RESULT-2024-PIANO-PRF-ONLY-OPTIMAL-CLIENT-PREPROCESSING","s":"zpsz24-prf-only-piano-construction","title":"PRF-only Piano construction","key":"ZPSZ24","y":2024,"sub":"Piano matches the client-storage times server-time lower bound up to polylogarithmic factors using only pseudorandom functions and plaintext operations."},{"t":"pir","k":"result","id":"PIR-RESULT-2024-SINGLEPASS-CONSTANT-TIME-DATABASE-UPDATES","s":"lp24-constant-time-updates","title":"Constant-time updates","key":"LP24","y":2024,"sub":"SinglePass updates its preprocessed client hint in constant time for edits and amortized constant time for append-only additions, without Checklist's logarithmic query-bandwidth overhead."},{"t":"pir","k":"result","id":"PIR-RESULT-2024-SINGLEPASS-SINGLE-PASS-CLIENT-PREPROCESSING","s":"lp24-one-pass-client-preprocessin","title":"One-pass client preprocessing","key":"LP24","y":2024,"sub":"SinglePass reduces client-specific preprocessing to exactly one linear pass over the database and reports large concrete preprocessing and query speedups over Checklist."},{"t":"pir","k":"result","id":"PIR-RESULT-2024-THORPIR-CONSTANT-DEPTH-HOMOMORPHIC-THORP-PREPROCESSING","s":"fllp24-homomorphic-thorp-preprocess","title":"Homomorphic Thorp preprocessing","key":"FLLP24","y":2024,"sub":"Homomorphic Thorp shuffles yield a linear-size constant-depth hint-generation circuit with sublinear offline communication for single-server client-preprocessing PIR."},{"t":"pir","k":"result","id":"PIR-RESULT-2024-YPIR-HIGH-THROUGHPUT-LWE-TO-RLWE-TRANSLATION","s":"mw24-high-throughput-lwe-to","title":"High-throughput LWE-to-RLWE response translation","key":"MW24","y":2024,"sub":"YPIR packs a DoublePIR response into an RLWE representation and reports 12.1 GB/s/core with 2.5 MB total communication for one-bit or one-byte retrieval from a 32 GB database."},{"t":"pir","k":"result","id":"PIR-RESULT-2024-YPIR-SILENT-PREPROCESSING-REMOVES-HINT-DOWNLOAD","s":"mw24-silent-preprocessing","title":"Silent preprocessing","key":"MW24","y":2024,"sub":"YPIR uses lightweight LWE-to-RLWE translation to remove offline client communication from the high-throughput hint-based PIR branch."},{"t":"pir","k":"result","id":"PIR-RESULT-2025-DISTRIBUTIONAL-CLASSIC-PIR-BLACK-BOX-COMPILER","s":"lhc25-classic-distributional-compi","title":"Classic→distributional compiler","key":"LHC25","y":2025,"sub":"A black-box transform applies classic PIR to popularity-partitioned databases to reduce expected server work under skewed query distributions."},{"t":"pir","k":"result","id":"PIR-RESULT-2025-DISTRIBUTIONAL-DISTRIBUTIONAL-PIR-WITH-RELAXED-CORRECTNESS","s":"lhc25-distributional-pir-correctne","title":"Distributional PIR correctness model","key":"LHC25","y":2025,"sub":"Distributional PIR preserves classic cryptographic query privacy while permitting success probability to depend on a public query-popularity distribution."},{"t":"pir","k":"result","id":"PIR-RESULT-2025-DISTRIBUTIONAL-PROBE-MODEL-SERVER-RUNTIME-LOWER-BOUND","s":"lhc25-distributional-probe-model-l","title":"Distributional probe-model lower bound","key":"LHC25","y":2025,"sub":"The paper lower-bounds expected server runtime for distributional-PIR schemes that answer by probing the unencoded original database."},{"t":"pir","k":"result","id":"PIR-RESULT-2025-LLFMP-MULTISERVER-DEPIR-INFORMATION-THEORETIC-MULTI-SERVER-DEPIR","s":"llfmp25-information-theoretic-multi","title":"Information-theoretic multi-server DEPIR","key":"LLFMP25","y":2025,"sub":"The first information-theoretic multi-server DEPIR supports unbounded queries with near-linear server preprocessing and subpolynomial query time."},{"t":"pir","k":"result","id":"PIR-RESULT-2025-LMW-BLACKBOX-BLACK-BOX-PRIMITIVES-COLLAPSE-TO-ONE-WAY-FUNCTIONS-FOR-SK-DEPIR","s":"lmw25-black-box-primitives-collaps","title":"Black-box primitives collapse to one-way functions for SK-DEPIR","key":"LMW25","y":2025,"sub":"For general secret-key DEPIR, black-box access to a broad class of generic and idealized cryptographic primitives gives no more construction power than black-box one-way functions in the paper's framework."},{"t":"pir","k":"result","id":"PIR-RESULT-2025-LMW-BLACKBOX-TWO-ROUND-PASSIVE-SERVER-BLACK-BOX-BARRIER","s":"lmw25-no-two-round-passive","title":"No two-round passive-server black-box SK-DEPIR","key":"LMW25","y":2025,"sub":"In the paper's locality and correctness regime, no two-round passive-server SK-DEPIR can be constructed by black-box use of any primitive covered by its crypto-oracle framework."},{"t":"pir","k":"result","id":"PIR-RESULT-2026-ZIPPIR-HIGH-THROUGHPUT-WITHOUT-CLIENT-HINT-STORAGE","s":"adk26-hintless-high-throughput","title":"Hintless high throughput","key":"ADK26","y":2026,"sub":"ZipPIR reports 3 GB/s throughput on a 1 GB database without client-side hint storage, using 120 KB of per-client server state and a 400-byte one-time offline message."},{"t":"pir","k":"result","id":"PIR-RESULT-2026-ZIPPIR-LWE-TO-PAILLIER-CIPHERTEXT-COMPRESSION","s":"adk26-lwe-to-paillier-compression","title":"LWE-to-Paillier compression for almost-silent PIR","key":"ADK26","y":2026,"sub":"ZipPIR homomorphically evaluates the linear phase of LWE or RLWE decryption under additive encryption, compressing lattice ciphertexts into Paillier ciphertexts and moving the expensive work offline."},{"t":"pir","k":"assumption","id":"ASM-DCR","s":"dcr","title":"Decisional composite residuosity (DCR)","key":null,"y":null,"sub":"Let \\( N = pq \\) be an RSA modulus."},{"t":"pir","k":"assumption","id":"ASM-DDH","s":"ddh","title":"Decisional Diffie-Hellman (DDH)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\)."},{"t":"pir","k":"assumption","id":"ASM-HIDDEN-SMOOTH-SUBGROUP","s":"hidden-smooth-subgroup","title":"Hidden smooth subgroup assumption","key":null,"y":null,"sub":"Gentry and Ramzan analyse their PIR scheme in a general group \\( G \\) whose order is hidden and which contains a subgroup \\( H \\) of smooth order \\( \\pi \\) (a product of small prime powers)."},{"t":"pir","k":"assumption","id":"ASM-LWE","s":"lwe","title":"Learning with errors (LWE)","key":null,"y":null,"sub":"Fix a dimension \\( n \\), a modulus \\( q \\), a number of samples \\( m \\), and an error distribution \\( \\chi \\) over \\( \\mathbb{Z} \\), typically a discrete Gaussian of width \\( \\alpha q \\) with \\( \\alpha q > 2\\sqrt{n} \\)."},{"t":"pir","k":"assumption","id":"ASM-PHI-HIDING","s":"phi-hiding","title":"Φ-hiding assumption (phi-hiding)","key":null,"y":null,"sub":"Let \\( N = pq \\) be an RSA modulus."},{"t":"pir","k":"assumption","id":"ASM-PRF","s":"prf","title":"Pseudorandom functions (PRF)","key":null,"y":null,"sub":"A keyed function family \\( F : \\{0,1\\}^{\\lambda} \\times \\{0,1\\}^{n} \\to \\{0,1\\}^{m} \\) is a pseudorandom function if, for a uniformly random key \\( k \\), no probabilistic polynomial-time adversary with oracle access to \\"},{"t":"pir","k":"assumption","id":"ASM-PRG","s":"prg","title":"Pseudorandom generators (PRG)","key":null,"y":null,"sub":"A deterministic polynomial-time function \\( G : \\{0,1\\}^{\\lambda} \\to \\{0,1\\}^{\\ell(\\lambda)} \\) with \\( \\ell(\\lambda) > \\lambda \\) is a pseudorandom generator if, for a uniformly random seed \\( s \\), no probabilistic po"},{"t":"pir","k":"assumption","id":"ASM-QR","s":"qr","title":"Quadratic residuosity (QR)","key":null,"y":null,"sub":"Let \\( N = pq \\) be an RSA modulus and let \\( \\mathbb{J}_N \\) be the subgroup of \\( \\mathbb{Z}_N^* \\) of elements with Jacobi symbol \\( +1 \\)."},{"t":"pir","k":"assumption","id":"ASM-RLWE","s":"rlwe","title":"Ring learning with errors (Ring-LWE)","key":null,"y":null,"sub":"Let \\( K \\) be a number field of degree \\( n \\) with ring of integers \\( R \\) (the standard choice is the power-of-two cyclotomic ring \\( R = \\mathbb{Z}[x]/(x^n + 1) \\)), let \\( q \\) be a modulus and \\( R_q = R / qR \\)."},{"t":"pke-kem","k":"assumption","id":"PKE-ASSUMPTION-SUITE-DEPENDENT-KEM","s":"suite-dependent-kem","title":"suite-dependent KEM","key":null,"y":null,"sub":"Assumption used by one or more PKE/KEM construction records: suite-dependent KEM."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-1978-MCELIECE","s":"mceliece78-original-mceliece-encryption","title":"Original McEliece encryption","key":"McEliece78","y":1978,"sub":"The original PKE anchors the code-based family; later CCA-secure KEM specifications require separate records."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-1978-RSA","s":"rsa78-textbook-rsa-encryption-rela","title":"Textbook RSA encryption relation","key":"RSA78","y":1978,"sub":"Textbook RSA is the starting point of the RSA family; randomized encoding is required for modern encryption security."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-1985-ELGAMAL","s":"elgamal85-elgamal-public-key-encryptio","title":"ElGamal public-key encryption","key":"ElGamal85","y":1985,"sub":"The multiplicative structure explains both the clean security reduction and the malleability that later CCA-secure designs address."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-1994-OAEP","s":"br94-oaep-encoding-transform","title":"OAEP encoding transform","key":"BR94","y":1994,"sub":"The security cell is deliberately qualified: it does not merge the original OAEP claim with every later RSA-OAEP proof result."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-1998-CS","s":"cs98-cramer-shoup-encryption","title":"Cramer–Shoup encryption","key":"CS98","y":1998,"sub":"Cramer–Shoup is the standard-model CCA landmark in this seed lineage."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-1999-FO","s":"fo99-fujisaki-okamoto-hybrid-tran","title":"Fujisaki–Okamoto hybrid transform","key":"FO99","y":1999,"sub":"Later KEMs use multiple FO variants; those variants must not be assumed identical without a construction-specific record."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-2017-KYBER","s":"bdk17-crystals-kyber-kem","title":"CRYSTALS-Kyber KEM","key":"BDK+17","y":2017,"sub":"This row follows the 2020-10-14 full revision of ePrint 2017/634. Round-three Kyber and FIPS 203 ML-KEM are separate configurations and must not inherit byte-level claims from this row."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-2022-HPKE","s":"bblw22-rfc-9180-hpke-framework","title":"RFC 9180 HPKE framework","key":"BBLW22","y":2022,"sub":"HPKE is a framework rather than one algorithm; suite-dependent values remain explicitly unresolved in this row."},{"t":"pke-kem","k":"scheme","id":"PKE-CONSTRUCTION-2024-MLKEM","s":"nist24-fips203-ml-kem","title":"ML-KEM","key":"NIST24/FIPS203","y":2024,"sub":"Sizes list ML-KEM-512, ML-KEM-768, and ML-KEM-1024 in that order, as fixed by the initial 2024 final FIPS 203. The NIST publication record flags potential updates, so conformance evidence should retain the exact revision"},{"t":"pke-kem","k":"problem","id":"PKE-OP-001","s":"op-1","title":"Public-key encryption from constant-noise LPN","key":null,"y":null,"sub":"Open problem · Can public-key encryption be based on learning parity with noise at a constant noise rate, assuming hardness only against polynomial-time adversaries? Known schemes need noise about \\( 1/\\sqrt{n} \\) or sub"},{"t":"pke-kem","k":"problem","id":"PKE-OP-002","s":"op-2","title":"Tight QROM security of Fujisaki–Okamoto KEMs from IND-CPA","key":null,"y":null,"sub":"Open problem · Can IND-CCA security of a Fujisaki–Okamoto KEM be reduced in the quantum random oracle model to IND-CPA security of the underlying scheme with only a constant-factor loss? Known reductions lose a square ro"},{"t":"pke-kem","k":"problem","id":"PKE-OP-003","s":"op-3","title":"Public-key encryption from LPN at noise rate about \\( 1/\\sqrt{n} \\)","key":null,"y":null,"sub":"Solved problem · Public-key encryption from polynomially hard LPN when the noise rate is \\( O(1/\\sqrt{n}) \\). Solved by Alekhnovich's scheme; chosen-ciphertext security in the same regime followed."},{"t":"pke-kem","k":"problem","id":"PKE-OP-004","s":"op-4","title":"Public-key encryption from sub-exponentially hard constant-noise LPN","key":null,"y":null,"sub":"Solved problem · Public-key encryption from constant-noise LPN when LPN is assumed hard for adversaries running in time \\( 2^{\\omega(\\sqrt{n})} \\). Solved, with chosen-ciphertext security and oblivious transfer."},{"t":"pke-kem","k":"problem","id":"PKE-OP-005","s":"op-5","title":"Public-key encryption from LPN at noise rate polynomially above \\( 1/\\sqrt{n} \\)","key":null,"y":null,"sub":"Open problem · Public-key encryption from polynomially hard LPN at noise rate \\( n^{-1/2+\\epsilon} \\) for a constant \\( \\epsilon > 0 \\). Open; it would already go beyond the square-root regime of known schemes from polyn"},{"t":"pke-kem","k":"problem","id":"PKE-OP-006","s":"op-6","title":"Tight security of Fujisaki–Okamoto KEMs in the classical random oracle model","key":null,"y":null,"sub":"Solved problem · IND-CCA security of an FO KEM with a tight reduction to IND-CPA security when the adversary queries the hash functions classically. Solved by the modular analysis of Hofheinz, Hövelmanns and Kiltz."},{"t":"pke-kem","k":"problem","id":"PKE-OP-007","s":"op-7","title":"Square-root-free QROM security of Fujisaki–Okamoto KEMs","key":null,"y":null,"sub":"Solved problem · QROM IND-CCA security of FO KEMs from IND-CPA with a loss polynomial in the query depth but no square root on the IND-CPA advantage. Solved by measure-rewind techniques, first under an injectivity condit"},{"t":"pke-kem","k":"problem","id":"PKE-OP-008","s":"op-8","title":"QROM security of Fujisaki–Okamoto KEMs with polynomial loss","key":null,"y":null,"sub":"Solved problem · QROM IND-CCA security of implicit-rejection FO KEMs, with no extra ciphertext hash, from IND-CPA with a loss that may include a square root and factors in the number of queries. Solved."},{"t":"pke-kem","k":"problem","id":"PKE-OP-009","s":"op-9","title":"Tight QROM security of Fujisaki–Okamoto KEMs from parameter-lossy encryption","key":null,"y":null,"sub":"Solved problem · A tight QROM IND-CCA proof for an FO KEM when the underlying scheme is parameter-lossy rather than merely IND-CPA. Solved, even with many users and many challenge ciphertexts."},{"t":"pke-kem","k":"problem","id":"PKE-OP-010","s":"op-10","title":"Chosen-ciphertext security from any CPA-secure encryption","key":null,"y":null,"sub":"Open problem · Does every IND-CPA secure public-key encryption scheme yield an IND-CCA secure one in the standard model? Known transforms add a random oracle or another primitive, or bound the number of decryption querie"},{"t":"pke-kem","k":"problem","id":"PKE-OP-011","s":"op-11","title":"Chosen-ciphertext security from CPA-secure encryption with random oracles","key":null,"y":null,"sub":"Solved problem · IND-CCA public-key encryption from any passively secure scheme when hash functions are modeled as random oracles. Solved by the Fujisaki–Okamoto transform."},{"t":"pke-kem","k":"problem","id":"PKE-OP-012","s":"op-12","title":"Bounded chosen-ciphertext security from CPA-secure encryption","key":null,"y":null,"sub":"Solved problem · Security against a number of adaptive decryption queries fixed at key generation, from any IND-CPA scheme in the standard model. Solved by a black-box construction."},{"t":"pke-kem","k":"problem","id":"PKE-OP-013","s":"op-13","title":"Non-adaptive chosen-ciphertext security from CPA-secure encryption","key":null,"y":null,"sub":"Open problem · IND-CCA1 public-key encryption, where decryption queries are allowed only before the challenge, from any IND-CPA scheme in the standard model. Open; the black-box separation already applies here, and the k"},{"t":"pke-kem","k":"problem","id":"PKE-OP-014","s":"op-14","title":"Chosen-ciphertext security from CPA security and KDM-secure secret-key encryption","key":null,"y":null,"sub":"Solved problem · IND-CCA public-key encryption from an IND-CPA scheme together with secret-key encryption that is one-time KDM secure for projection functions. Solved."},{"t":"pke-kem","k":"problem","id":"PKE-OP-015","s":"op-15","title":"KDM-secure secret-key encryption for projections from CPA-secure encryption","key":null,"y":null,"sub":"Open problem · Build secret-key encryption with one-time KDM security for projection functions from any IND-CPA public-key encryption scheme. By the KDM construction of CCA security, this would give CCA security from CPA"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-1976-DH","s":"dh76","title":"New Directions in Cryptography","key":"DH76","y":1976,"sub":"Whitfield Diffie, Martin E. Hellman · IEEE Transactions on Information Theory 22(6)"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-1978-MCELIECE","s":"mceliece78","title":"A Public-Key Cryptosystem Based on Algebraic Coding Theory","key":"McEliece78","y":1978,"sub":"Robert J. McEliece · DSN Progress Report 42-44"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-1978-RSA","s":"rsa78","title":"A Method for Obtaining Digital Signatures and Public-Key Cryptosystems","key":"RSA78","y":1978,"sub":"Ronald L. Rivest, Adi Shamir, Leonard M. Adleman · Communications of the ACM 21(2)"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-1984-GM","s":"gm84","title":"Probabilistic Encryption","key":"GM84","y":1984,"sub":"Shafi Goldwasser, Silvio Micali · Journal of Computer and System Sciences 28(2)"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-1985-ELGAMAL","s":"elgamal85","title":"A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms","key":"ElGamal85","y":1985,"sub":"Taher ElGamal · IEEE Transactions on Information Theory 31(4)"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-1994-OAEP","s":"br94","title":"Optimal Asymmetric Encryption — How to Encrypt with RSA","key":"BR94","y":1994,"sub":"Mihir Bellare, Phillip Rogaway · EUROCRYPT 1994"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-1998-CS","s":"cs98","title":"A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack","key":"CS98","y":1998,"sub":"Ronald Cramer, Victor Shoup · CRYPTO 1998"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-1999-FO","s":"fo99","title":"Secure Integration of Asymmetric and Symmetric Encryption Schemes","key":"FO99","y":1999,"sub":"Eiichiro Fujisaki, Tatsuaki Okamoto · CRYPTO 1999"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2003-ALEKHNOVICH","s":"alekhnovich03","title":"More on Average Case vs Approximation Complexity","key":"Alekhnovich03","y":2003,"sub":"Michael Alekhnovich · FOCS 2003"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2006-CHK","s":"chk06","title":"A Note on Bounded Chosen Ciphertext Security from Black-box Semantical Security","key":"CHK06","y":2006,"sub":"Ronald Cramer, Dennis Hofheinz, Eike Kiltz · IACR ePrint 2006/391"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2007-GMM","s":"gmm07","title":"Towards a Separation of Semantic and CCA Security for Public Key Encryption","key":"GMM07","y":2007,"sub":"Yael Gertner, Tal Malkin, Steven Myers · TCC 2007"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2010-ABW","s":"abw10","title":"Public-Key Cryptography from Different Assumptions","key":"ABW10","y":2010,"sub":"Benny Applebaum, Boaz Barak, Avi Wigderson · STOC 2010"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2014-KMP","s":"kmp14","title":"Simple Chosen-Ciphertext Security from Low-Noise LPN","key":"KMP14","y":2014,"sub":"Eike Kiltz, Daniel Masny, Krzysztof Pietrzak · PKC 2014"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2016-YZ","s":"yz16","title":"Cryptography with Auxiliary Input and Trapdoor from Constant-Noise LPN","key":"YZ16","y":2016,"sub":"Yu Yu, Jiang Zhang · CRYPTO 2016"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2017-HHK","s":"hhk17","title":"A Modular Analysis of the Fujisaki-Okamoto Transformation","key":"HHK17","y":2017,"sub":"Dennis Hofheinz, Kathrin Hövelmanns, Eike Kiltz · TCC 2017"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2017-KYBER","s":"bdk17","title":"CRYSTALS-Kyber: A CCA-Secure Module-Lattice-Based KEM","key":"BDK+17","y":2017,"sub":"Joppe Bos, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, John M. Schanck, Peter Schwabe, Gregor Seiler, Damien Stehlé · IEEE European Symposium on Security and Privacy 2018"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2018-JZCWM","s":"jzcwm18","title":"IND-CCA-secure Key Encapsulation Mechanism in the Quantum Random Oracle Model, Revisited","key":"JZCWM18","y":2018,"sub":"Haodong Jiang, Zhenfeng Zhang, Long Chen, Hong Wang, Zhi Ma · CRYPTO 2018"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2019-BHHHP","s":"bhhhp19","title":"Tighter Proofs of CCA Security in the Quantum Random Oracle Model","key":"BHHHP19","y":2019,"sub":"Nina Bindel, Mike Hamburg, Kathrin Hövelmanns, Andreas Hülsing, Edoardo Persichetti · TCC 2019"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2019-KMT","s":"kmt19","title":"CCA Security and Trapdoor Functions via Key-Dependent-Message Security","key":"KMT19","y":2019,"sub":"Fuyuki Kitagawa, Takahiro Matsuda, Keisuke Tanaka · CRYPTO 2019"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2020-KSSSS","s":"kssss20","title":"Measure-Rewind-Measure: Tighter Quantum Random Oracle Model Proofs for One-Way to Hiding and CCA Security","key":"KSSSS20","y":2020,"sub":"Veronika Kuchta, Amin Sakzad, Damien Stehlé, Ron Steinfeld, Shi-Feng Sun · EUROCRYPT 2020"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2021-DHKLS","s":"dhkls21","title":"Faster Lattice-Based KEMs via a Generic Fujisaki-Okamoto Transform Using Prefix Hashing","key":"DHKLS21","y":2021,"sub":"Julien Duman, Kathrin Hövelmanns, Eike Kiltz, Vadim Lyubashevsky, Gregor Seiler · ACM CCS 2021"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2021-JZM","s":"jzm21","title":"On the Non-Tightness of Measurement-Based Reductions for Key Encapsulation Mechanism in the Quantum Random Oracle Model","key":"JZM21","y":2021,"sub":"Haodong Jiang, Zhenfeng Zhang, Zhi Ma · ASIACRYPT 2021"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2021-KW","s":"kw21","title":"On the CCA Compatibility of Public-Key Infrastructure","key":"KW21","y":2021,"sub":"Dakshita Khurana, Brent Waters · PKC 2021"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2021-YZ","s":"yz21","title":"Smoothing Out Binary Linear Codes and Worst-case Sub-exponential Hardness for LPN","key":"YZ21","y":2021,"sub":"Yu Yu, Jiang Zhang · CRYPTO 2021"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2022-HPKE","s":"bblw22","title":"Hybrid Public Key Encryption","key":"BBLW22","y":2022,"sub":"Richard Barnes, Karthikeyan Bhargavan, Benjamin Lipp, Christopher A. Wood · RFC 9180"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2023-PWZ","s":"pwz23","title":"Tighter Security for Generic Authenticated Key Exchange in the QROM","key":"PWZ23","y":2023,"sub":"Jiaxin Pan, Benedikt Wagner, Runzhi Zeng · ASIACRYPT 2023"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2024-DJ","s":"dj24","title":"Lossy Cryptography from Code-Based Assumptions","key":"DJ24","y":2024,"sub":"Quang Dao, Aayush Jain · CRYPTO 2024"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2024-FIPS203","s":"nist24-fips203","title":"Module-Lattice-Based Key-Encapsulation Mechanism Standard","key":"NIST24/FIPS203","y":2024,"sub":"National Institute of Standards and Technology · FIPS 203"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2024-GLX","s":"glx24","title":"Measure-Rewind-Extract: Tighter Proofs of One-Way to Hiding and CCA Security in the Quantum Random Oracle Model","key":"GLX24","y":2024,"sub":"Jiangxia Ge, Heming Liao, Rui Xue · IACR ePrint 2024/777"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2024-HDV","s":"hv24","title":"Impossibility of Post-Quantum Shielding Black-Box Constructions of CCA from CPA","key":"HV24","y":2024,"sub":"Loïs Huguenin-Dumittan, Serge Vaudenay · IACR Communications in Cryptology 1(1), 2024"},{"t":"pke-kem","k":"paper","id":"PKE-PAPER-2026-GYY","s":"gyy26","title":"Extract-Amplify-Measure: Single-Sided and Tight O2H with Applications to CCA Security in the Quantum Random Oracle Model","key":"GYY26","y":2026,"sub":"Jiangxia Ge, Kang Yang, Yu Yu · IACR ePrint 2026/2370"},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1976-DH-INTERACTIVE-PUBLIC-CHANNEL-KEY-AGREEMENT","s":"dh76-dh-public-key-distribution","title":"DH public key distribution","key":"DH76","y":1976,"sub":"Diffie and Hellman give a public key distribution system in which each user places an exponential of a secret exponent, modulo a prime, in a public file, and two users each compute the same key from the other's public va"},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1976-DH-PUBLIC-KEY-CRYPTOGRAPHY-CONCEPT","s":"dh76-public-key-cryptography-conc","title":"Public-key cryptography concept","key":"DH76","y":1976,"sub":"Diffie and Hellman formulate public-key cryptography as systems in which publishing enciphering information need not reveal the private information required to reverse or authenticate an operation."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1978-MCELIECE-CODE-BASED-PUBLIC-KEY-ENCRYPTION","s":"mceliece78-mceliece-code-based-pke","title":"McEliece code-based PKE","key":"McEliece78","y":1978,"sub":"McEliece encrypts by encoding under a disguised public generator matrix and adding a bounded error vector that only the secret code structure efficiently corrects."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1978-RSA-RSA-PUBLIC-KEY-ENCRYPTION-RELATION","s":"rsa78-textbook-rsa-encryption-root","title":"Textbook RSA encryption root","key":"RSA78","y":1978,"sub":"RSA uses public modular exponentiation for enciphering and the private inverse exponent for deciphering, giving a concrete trapdoor-permutation PKE relation."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1985-ELGAMAL-RANDOMIZED-DISCRETE-LOG-ENCRYPTION","s":"elgamal85-randomized-elgamal-pke","title":"Randomized ElGamal PKE","key":"ElGamal85","y":1985,"sub":"ElGamal PKE samples an ephemeral exponent, publishes its group element, and masks the plaintext with a Diffie–Hellman-style shared group element."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1994-OAEP-OAEP-RANDOMIZED-ENCODING-TRANSFORM","s":"br94-oaep-randomized-encoding","title":"OAEP randomized encoding","key":"BR94","y":1994,"sub":"OAEP uses a two-hash Feistel-style encoding to randomize and structure a message before applying a trapdoor permutation such as RSA."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1998-CS-HASH-BOUND-ELGAMAL-CIPHERTEXT-CONSISTENCY","s":"cs98-hash-bound-cramer-shoup","title":"Hash-bound Cramer–Shoup ciphertexts","key":"CS98","y":1998,"sub":"Cramer–Shoup augments an ElGamal-like ciphertext with extra group elements and a hash-bound consistency equation that decryption verifies before releasing a message."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1998-CS-STANDARD-MODEL-ADAPTIVE-CCA-ENCRYPTION","s":"cs98-standard-model-adaptive-cca","title":"Standard-model adaptive CCA PKE","key":"CS98","y":1998,"sub":"Cramer–Shoup proves its public-key encryption construction secure against adaptive chosen-ciphertext attack in the standard model under its stated discrete-log-group assumptions."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-1999-FO-FUJISAKI-OKAMOTO-CCA-TRANSFORM","s":"fo99-fujisaki-okamoto-cca-transfo","title":"Fujisaki–Okamoto CCA transform","key":"FO99","y":1999,"sub":"Fujisaki and Okamoto give a random-oracle transform that derives asymmetric encryption coins and symmetric keying material from message-dependent hashes, then validates decryption by recomputing the asymmetric ciphertext"},{"t":"pke-kem","k":"result","id":"PKE-RESULT-2017-KYBER-MODULE-LATTICE-CCA-SECURE-KEM","s":"bdk17-kyber-module-lattice-cca","title":"Kyber module-lattice CCA KEM","key":"BDK+17","y":2017,"sub":"Kyber applies a Fujisaki–Okamoto variant with implicit rejection to its Module-LWE encryption component to obtain a chosen-ciphertext-secure key-encapsulation mechanism."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-2017-KYBER-MODULE-LATTICE-CPA-ENCRYPTION-COMPONENT","s":"bdk17-kyber-cpa-encryption-compone","title":"Kyber CPA encryption component","key":"BDK+17","y":2017,"sub":"Kyber defines a compact public-key encryption component over module lattices using structured polynomial arithmetic, compressed ciphertext components, and a quantified decryption-failure probability."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-2022-HPKE-AUTHENTICATED-AND-PSK-MODES","s":"bblw22-hpke-authentication-and-psk","title":"HPKE authentication and PSK modes","key":"BBLW22","y":2022,"sub":"RFC 9180 defines base, PSK, authenticated, and authenticated-PSK setup modes that alter which sender credentials and pre-shared inputs are bound into the HPKE key schedule."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-2022-HPKE-KEM-KDF-AEAD-HYBRID-FRAMEWORK","s":"bblw22-hpke-kem-kdf-aead","title":"HPKE KEM-KDF-AEAD framework","key":"BBLW22","y":2022,"sub":"RFC 9180 defines HPKE as a suite-parameterized hybrid protocol that combines a KEM-produced shared secret with a labeled key schedule and an AEAD encryption context."},{"t":"pke-kem","k":"result","id":"PKE-RESULT-2024-FIPS203-ML-KEM-NORMATIVE-STANDARD","s":"nist24-fips203-nist-standardization-of-the","title":"NIST standardization of the Kyber-derived ML-KEM profile","key":"NIST24/FIPS203","y":2024,"sub":"FIPS 203 normatively specifies ML-KEM with three parameter sets, exact algorithms, encodings, input checks, and implicit-rejection behavior."},{"t":"pke-kem","k":"assumption","id":"ASM-DDH","s":"ddh","title":"Decisional Diffie-Hellman (DDH)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\)."},{"t":"pke-kem","k":"assumption","id":"ASM-MCELIECE","s":"mceliece","title":"McEliece problem (decoding a disguised binary Goppa code)","key":null,"y":null,"sub":"Let \\( \\mathcal{G} \\) be a binary Goppa code of length \\( n \\), dimension \\( k \\ge n - mt \\) and error-correcting capability \\( t \\), defined by an irreducible polynomial of degree \\( t \\) over \\( \\mathbb{F}_{2^m} \\) and"},{"t":"pke-kem","k":"assumption","id":"ASM-MLWE","s":"mlwe","title":"Module learning with errors (Module-LWE)","key":null,"y":null,"sub":"Let \\( R = \\mathbb{Z}[x]/(x^n + 1) \\) (or another ring of integers of degree \\( n \\)), \\( R_q = R/qR \\), and let \\( d \\ge 1 \\) be the module rank."},{"t":"pke-kem","k":"assumption","id":"ASM-ROM","s":"rom","title":"Random oracle model (ROM)","key":null,"y":null,"sub":"A proof in the random oracle model gives every party, honest or adversarial, oracle access to a uniformly random function \\( H : \\{0,1\\}^* \\to \\{0,1\\}^{\\ell} \\) (or to a random function into a group or another range)."},{"t":"pke-kem","k":"assumption","id":"ASM-RSA","s":"rsa","title":"RSA assumption (RSA)","key":null,"y":null,"sub":"Let \\( N = pq \\) be a product of two random primes of equal length and let \\( e \\) be an exponent with \\( \\gcd(e, \\varphi(N)) = 1 \\) (fixed small values such as \\( e = 65537 \\), or random)."},{"t":"pke-kem","k":"assumption","id":"ASM-TDP","s":"tdp","title":"Trapdoor one-way permutations (TDP)","key":null,"y":null,"sub":"A family of trapdoor permutations consists of efficient algorithms \\( \\mathsf{Gen}, \\mathsf{Eval}, \\mathsf{Inv} \\): \\( \\mathsf{Gen}(1^\\lambda) \\) outputs an index \\( i \\) and a trapdoor \\( t \\); \\( f_i = \\mathsf{Eval}(i,"},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-GROTH16","s":"groth16-2","title":"Groth16","key":null,"y":2016,"sub":"It is the compact pairing-based endpoint against which setup flexibility, transparency, and recursive friendliness are often contrasted."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-BULLETPROOFS","s":"bulletproofs","title":"Bulletproofs","key":null,"y":2017,"sub":"It shows that logarithmic proofs and no trusted setup do not imply a succinct verifier in every dimension."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-STARK","s":"zk-stark","title":"ZK-STARK","key":null,"y":2018,"sub":"It makes transparency and hash-based assumptions visible as properties of a full AIR/IOP/backend stack."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-HALO","s":"halo","title":"Halo","key":null,"y":2019,"sub":"Halo’s recursive wrapping is compared with folding only in the composition table, where the mechanism distinction is explicit."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-MARLIN-KZG","s":"marlin-kzg","title":"Marlin + KZG","key":null,"y":2019,"sub":"Marlin makes the AHP-to-PCS compiler boundary explicit, which is central to the atlas stack view."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-PLONK-KZG","s":"plonk-kzg","title":"PLONK + KZG","key":null,"y":2019,"sub":"Security cards expose which batching and optimization choices are covered. The family name alone carries no automatic theorem."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-SPARTAN","s":"spartan","title":"Spartan","key":null,"y":2019,"sub":"It anchors the multilinear/sum-check path later reused in folding systems and lookup-oriented zkVMs."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-NOVA","s":"nova","title":"Nova","key":null,"y":2021,"sub":"Nova changes the recursion problem from repeatedly proving verifier execution to folding the relation instances themselves."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-HYPERNOVA","s":"hypernova","title":"HyperNova","key":null,"y":2023,"sub":"It demonstrates how a more expressive relation layer and multi-instance composition should be represented without promoting either to a new top-level field."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-JOLT","s":"jolt","title":"Jolt","key":null,"y":2023,"sub":"Jolt makes visible why a zkVM is a system stack: ISA semantics, lookups, memory checking, R1CS/Spartan, and a PCS cannot be replaced by one “zkVM” category label."},{"t":"proof-systems","k":"scheme","id":"PROOF-SYSTEM-PROTOSTAR","s":"protostar","title":"Protostar","key":null,"y":2023,"sub":"Generic accumulation and the Protostar PLONK/lookup instantiation are distinct objects linked by the source contribution."},{"t":"proof-systems","k":"problem","id":"PROOF-OP-001","s":"op-1","title":"SNARGs for NP from standard assumptions","key":null,"y":null,"sub":"Open problem · Is there a succinct non-interactive argument for every NP language, even with non-adaptive soundness, whose security rests on standard assumptions such as LWE or pairings that are not known to imply obfusc"},{"t":"proof-systems","k":"problem","id":"PROOF-OP-005","s":"op-5","title":"Reed–Solomon proximity gaps up to capacity over prime fields","key":null,"y":null,"sub":"Open problem · Do constant-rate Reed–Solomon codes over prime fields have proximity gaps for lines up to radius \\( 1 - \\rho - \\eta \\), for every fixed \\( \\eta > 0 \\), with a number of exceptional points bounded by one fi"},{"t":"proof-systems","k":"problem","id":"PROOF-OP-006","s":"op-6","title":"SNARGs for NP in the random-oracle model","key":null,"y":null,"sub":"Solved problem · SNARGs for all of NP in the random-oracle model instead of the standard model with a reference string. Solved by Micali's computationally sound proofs, which need no assumption beyond the oracle."},{"t":"proof-systems","k":"problem","id":"PROOF-OP-007","s":"op-7","title":"Succinct interactive arguments for NP","key":null,"y":null,"sub":"Solved problem · Succinct arguments for all of NP with a constant number of rounds of interaction instead of one message. Solved by Kilian from collision-resistant hashing."},{"t":"proof-systems","k":"problem","id":"PROOF-OP-008","s":"op-8","title":"SNARGs for deterministic polynomial-time computations","key":null,"y":null,"sub":"Solved problem · SNARGs from standard assumptions for languages in P, the setting of publicly verifiable delegation. Solved from LWE with proofs, CRS and verification polylogarithmic in the running time."},{"t":"proof-systems","k":"problem","id":"PROOF-OP-009","s":"op-9","title":"SNARGs for NP languages with short Extended Frege refutations","key":null,"y":null,"sub":"Solved problem · SNARGs from standard assumptions for NP languages in which every false statement has a polynomial-size Extended Frege proof that no witness exists. Solved from LWE with non-adaptive soundness."},{"t":"proof-systems","k":"problem","id":"PROOF-OP-010","s":"op-10","title":"SNARGs for NP from indistinguishability obfuscation","key":null,"y":null,"sub":"Solved problem · SNARGs for all of NP when sub-exponentially secure indistinguishability obfuscation may also be assumed. Solved, even with adaptive soundness and proofs of size \\( \\mathrm{poly}(\\lambda) \\)."},{"t":"proof-systems","k":"problem","id":"PROOF-OP-011","s":"op-11","title":"SNARGs for NP under a proof-complexity unprovability assumption","key":null,"y":null,"sub":"Solved problem · SNARGs for all of NP when a derandomization assumption and a new assumption about the unprovability of Extended Frege lower bounds may be added to LWE and SXDH. Solved in 2026 with non-adaptive soundness"},{"t":"proof-systems","k":"problem","id":"PROOF-OP-012","s":"op-12","title":"Mildly succinct SNARKs for NP from standard assumptions","key":null,"y":null,"sub":"Open problem · Build an argument of knowledge for NP whose proofs are only a \\( \\lambda^{\\varepsilon} \\) factor shorter than the witness, from standard assumptions. By the boosting theorem of Cheng and Goyal this gives a"},{"t":"proof-systems","k":"problem","id":"PROOF-OP-013","s":"op-13","title":"Reed–Solomon proximity gaps up to the Johnson radius","key":null,"y":null,"sub":"Solved problem · Reed–Solomon proximity gaps below the Johnson radius \\( 1 - \\sqrt{\\rho} \\) instead of up to capacity. Solved for every Reed–Solomon code, first with \\( O(n^{2}) \\) exceptional points and then with \\( O(n"},{"t":"proof-systems","k":"problem","id":"PROOF-OP-014","s":"op-14","title":"Reed–Solomon proximity gaps up to capacity for random evaluation sets","key":null,"y":null,"sub":"Solved problem · Proximity gaps up to capacity for Reed–Solomon codes on \\( n \\) uniformly random evaluation points instead of every evaluation set. Solved with high probability, with linearly many exceptional points and"},{"t":"proof-systems","k":"problem","id":"PROOF-OP-015","s":"op-15","title":"Proximity gaps up to capacity with slack-dependent exponents","key":null,"y":null,"sub":"Solved problem · Proximity gaps up to capacity over prime fields when the exponent of the polynomial bound on exceptional points may grow as the slack \\( \\eta \\) shrinks. Settled in September 2026 for every evaluation se"},{"t":"proof-systems","k":"problem","id":"PROOF-OP-016","s":"op-16","title":"Reed–Solomon proximity gaps up to capacity on smooth domains","key":null,"y":null,"sub":"Open problem · Proximity gaps up to capacity with one fixed exponent, for evaluation sets that are multiplicative subgroups of prime fields, the domains used by FRI, STIR and WHIR. Open; the known failures on these domai"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-1986-FS","s":"fs86","title":"How to Prove Yourself: Practical Solutions to Identification and Signature Problems","key":"FS86","y":1986,"sub":"Amos Fiat, Adi Shamir · CRYPTO 1986"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-1988-BFM","s":"bfm88","title":"Non-Interactive Zero-Knowledge and Its Applications (Extended Abstract)","key":"BFM88","y":1988,"sub":"Manuel Blum, Paul Feldman, Silvio Micali · STOC 1988, 103–112"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-1989-GMR","s":"gmr89","title":"The Knowledge Complexity of Interactive Proof Systems","key":"GMR89","y":1989,"sub":"Shafi Goldwasser, Silvio Micali, Charles Rackoff · SIAM Journal on Computing 18(1), 186–208"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-1990-FLS","s":"fls90","title":"Multiple Non-Interactive Zero Knowledge Proofs Based on a Single Random String (Extended Abstract)","key":"FLS90","y":1990,"sub":"Uriel Feige, Dror Lapidot, Adi Shamir · FOCS 1990, 308–317"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-1992-KILIAN","s":"kilian92","title":"A Note on Efficient Zero-Knowledge Proofs and Arguments","key":"Kilian92","y":1992,"sub":"Joe Kilian · STOC 1992"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-1992-LFKN","s":"lfkn92","title":"Algebraic Methods for Interactive Proof Systems","key":"LFKN92","y":1992,"sub":"Carsten Lund, Lance Fortnow, Howard Karloff, Noam Nisan · Journal of the ACM 39(4)"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2000-MICALI","s":"micali00","title":"Computationally Sound Proofs","key":"Micali00","y":2000,"sub":"Silvio Micali · SIAM Journal on Computing 30(4)"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2010-KZG","s":"kzg10","title":"Constant-Size Commitments to Polynomials and Their Applications","key":"KZG10","y":2010,"sub":"Aniket Kate, Gregory M. Zaverucha, Ian Goldberg · ASIACRYPT 2010"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2016-GROTH","s":"groth16","title":"On the Size of Pairing-based Non-interactive Arguments","key":"Groth16","y":2016,"sub":"Jens Groth · EUROCRYPT 2016"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2017-BULLETPROOFS","s":"bbb17","title":"Bulletproofs: Short Proofs for Confidential Transactions and More","key":"BBB+17","y":2017,"sub":"Benedikt Bünz, Jonathan Bootle, Dan Boneh, Andrew Poelstra, Pieter Wuille, Greg Maxwell · IEEE Symposium on Security and Privacy 2018"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2018-FRI","s":"bbhr18a","title":"Fast Reed-Solomon Interactive Oracle Proofs of Proximity","key":"BBHR18a","y":2018,"sub":"Eli Ben-Sasson, Iddo Bentov, Yinon Horesh, Michael Riabzev · ICALP 2018"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2018-STARK","s":"bbhr18b","title":"Scalable, Transparent, and Post-Quantum Secure Computational Integrity","key":"BBHR18b","y":2018,"sub":"Eli Ben-Sasson, Iddo Bentov, Yinon Horesh, Michael Riabzev · IACR ePrint 2018/046"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2019-HALO","s":"bgh19","title":"Recursive Proof Composition without a Trusted Setup","key":"BGH19","y":2019,"sub":"Sean Bowe, Jack Grigg, Daira Hopwood · IACR ePrint 2019/1021"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2019-MARLIN","s":"chm19","title":"Marlin: Preprocessing zkSNARKs with Universal and Updatable SRS","key":"CHM+19","y":2019,"sub":"Alessandro Chiesa, Yuncong Hu, Mary Maller, Pratyush Mishra, Noah Vesely, Nicholas Ward · EUROCRYPT 2020"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2019-PLONK","s":"gwc19","title":"PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge","key":"GWC19","y":2019,"sub":"Ariel Gabizon, Zachary J. Williamson, Oana Ciobotaru · IACR ePrint 2019/953"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2019-SPARTAN","s":"setty19","title":"Spartan: Efficient and General-purpose zkSNARKs without Trusted Setup","key":"Setty19","y":2019,"sub":"Srinath Setty · CRYPTO 2020"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2020-ACCUMULATION","s":"bcms20","title":"Proof-Carrying Data from Accumulation Schemes","key":"BCMS20","y":2020,"sub":"Benedikt Bünz, Alessandro Chiesa, Pratyush Mishra, Nicholas Spooner · TCC 2020"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2020-BCIKS","s":"bciks20","title":"Proximity Gaps for Reed–Solomon Codes","key":"BCIKS20","y":2020,"sub":"Eli Ben-Sasson, Dan Carmon, Yuval Ishai, Swastik Kopparty, Shubhangi Saraf · FOCS 2020"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2021-CJJ","s":"cjj21","title":"SNARGs for P from LWE","key":"CJJ21","y":2021,"sub":"Arka Rai Choudhuri, Abhishek Jain, Zhengzhong Jin · FOCS 2021"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2021-NOVA","s":"kst21","title":"Nova: Recursive Zero-Knowledge Arguments from Folding Schemes","key":"KST21","y":2021,"sub":"Abhiram Kothapalli, Srinath Setty, Ioanna Tzialla · CRYPTO 2022"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2023-BEHEMOTH","s":"sb23","title":"Behemoth — Transparent Polynomial Commitment Scheme with Constant Opening Proof Size and Verifier Time","key":"SB23","y":2023,"sub":"István András Seres, Péter Burcsi · AFRICACRYPT 2025"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2023-HYPERNOVA","s":"ks23","title":"Recursive Arguments for Customizable Constraint Systems","key":"KS23","y":2023,"sub":"Abhiram Kothapalli, Srinath Setty · CRYPTO 2024"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2023-JOLT","s":"ast23","title":"Jolt: SNARKs for Virtual Machines via Lookups","key":"AST23","y":2023,"sub":"Arasu Arun, Srinath Setty, Justin Thaler · IACR ePrint 2023/1217"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2023-PROTOSTAR","s":"bc23","title":"Protostar: Generic Efficient Accumulation/Folding for Special-Sound Protocols","key":"BC23","y":2023,"sub":"Benedikt Bünz, Binyi Chen · ASIACRYPT 2023"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2024-JKLV","s":"jklv24","title":"SNARGs under LWE via Propositional Proofs","key":"JKLV24","y":2024,"sub":"Zhengzhong Jin, Yael Tauman Kalai, Alex Lombardi, Vinod Vaikuntanathan · STOC 2024"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2024-LATTICE-PCS","s":"cmnw24","title":"Polynomial Commitments from Lattices — Post-Quantum Security, Fast Verification and Transparent Setup","key":"CMNW24","y":2024,"sub":"Valerio Cini, Giulio Malavolta, Ngoc Khanh Nguyen, Hoeteck Wee · CRYPTO 2024"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2024-PLONK-KS","s":"lps24","title":"On Knowledge-Soundness of Plonk in ROM from Falsifiable Assumptions","key":"LPS24","y":2024,"sub":"Helger Lipmaa, Roberto Parisella, Janno Siim · IACR ePrint 2024/994"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2024-REALWORLD-SE","s":"ffr24","title":"Real-world Universal zkSNARKs are Non-malleable","key":"FFR24","y":2024,"sub":"Antonio Faonio, Dario Fiore, Luigi Russo · ACM CCS 2024"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2024-WHIR","s":"acfy24","title":"WHIR: Reed–Solomon Proximity Testing with Super-Fast Verification","key":"ACFY24","y":2024,"sub":"Gal Arnon, Alessandro Chiesa, Giacomo Fenzi, Eylon Yogev · EUROCRYPT 2025"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2024-WW","s":"ww24b","title":"Adaptively-Sound Succinct Arguments for NP from Indistinguishability Obfuscation","key":"WW24b","y":2024,"sub":"Brent Waters, David J. Wu · STOC 2024"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2025-BCHKS","s":"bchks25","title":"On Proximity Gaps for Reed–Solomon Codes","key":"BCHKS25","y":2025,"sub":"Eli Ben-Sasson, Dan Carmon, Ulrich Haböck, Swastik Kopparty, Shubhangi Saraf · STOC 2026"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2025-BOOSTING-SNARKS","s":"cg25","title":"Boosting SNARKs and Rate-1 Barrier in Arguments of Knowledge","key":"CG25","y":2025,"sub":"Jiaqi Cheng, Rishab Goyal · ICALP 2025"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2025-CS-CONJECTURES","s":"cs25","title":"On Reed–Solomon Proximity Gaps Conjectures","key":"CS25","y":2025,"sub":"Elizabeth Crites, Alistair Stewart · CRYPTO 2026"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2025-DG-RANDOM-WORDS","s":"dg25","title":"On the Distribution of the Distances of Random Words","key":"DG25","y":2025,"sub":"Benjamin E. Diamond, Angus Gruen · CRYPTO 2026"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2025-GALOIS","s":"wzd25","title":"Transparent SNARKs over Galois Rings","key":"WZD25","y":2025,"sub":"Yuanju Wei, Xinxuan Zhang, Yi Deng · PKC 2025"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2025-GG-SUBSPACE-DESIGN","s":"gg25","title":"Optimal Proximity Gaps for Subspace-Design Codes and (Random) Reed-Solomon Codes","key":"GG25","y":2025,"sub":"Rohan Goyal, Venkatesan Guruswami · STOC 2026"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2025-IBCS-QUANTUM","s":"cddgs25","title":"Quantum Rewinding for IOP-Based Succinct Arguments","key":"CDDGS25","y":2025,"sub":"Alessandro Chiesa, Marcel Dall’Agnol, Zijing Di, Ziyi Guan, Nicholas Spooner · TCC 2025"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2025-JOLT-SPACE","s":"ntz25","title":"Proving CPU Executions in Small Space","key":"NTZ25","y":2025,"sub":"Vineet Nair, Justin Thaler, Michael Zhu · IACR ePrint 2025/611"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2026-ABF-OPEN-PROBLEMS","s":"abf26","title":"Open Problems in List Decoding and Correlated Agreement","key":"ABF26","y":2026,"sub":"Gal Arnon, Dan Boneh, Giacomo Fenzi · IACR ePrint 2026/680"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2026-BCPZZ-LIST-DECODING","s":"bcpzz26","title":"Algorithmic List Decoding of Reed–Solomon Codes up to Capacity","key":"BCPZZ26","y":2026,"sub":"Joshua Brakensiek, Yeyuan Chen, Aaron Putterman, Zihan Zhang, Kai Zhe Zheng · ECCC TR26-164"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2026-DKT-BEYOND-JOHNSON","s":"dkt26","title":"Reed-Solomon Codes Beyond Johnson: Efficient Decoding and Smaller Cryptographic Proofs","key":"DKT26","y":2026,"sub":"Quang Dao, Scott Duke Kominers, Justin Thaler · IACR ePrint 2026/2056"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2026-JERONIMO-MCA","s":"jeronimo26","title":"Algorithmic List Decoding at Capacity and Optimal Proximity Gaps for Reed–Solomon Codes","key":"Jeronimo26","y":2026,"sub":"Fernando Granha Jeronimo · arXiv 2609.05870"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2026-KKH-NEAR-CAPACITY","s":"kkh26","title":"Failure of proximity gaps close to capacity","key":"KKH26","y":2026,"sub":"Dmitry Krachun, Stepan Kazanin, Ulrich Haböck · IACR ePrint 2026/782"},{"t":"proof-systems","k":"paper","id":"PROOF-PAPER-2026-SNARG-UNPROVABILITY","s":"hjlm26","title":"SNARGs for NP from Unprovability of Mathematical Theorems","key":"HJLM26","y":2026,"sub":"Yao-Ching Hsieh, Abhishek Jain, Jiatu Li, Surya Mathialagan · STOC 2026"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-1986-FS-COMPILER","s":"fs86-fiat-shamir-compiler","title":"Fiat–Shamir compiler","key":"FS86","y":1986,"sub":"The Fiat–Shamir transform replaces a verifier-sampled public-coin challenge with a hash of the statement and commitment, yielding the foundational non-interactive compilation pattern for identification protocols."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-1988-BFM-NIZK-MODEL","s":"bfm88-shared-random-string-model","title":"Shared-random-string model for non-interactive zero knowledge","key":"BFM88","y":1988,"sub":"Blum, Feldman, and Micali formalize non-interactive zero knowledge in a model where prover and verifier share a uniformly random string and a written proof is checked without further verifier messages. Their single-theor"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-1989-GMR-ZK","s":"gmr89-zero-knowledge-definition","title":"Zero-knowledge definition","key":"GMR89","y":1989,"sub":"Goldwasser, Micali, and Rackoff formalize knowledge complexity for interactive proofs and identify zero knowledge as the case where interaction conveys no additional efficiently usable knowledge beyond validity."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-1990-FLS-MULTI-THEOREM","s":"fls90-single-to-many-nizk","title":"Single-to-many NIZK with a shared random reference string","key":"FLS90","y":1990,"sub":"Given a bounded NIZK proof system for an NP-complete language whose prover runs in polynomial time with a witness, and a pseudorandom generator obtained from one-way functions, the FLS transformation supports polynomiall"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-1992-KILIAN-PCP-COMMIT","s":"kilian92-pcp-commitments","title":"PCP + commitments","key":"Kilian92","y":1992,"sub":"Kilian compiles probabilistically checkable proof access through cryptographic commitments so that a verifier queries only authenticated PCP locations, obtaining communication-efficient computational arguments."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-1992-LFKN-SUMCHECK","s":"lfkn92-sum-check","title":"Sum-check","key":"LFKN92","y":1992,"sub":"The algebraic protocol now isolated as sum-check verifies a claimed sum of a low-degree multivariate polynomial over a product domain by reducing it round by round to one polynomial evaluation."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2010-KZG-PCS","s":"kzg10-kzg-commitments","title":"KZG commitments","key":"KZG10","y":2010,"sub":"KZG commits to a bounded-degree univariate polynomial and proves one evaluation with constant-size group elements using pairing groups and degree-bounded structured public parameters."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2016-GROTH-3ELEMENT","s":"groth16-three-element-argument","title":"Three-element argument","key":"Groth16","y":2016,"sub":"Groth16 gives a preprocessing pairing-based non-interactive zero-knowledge argument for arithmetic-circuit satisfiability whose proof in the displayed construction contains three group elements."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2017-BULLETPROOFS-AGG","s":"bbb17-multiple-range-statements-ag","title":"Multiple range statements aggregate with logarithmic additive proof growth","key":"BBB+17","y":2017,"sub":"Bulletproofs aggregates multiple range statements into one proof whose size grows only logarithmically with the number and bit length of the committed values rather than linearly across separate proofs."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2017-BULLETPROOFS-IPA","s":"bbb17-logarithmic-inner-product-ar","title":"Logarithmic inner-product argument","key":"BBB+17","y":2017,"sub":"Bulletproofs constructs logarithmic-size proofs from a discrete-log inner-product argument and Pedersen-style commitments without a trusted setup, with verification work that remains linear in the witness dimension."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2018-FRI-IOPP","s":"bbhr18a-fri-proximity-test","title":"FRI proximity test","key":"BBHR18a","y":2018,"sub":"FRI is an interactive oracle proof of proximity for binary additive Reed–Solomon codes of rate \\( 2^{-R} \\) (\\( R \\ge 2 \\)) in which, for block length N, the prover performs fewer than \\( 6N \\) field operations, sends fe"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2018-STARK-SYSTEM","s":"bbhr18b-stark-stack","title":"STARK stack","key":"BBHR18b","y":2018,"sub":"The paper constructs transparent IOPs of knowledge with scalable prover and verifier, zero knowledge for polynomial-time computations (Theorems 3.4 and 3.5), by reducing an algebraic intermediate representation of a comp"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2019-HALO-RECURSION","s":"bgh19-halo-recursion","title":"Halo recursion","key":"BGH19","y":2019,"sub":"Halo combines an inner-product polynomial commitment, nested amortization, and an elliptic-curve cycle to realize recursive proof composition without a trusted setup."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2019-MARLIN-AHP","s":"chm19-marlin-ahp-compiler","title":"Marlin AHP compiler","key":"CHM+19","y":2019,"sub":"Marlin formalizes a compiler from public-coin algebraic holographic proofs and extractable polynomial commitments to preprocessing arguments with a universal and updatable structured reference string."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2019-PLONK-PIOP","s":"gwc19-plonk-piop","title":"PLONK PIOP","key":"GWC19","y":2019,"sub":"PLONK gives a permutation-based polynomial proof architecture over Lagrange-basis constraints whose structured reference string is universal and updatable rather than circuit specific."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2019-SPARTAN-R1CS","s":"setty19-spartan-r1cs","title":"Spartan R1CS","key":"Setty19","y":2019,"sub":"Spartan reduces arbitrary R1CS satisfiability to sum-check and multilinear commitment machinery, giving transparent argument variants with sublinear verification after public preprocessing."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2020-ACCUMULATION-PCD","s":"bcms20-accumulation-for-pcd","title":"Accumulation for PCD","key":"BCMS20","y":2020,"sub":"The paper defines accumulation schemes and proves that an argument equipped with a suitable accumulator yields proof-carrying data, with concrete non-interactive instantiations relying on a random oracle or knowledge ass"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2021-NOVA-FOLDING","s":"kst21-nova-folding","title":"Nova folding","key":"KST21","y":2021,"sub":"Nova defines folding schemes as a weaker primitive than SNARKs and folds two relaxed-R1CS instances into one running instance to realize incrementally verifiable computation before an optional final compression step."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2023-BEHEMOTH-CONSTANT","s":"sb23-transparent-polynomial-commi","title":"Transparent polynomial commitments with degree-independent opening size and verification","key":"SB23","y":2023,"sub":"Behemoth constructs a transparent polynomial commitment with degree-independent opening-proof size and verifier time in a group of unknown order, with cubic prover time and analysis in the random-oracle and generic-group"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2023-HYPERNOVA-MULTIFOLD","s":"ks23-hypernova-multifolding","title":"HyperNova multifolding","key":"KS23","y":2023,"sub":"HyperNova generalizes folding from relaxed R1CS to customizable constraint systems, folds multiple instances in one step, and supports non-uniform step circuits and PCD-oriented generalizations."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2023-JOLT-LOOKUPVM","s":"ast23-jolt-lookup-vm","title":"Jolt lookup VM","key":"AST23","y":2023,"sub":"Jolt organizes instruction execution around large structured lookups and combines the lookup argument with a sum-check-based proof for residual constraints plus a separate memory-checking protocol."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2023-PROTOSTAR-GENERIC","s":"bc23-protostar-accumulation","title":"Protostar accumulation","key":"BC23","y":2023,"sub":"Protostar gives an accumulation or folding compiler for a class of special-sound protocols and instantiates it for non-uniform IVC with PLONK-style high-degree gates and vector lookups."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2024-LATTICE-PCS-PQ","s":"cmnw24-lattice-pcs","title":"Lattice PCS","key":"CMNW24","y":2024,"sub":"The construction gives a transparent lattice-based polynomial commitment with polylogarithmic communication and verification and quasi-linear proving under Module-SIS, and proves its knowledge soundness against quantum a"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2024-PLONK-KS","s":"lps24-plonk-knowledge-audit","title":"PLONK knowledge audit","key":"LPS24","y":2024,"sub":"The paper proves computational special soundness for specified batched KZG opening protocols and interactive PLONK variants under falsifiable assumptions, then relates those results to random-oracle-model knowledge sound"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2024-REALWORLD-SE","s":"ffr24-simulation-extractability","title":"Simulation extractability","key":"FFR24","y":2024,"sub":"The paper establishes simulation extractability for optimized real-world PLONK- and Marlin-style universal zkSNARK configurations satisfying its stated protocol, backend, and optimization conditions."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2024-WHIR-PROXIMITY","s":"acfy24-whir-proximity-test","title":"WHIR proximity test","key":"ACFY24","y":2024,"sub":"WHIR is an IOP of proximity for constrained Reed–Solomon codes, whose codewords also satisfy a sumcheck-style weighted-sum constraint that can express evaluation queries; with folding parameter k it uses \\( O(m/k) \\) rou"},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2025-BOOSTING-SNARKS","s":"cg25-ram-delegation-boosts-mildly","title":"RAM delegation boosts mildly succinct knowledge arguments to full succinctness","key":"CG25","y":2025,"sub":"Given suitable RAM delegation, the compiler promotes a mildly succinct SNARK for NP to a fully succinct SNARK while preserving whether the base extractor is black box or non-black box."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2025-GALOIS-RINGS","s":"wzd25-transparent-snark-constructi","title":"Transparent SNARK constructions extend to arbitrary Galois rings","key":"WZD25","y":2025,"sub":"The paper extends expander-code commitments and existing proof frameworks to transparent SNARK constructions over arbitrary Galois rings with the sublinear verifier and proof bounds stated in its abstract."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2025-IBCS-QUANTUM","s":"cddgs25-quantum-ibcs-security","title":"Quantum IBCS security","key":"CDDGS25","y":2025,"sub":"The paper proves post-quantum soundness and Unruh-style knowledge soundness for interactive BCS instantiated with a semi-adaptive public-coin IOP and a collapse-position-binding vector commitment."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2025-JOLT-SPACE","s":"ntz25-small-space-jolt-prover","title":"Small-space Jolt prover","key":"NTZ25","y":2025,"sub":"The paper gives a small-space honest-prover strategy for the Jolt stack by streaming witness-dependent data and recomputing selected values, with an explicit time–space tradeoff rather than recursion-based sharding."},{"t":"proof-systems","k":"result","id":"PROOF-CONTRIB-2026-SNARG-UNPROVABILITY","s":"hjlm26-all-np-non-adaptive","title":"All-NP non-adaptive SNARGs from cryptography plus proof-unprovability","key":"HJLM26","y":2026,"sub":"The paper constructs a non-adaptively sound SNARG for all NP from prBPP = prP, LWE, SXDH, and a Hardness Certification assumption about proving Extended-Frege lower bounds in a weak bounded-arithmetic theory."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-1978-RSA","s":"rsa78-textbook-rsa-signature-relat","title":"Textbook RSA signature relation","key":"RSA78","y":1978,"sub":"Textbook RSA is the algebraic starting point of the RSA family; secure deployed RSA signatures require an encoding such as PSS."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-1988-GMR","s":"gmr88-gmr-provably-secure-signatur","title":"GMR provably secure signature","key":"GMR88","y":1988,"sub":"The canonical security-definition anchor, rather than a modern deployment profile."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-1991-SCHNORR","s":"schnorr91-schnorr-signature","title":"Schnorr signature","key":"Schnorr91","y":1991,"sub":"Nonce reuse or bias can reveal the signing key; deterministic and hedged nonce derivation are separate profile choices."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-1996-PSS","s":"br96-rsa-probabilistic-signature","title":"RSA Probabilistic Signature Scheme","key":"BR96","y":1996,"sub":"PSS is the security-oriented encoding layer missing from textbook RSA."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-1999-CS","s":"cs99-cramer-shoup-signature","title":"Cramer-Shoup signature","key":"CS99","y":1999,"sub":"An important standard-model branch distinct from the random-oracle encodings used by deployed RSA profiles."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2001-BLS","s":"bls01-boneh-lynn-shacham-signature","title":"Boneh-Lynn-Shacham signature","key":"BLS01","y":2001,"sub":"This entry is ordinary BLS signing; multisignatures and aggregation are separate functionalities."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2004-BB","s":"bb04-boneh-boyen-short-signature","title":"Boneh-Boyen short signature","key":"BB04","y":2004,"sub":"This entry is the full standard-model signature, not the weak-message variant from the same paper."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2008-GPV","s":"gpv08-gpv-lattice-signature-framew","title":"GPV lattice signature framework","key":"GPV08","y":2008,"sub":"The hash-and-sign lattice root later optimized by compact trapdoors and fast Fourier sampling."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2009-LYU","s":"lyubashevsky09-lyubashevsky-lattice-signatu","title":"Lyubashevsky lattice signature with rejection sampling","key":"Lyubashevsky09","y":2009,"sub":"Exact theorem and parameter locators remain queued for a local full-text audit."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2011-ED25519","s":"bdlsy11-ed25519-deterministic-edward","title":"Ed25519 deterministic Edwards-curve signature","key":"BDLSY11","y":2011,"sub":"The size fields describe Ed25519's reference encoding, not every EdDSA parameterization."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2018-DILITHIUM","s":"dkl18-crystals-dilithium","title":"CRYSTALS-Dilithium","key":"DKL+18","y":2018,"sub":"Algorithmic family card; exact FIPS encodings and parameter sets belong to the ML-DSA card. The paper's SUF-CMA bound (Section 4.2, Eq. 6) uses MLWE, MSIS, and the hash-combined SelfTargetMSIS problem."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2019-SPHINCSPLUS","s":"hkb19-sphincs-stateless-hash-based","title":"SPHINCS+ stateless hash-based signature","key":"HKB+19","y":2019,"sub":"The conservative-assumption branch trades comparatively large signatures and hashing work for stateless operation."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2020-FALCON","s":"fhk20-falcon-fast-fourier-lattice","title":"Falcon fast-Fourier lattice signature","key":"FHK+20","y":2020,"sub":"Implementation assurance centers on the correctness and side-channel behavior of the sampler as well as the algebraic core."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2024-MLDSA","s":"nist24-fips204-module-lattice-based-digital","title":"Module-Lattice-Based Digital Signature Standard","key":"NIST24/FIPS204","y":2024,"sub":"Use the three named FIPS parameter sets for concrete byte counts; this cross-family card deliberately avoids mixing them."},{"t":"signature","k":"scheme","id":"SIG-CONSTRUCTION-2024-SLHDSA","s":"nist24-fips205-stateless-hash-based-digital","title":"Stateless Hash-Based Digital Signature Standard","key":"NIST24/FIPS205","y":2024,"sub":"The SHA2 and SHAKE parameter families expose different speed/size/security tradeoffs and should be compared at parameter-set granularity."},{"t":"signature","k":"problem","id":"SIG-OP-002","s":"op-2","title":"Security of unmodified ECDSA without idealized models","key":null,"y":null,"sub":"Open problem · Is standard ECDSA unforgeable assuming only that discrete logarithms are hard, with at most the message hash idealized? Every known proof idealizes the group or the conversion function, and algebraic reduc"},{"t":"signature","k":"problem","id":"SIG-OP-003","s":"op-3","title":"Unforgeability of ECDSA in the generic group model","key":null,"y":null,"sub":"Solved problem · EUF-CMA security of unmodified ECDSA when the curve group is modeled as a generic group that also captures the conversion function and signature malleability. Solved in the elliptic-curve generic group m"},{"t":"signature","k":"problem","id":"SIG-OP-004","s":"op-4","title":"Unforgeability of ECDSA with an idealized conversion function","key":null,"y":null,"sub":"Solved problem · EUF-CMA security of unmodified ECDSA from discrete logarithms when the middle part of the conversion function is a programmable bijective random oracle. Solved."},{"t":"signature","k":"problem","id":"SIG-OP-005","s":"op-5","title":"Key-only unforgeability of ECDSA from discrete logarithms","key":null,"y":null,"sub":"Open problem · Unforgeability of unmodified ECDSA against adversaries that see only the public key, from discrete logarithms and without idealizing the group or the conversion function. Open; algebraic reductions must pr"},{"t":"signature","k":"problem","id":"SIG-OP-006","s":"op-6","title":"Signature length in the random oracle model","key":null,"y":null,"sub":"Open problem · Must every signature scheme built from a random oracle alone have signatures of about \\( \\lambda^{2} \\) bits, as known hash-based schemes do, or can it come closer to the \\( O(\\lambda) \\) bits of Schnorr s"},{"t":"signature","k":"paper","id":"SIG-PAPER-1978-RSA","s":"rsa78","title":"A Method for Obtaining Digital Signatures and Public-Key Cryptosystems","key":"RSA78","y":1978,"sub":"Ronald L. Rivest, Adi Shamir, Leonard M. Adleman · Communications of the ACM 21(2)"},{"t":"signature","k":"paper","id":"SIG-PAPER-1979-LAMPORT","s":"lamport79","title":"Constructing Digital Signatures from a One Way Function","key":"Lamport79","y":1979,"sub":"Leslie Lamport · SRI technical report CSL-98"},{"t":"signature","k":"paper","id":"SIG-PAPER-1986-FS","s":"fs86","title":"How to Prove Yourself: Practical Solutions to Identification and Signature Problems","key":"FS86","y":1986,"sub":"Amos Fiat, Adi Shamir · CRYPTO 1986"},{"t":"signature","k":"paper","id":"SIG-PAPER-1988-GMR","s":"gmr88","title":"A Digital Signature Scheme Secure Against Adaptive Chosen-Message Attacks","key":"GMR88","y":1988,"sub":"Shafi Goldwasser, Silvio Micali, Ronald L. Rivest · SIAM Journal on Computing 17(2)"},{"t":"signature","k":"paper","id":"SIG-PAPER-1989-MERKLE","s":"merkle89","title":"A Certified Digital Signature","key":"Merkle89","y":1989,"sub":"Ralph C. Merkle · CRYPTO 1989"},{"t":"signature","k":"paper","id":"SIG-PAPER-1991-SCHNORR","s":"schnorr91","title":"Efficient Signature Generation by Smart Cards","key":"Schnorr91","y":1991,"sub":"Claus-Peter Schnorr · Journal of Cryptology 4(3)"},{"t":"signature","k":"paper","id":"SIG-PAPER-1996-PSS","s":"br96","title":"Optimal Asymmetric Encryption and Signature","key":"BR96","y":1996,"sub":"Mihir Bellare, Phillip Rogaway · EUROCRYPT 1996"},{"t":"signature","k":"paper","id":"SIG-PAPER-1999-CS","s":"cs99","title":"Signature Schemes Based on the Strong RSA Assumption","key":"CS99","y":1999,"sub":"Ronald Cramer, Victor Shoup · ACM CCS 1999"},{"t":"signature","k":"paper","id":"SIG-PAPER-2001-BLS","s":"bls01","title":"Short Signatures from the Weil Pairing","key":"BLS01","y":2001,"sub":"Dan Boneh, Ben Lynn, Hovav Shacham · ASIACRYPT 2001"},{"t":"signature","k":"paper","id":"SIG-PAPER-2004-BB","s":"bb04","title":"Short Signatures Without Random Oracles","key":"BB04","y":2004,"sub":"Dan Boneh, Xavier Boyen · EUROCRYPT 2004"},{"t":"signature","k":"paper","id":"SIG-PAPER-2007-BM","s":"bm07","title":"Lower Bounds on Signatures From Symmetric Primitives","key":"BM07","y":2007,"sub":"Boaz Barak, Mohammad Mahmoody-Ghidary · FOCS 2007"},{"t":"signature","k":"paper","id":"SIG-PAPER-2008-GPV","s":"gpv08","title":"Trapdoors for Hard Lattices and New Cryptographic Constructions","key":"GPV08","y":2008,"sub":"Craig Gentry, Chris Peikert, Vinod Vaikuntanathan · STOC 2008"},{"t":"signature","k":"paper","id":"SIG-PAPER-2009-LYU","s":"lyubashevsky09","title":"Fiat-Shamir with Aborts: Applications to Lattice and Factoring-Based Signatures","key":"Lyubashevsky09","y":2009,"sub":"Vadim Lyubashevsky · ASIACRYPT 2009"},{"t":"signature","k":"paper","id":"SIG-PAPER-2011-ED25519","s":"bdlsy11","title":"High-Speed High-Security Signatures","key":"BDLSY11","y":2011,"sub":"Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang · CHES 2011"},{"t":"signature","k":"paper","id":"SIG-PAPER-2012-LYU","s":"lyubashevsky12","title":"Lattice Signatures Without Trapdoors","key":"Lyubashevsky12","y":2012,"sub":"Vadim Lyubashevsky · EUROCRYPT 2012"},{"t":"signature","k":"paper","id":"SIG-PAPER-2016-FKP","s":"fkp16","title":"On the Provable Security of (EC)DSA Signatures","key":"FKP16","y":2016,"sub":"Manuel Fersch, Eike Kiltz, Bertram Poettering · ACM CCS 2016"},{"t":"signature","k":"paper","id":"SIG-PAPER-2018-DILITHIUM","s":"dkl18","title":"CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme","key":"DKL+18","y":2018,"sub":"Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, Damien Stehlé · IACR TCHES 2018(1)"},{"t":"signature","k":"paper","id":"SIG-PAPER-2019-SPHINCSPLUS","s":"hkb19","title":"The SPHINCS+ Signature Framework","key":"HKB+19","y":2019,"sub":"Andreas Hülsing, Stefan Kölbl, Daniel J. Bernstein, Ruben Niederhagen, Joost Rijneveld, Peter Schwabe · ACM CCS 2019"},{"t":"signature","k":"paper","id":"SIG-PAPER-2020-FALCON","s":"fhk20","title":"Falcon: Fast-Fourier Lattice-Based Compact Signatures over NTRU","key":"FHK+20","y":2020,"sub":"Pierre-Alain Fouque, Jeffrey Hoffstein, Paul Kirchner, Vadim Lyubashevsky, Thomas Pornin, Thomas Prest, Thomas Ricosset, Gregor Seiler, William Whyte, Zhenfei Zhang · NIST PQC supporting documentation"},{"t":"signature","k":"paper","id":"SIG-PAPER-2022-GS","s":"gs22","title":"On the Security of ECDSA with Additive Key Derivation and Presignatures","key":"GS22","y":2022,"sub":"Jens Groth, Victor Shoup · EUROCRYPT 2022"},{"t":"signature","k":"paper","id":"SIG-PAPER-2023-BGZ","s":"bgz23","title":"A Lower Bound on the Length of Signatures Based on Group Actions and Generic Isogenies","key":"BGZ23","y":2023,"sub":"Dan Boneh, Jiaxin Guan, Mark Zhandry · EUROCRYPT 2023"},{"t":"signature","k":"paper","id":"SIG-PAPER-2023-FIPS186-5","s":"nist23","title":"FIPS 186-5: Digital Signature Standard","key":"NIST23","y":2023,"sub":"National Institute of Standards and Technology · FIPS 186-5"},{"t":"signature","k":"paper","id":"SIG-PAPER-2023-HK","s":"hk23","title":"Limits in the Provable Security of ECDSA Signatures","key":"HK23","y":2023,"sub":"Dominik Hartmann, Eike Kiltz · TCC 2023"},{"t":"signature","k":"paper","id":"SIG-PAPER-2024-FIPS204","s":"nist24-fips204","title":"FIPS 204: Module-Lattice-Based Digital Signature Standard","key":"NIST24/FIPS204","y":2024,"sub":"National Institute of Standards and Technology · FIPS 204"},{"t":"signature","k":"paper","id":"SIG-PAPER-2024-FIPS205","s":"nist24-fips205","title":"FIPS 205: Stateless Hash-Based Digital Signature Standard","key":"NIST24/FIPS205","y":2024,"sub":"National Institute of Standards and Technology · FIPS 205"},{"t":"signature","k":"paper","id":"SIG-PAPER-2026-CHMY","s":"chmy26","title":"Lower Bounds on Random-Oracle-Model Signature Length","key":"CHMY26","y":2026,"sub":"Alon Chayet, Iftach Haitner, Mathias Marty, Eylon Yogev · IACR ePrint 2026/2237"},{"t":"signature","k":"result","id":"SIG-RESULT-1978-RSA-PUBLIC-KEY-SIGNATURE-FEASIBILITY","s":"rsa78-rsa-public-verification-inte","title":"RSA public-verification interface","key":"RSA78","y":1978,"sub":"The RSA private transformation can produce a value that anyone holding the public key can verify, establishing a public-key signature interface."},{"t":"signature","k":"result","id":"SIG-RESULT-1979-LAMPORT-ONE-TIME-SIGNATURES-FROM-ONE-WAY-FUNCTIONS","s":"lamport79-one-way-function-one","title":"One-way-function one-time signatures","key":"Lamport79","y":1979,"sub":"Lamport constructs a one-time signature using only one-way functions."},{"t":"signature","k":"result","id":"SIG-RESULT-1986-FS-FIAT-SHAMIR-IDENTIFICATION-TO-SIGNATURE","s":"fs86-hash-compiled-identification","title":"Hash-compiled identification signatures","key":"FS86","y":1986,"sub":"The Fiat–Shamir transform replaces a public-coin verifier challenge with a hash of the message and commitment to obtain a noninteractive signature."},{"t":"signature","k":"result","id":"SIG-RESULT-1988-GMR-ADAPTIVE-CHOSEN-MESSAGE-UNFORGEABILITY","s":"gmr88-adaptive-chosen-message-unfo","title":"Adaptive chosen-message unforgeability","key":"GMR88","y":1988,"sub":"GMR formalizes signature security against an adversary that adaptively obtains signatures before forging a new message."},{"t":"signature","k":"result","id":"SIG-RESULT-1989-MERKLE-MERKLE-TREE-MANY-TIME-HASH-SIGNATURES","s":"merkle89-stateful-merkle-many-time","title":"Stateful Merkle many-time signatures","key":"Merkle89","y":1989,"sub":"A Merkle authentication tree binds many one-time verification keys to one public root, enabling a bounded number of signatures."},{"t":"signature","k":"result","id":"SIG-RESULT-1991-SCHNORR-COMPACT-DISCRETE-LOG-SIGNATURE","s":"schnorr91-offline-precomputable-schnor","title":"Offline-precomputable Schnorr signing","key":"Schnorr91","y":1991,"sub":"Schnorr gives a compact discrete-log signature whose commitment computation can be performed before the message is known."},{"t":"signature","k":"result","id":"SIG-RESULT-1996-PSS-RSA-PSS-PROBABILISTIC-ENCODING","s":"br96-randomized-rsa-pss-encoding","title":"Randomized RSA-PSS encoding","key":"BR96","y":1996,"sub":"PSS randomizes and structures the message representative before applying the RSA private operation."},{"t":"signature","k":"result","id":"SIG-RESULT-1996-PSS-TIGHT-ROM-RSA-SIGNATURES","s":"br96-reduction-oriented-rsa-pss","title":"Reduction-oriented RSA-PSS security in the random-oracle model","key":"BR96","y":1996,"sub":"The PSS analysis relates adaptive signature forgery to inverting the underlying RSA permutation in the random-oracle model."},{"t":"signature","k":"result","id":"SIG-RESULT-1999-CS-EFFICIENT-STANDARD-MODEL-SIGNATURES","s":"cs99-stateless-strong-rsa-signing","title":"Stateless Strong-RSA signing","key":"CS99","y":1999,"sub":"Cramer–Shoup gives a stateless Strong-RSA signature construction that the paper compares as more efficient than earlier provably secure standard-model schemes."},{"t":"signature","k":"result","id":"SIG-RESULT-1999-CS-STRONG-RSA-EUF-CMA","s":"cs99-euf-cma-security-from","title":"EUF-CMA security from Strong RSA without random oracles","key":"CS99","y":1999,"sub":"The Cramer–Shoup signature is proved adaptively unforgeable under the Strong RSA assumption in the standard model."},{"t":"signature","k":"result","id":"SIG-RESULT-2001-BLS-CDH-ROM-EUF-CMA","s":"bls01-bls-unforgeability-from-cdh","title":"BLS unforgeability from CDH in the random-oracle model","key":"BLS01","y":2001,"sub":"The BLS signature is analyzed for adaptive chosen-message unforgeability from computational Diffie–Hellman in the random-oracle model."},{"t":"signature","k":"result","id":"SIG-RESULT-2001-BLS-ONE-GROUP-ELEMENT-PAIRING-SIGNATURES","s":"bls01-one-element-pairing-signatur","title":"One-element pairing signatures","key":"BLS01","y":2001,"sub":"BLS hashes a message to a group and signs with one exponentiation, yielding a signature represented by one group element."},{"t":"signature","k":"result","id":"SIG-RESULT-2004-BB-Q-SDH-EUF-CMA","s":"bb04-euf-cma-proof-for","title":"EUF-CMA proof for short signatures under q-SDH","key":"BB04","y":2004,"sub":"The Boneh–Boyen analysis derives chosen-message unforgeability for its short signature from the q-Strong Diffie–Hellman assumption."},{"t":"signature","k":"result","id":"SIG-RESULT-2004-BB-SHORT-STANDARD-MODEL-SIGNATURES","s":"bb04-short-standard-model-pairing","title":"Short standard-model pairing signatures","key":"BB04","y":2004,"sub":"Boneh–Boyen constructs short pairing-based signatures with a standard-model security proof."},{"t":"signature","k":"result","id":"SIG-RESULT-2008-GPV-LATTICE-HASH-AND-SIGN","s":"gpv08-gpv-lattice-hash-and","title":"GPV lattice hash-and-sign","key":"GPV08","y":2008,"sub":"GPV signs by hashing a message to a lattice syndrome and sampling a short preimage with a trapdoor."},{"t":"signature","k":"result","id":"SIG-RESULT-2008-GPV-LATTICE-PREIMAGE-SAMPLING-TRAPDOORS","s":"gpv08-short-lattice-preimage-sampl","title":"Short lattice preimage sampling","key":"GPV08","y":2008,"sub":"GPV develops lattice trapdoors supporting short preimage sampling with distributions suitable for cryptographic use."},{"t":"signature","k":"result","id":"SIG-RESULT-2009-LYU-FIAT-SHAMIR-WITH-ABORTS","s":"lyubashevsky09-abort-sampling-hides-secrets","title":"Abort sampling hides secrets in lattice Fiat–Shamir signatures","key":"Lyubashevsky09","y":2009,"sub":"Fiat–Shamir with aborts uses rejection sampling so accepted response distributions are sufficiently independent of the lattice signing secret."},{"t":"signature","k":"result","id":"SIG-RESULT-2011-ED25519-DETERMINISTIC-NONCE-SIDE-CHANNEL-DISCIPLINE","s":"bdlsy11-deterministic-nonce-derivati","title":"Deterministic nonce derivation and constant-time signing discipline","key":"BDLSY11","y":2011,"sub":"Ed25519 derives the signing nonce from secret material and the message and uses a constant-time-oriented implementation profile."},{"t":"signature","k":"result","id":"SIG-RESULT-2011-ED25519-ED25519-ENGINEERING-PROFILE","s":"bdlsy11-ed25519-software-profile","title":"Ed25519 software profile","key":"BDLSY11","y":2011,"sub":"Ed25519 combines a twisted Edwards curve, fixed encodings, deterministic signing, and constant-time-oriented software into a named signature profile."},{"t":"signature","k":"result","id":"SIG-RESULT-2012-LYU-TRAPDOOR-FREE-LATTICE-SIGNATURES","s":"lyubashevsky12-lattice-signatures-without-t","title":"Lattice signatures without trapdoors","key":"Lyubashevsky12","y":2012,"sub":"Lyubashevsky builds a Fiat–Shamir-style lattice signature without trapdoors, in which rejection sampling against a discrete Normal distribution makes each output signature independent of the short secret key, giving sign"},{"t":"signature","k":"result","id":"SIG-RESULT-2018-DILITHIUM-GAUSSIAN-FREE-CONSTANT-TIME-DESIGN","s":"dkl18-gaussian-free-constant-time","title":"Gaussian-free, constant-time-oriented Dilithium signing","key":"DKL+18","y":2018,"sub":"Dilithium avoids discrete Gaussian sampling and uses simple bounded distributions and arithmetic designed for constant-time implementation."},{"t":"signature","k":"result","id":"SIG-RESULT-2018-DILITHIUM-MODULE-LATTICE-FSWA-SIGNATURE","s":"dkl18-module-lattice-fiat-shamir","title":"Module-lattice Fiat–Shamir with aborts","key":"DKL+18","y":2018,"sub":"Dilithium builds a module-lattice Fiat–Shamir-with-aborts signature with uniformly sampled bounded secrets and masks, in which signers supply hints so that low-order bits of the public key can be dropped."},{"t":"signature","k":"result","id":"SIG-RESULT-2019-SPHINCSPLUS-STATELESS-HASH-BASED-HYPERTREE","s":"hkb19-smaller-faster-stateless-has","title":"Smaller, faster stateless hash-based signatures","key":"HKB+19","y":2019,"sub":"SPHINCS+ is a stateless hash-based signature framework, built from FORS, WOTS+, and a hypertree, that improves upon SPHINCS in speed and signature size."},{"t":"signature","k":"result","id":"SIG-RESULT-2020-FALCON-COMPACT-LATTICE-SIGNATURES","s":"fhk20-compact-ntru-lattice-signatu","title":"Compact NTRU-lattice signatures","key":"FHK+20","y":2020,"sub":"Falcon realizes short public keys and signatures by instantiating GPV hash-and-sign over structured NTRU lattices."},{"t":"signature","k":"result","id":"SIG-RESULT-2020-FALCON-GPV-NTRU-FAST-FOURIER-SAMPLING","s":"fhk20-ntru-fast-fourier-sampling","title":"NTRU fast Fourier sampling","key":"FHK+20","y":2020,"sub":"Falcon implements GPV-style short-preimage signing over NTRU lattices using fast Fourier sampling."},{"t":"signature","k":"result","id":"SIG-RESULT-2023-FIPS186-5-CURRENT-CLASSICAL-NIST-SIGNATURES","s":"nist23-fips-186-5-profiles","title":"FIPS 186-5 profiles approved classical digital signatures","key":"NIST23","y":2023,"sub":"FIPS 186-5 normatively specifies federal use of RSA, ECDSA, and EdDSA signature methods and revises legacy DSA status."},{"t":"signature","k":"result","id":"SIG-RESULT-2024-FIPS204-ML-DSA-STANDARDIZATION","s":"nist24-fips204-ml-dsa-standardizes-the","title":"ML-DSA standardizes the Dilithium-derived module-lattice signature","key":"NIST24/FIPS204","y":2024,"sub":"FIPS 204 specifies ML-DSA algorithms, encodings, parameter sets, and interfaces derived from the Dilithium design."},{"t":"signature","k":"result","id":"SIG-RESULT-2024-FIPS205-SLH-DSA-STANDARDIZATION","s":"nist24-fips205-slh-dsa-standardizes-statele","title":"SLH-DSA standardizes stateless hash-based signatures","key":"NIST24/FIPS205","y":2024,"sub":"FIPS 205 specifies SLH-DSA algorithms, encodings, and parameter sets derived from SPHINCS+."},{"t":"signature","k":"assumption","id":"ASM-CDH","s":"cdh","title":"Computational Diffie-Hellman (CDH)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\)."},{"t":"signature","k":"assumption","id":"ASM-CLAWFREE-TDP","s":"clawfree-tdp","title":"Claw-free trapdoor permutation pairs","key":null,"y":null,"sub":"A claw-free pair is a family of pairs of permutations \\( (f_0, f_1) \\) on a common domain \\( D \\), generated together with trapdoors for inverting them, such that given the public description no probabilistic polynomial-"},{"t":"signature","k":"assumption","id":"ASM-DLOG","s":"dlog","title":"Discrete logarithm (DL)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\) output by a group generator (a subgroup of \\( \\mathbb{F}_q^* \\), or the group of points of an elliptic curve such as Curve25519 or its twi"},{"t":"signature","k":"assumption","id":"ASM-GAPSVP","s":"gapsvp","title":"Worst-case approximate lattice problems (GapSVP and SIVP)","key":null,"y":null,"sub":"Let \\( \\mathcal{L} \\subset \\mathbb{R}^n \\) be a lattice given by a basis, let \\( \\lambda_1(\\mathcal{L}) \\) be the length of a shortest nonzero vector and \\( \\lambda_n(\\mathcal{L}) \\) the smallest \\( r \\) such that \\( \\ma"},{"t":"signature","k":"assumption","id":"ASM-HASH-SPR","s":"hash-spr","title":"Second-preimage and target-collision resistance of hash functions (multi-target variants)","key":null,"y":null,"sub":"Let \\( H_k : \\{0,1\\}^{*} \\to \\{0,1\\}^{n} \\) be a keyed hash function family."},{"t":"signature","k":"assumption","id":"ASM-MLWE","s":"mlwe","title":"Module learning with errors (Module-LWE)","key":null,"y":null,"sub":"Let \\( R = \\mathbb{Z}[x]/(x^n + 1) \\) (or another ring of integers of degree \\( n \\)), \\( R_q = R/qR \\), and let \\( d \\ge 1 \\) be the module rank."},{"t":"signature","k":"assumption","id":"ASM-MSIS","s":"msis","title":"Module short integer solution (Module-SIS)","key":null,"y":null,"sub":"Let \\( R_q = \\mathbb{Z}_q[x]/(x^n + 1) \\)."},{"t":"signature","k":"assumption","id":"ASM-NTRU","s":"ntru","title":"NTRU assumption (NTRU)","key":null,"y":null,"sub":"Let \\( R = \\mathbb{Z}[x]/(\\phi(x)) \\) with \\( \\phi = x^n - 1 \\) in the original scheme or \\( \\phi = x^n + 1 \\) in later ones, and \\( R_q = R/qR \\)."},{"t":"signature","k":"assumption","id":"ASM-PRF","s":"prf","title":"Pseudorandom functions (PRF)","key":null,"y":null,"sub":"A keyed function family \\( F : \\{0,1\\}^{\\lambda} \\times \\{0,1\\}^{n} \\to \\{0,1\\}^{m} \\) is a pseudorandom function if, for a uniformly random key \\( k \\), no probabilistic polynomial-time adversary with oracle access to \\"},{"t":"signature","k":"assumption","id":"ASM-QSDH","s":"qsdh","title":"q-strong Diffie-Hellman (q-SDH)","key":null,"y":null,"sub":"Let \\( (\\mathbb{G}_1, \\mathbb{G}_2) \\) be groups of prime order \\( p \\) with generators \\( g_1, g_2 \\) and a bilinear map."},{"t":"signature","k":"assumption","id":"ASM-RSA","s":"rsa","title":"RSA assumption (RSA)","key":null,"y":null,"sub":"Let \\( N = pq \\) be a product of two random primes of equal length and let \\( e \\) be an exponent with \\( \\gcd(e, \\varphi(N)) = 1 \\) (fixed small values such as \\( e = 65537 \\), or random)."},{"t":"signature","k":"assumption","id":"ASM-RSIS","s":"rsis","title":"Ring short integer solution (Ring-SIS)","key":null,"y":null,"sub":"Let \\( R = \\mathbb{Z}[x]/(f(x)) \\) with \\( f \\) monic, irreducible and of degree \\( n \\) (the standard choice is \\( f = x^n + 1 \\) with \\( n \\) a power of two), and \\( R_q = R/qR \\)."},{"t":"signature","k":"assumption","id":"ASM-SIS","s":"sis","title":"Short integer solution (SIS)","key":null,"y":null,"sub":"Fix \\( n \\), a modulus \\( q \\), a width \\( m \\ge n \\log q \\) and a norm bound \\( \\beta < q \\)."},{"t":"signature","k":"assumption","id":"ASM-STRONG-RSA","s":"strong-rsa","title":"Strong RSA assumption (strong RSA)","key":null,"y":null,"sub":"Let \\( N \\) be an RSA modulus (often a product of two safe primes)."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-1977-DES","s":"nbs77-des","title":"DES","key":"NBS77","y":1977,"sub":"DES is included only to explain the standardization transition to AES."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2001-AES","s":"nist01-aes","title":"AES","key":"NIST01","y":2001,"sub":"AES is a primitive. Confidentiality and authentication properties depend on the mode that uses it."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2001-AESCBC","s":"dworkin01-aes-cbc","title":"AES-CBC","key":"Dworkin01","y":2001,"sub":"CBC does not authenticate ciphertext. Padding and composition rules are outside this row."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2001-AESCTR","s":"dworkin01-aes-ctr","title":"AES-CTR","key":"Dworkin01","y":2001,"sub":"CTR is a confidentiality component used inside several AEAD constructions; it provides no integrity by itself."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2004-CCM","s":"dworkin04-aes-ccm","title":"AES-CCM","key":"Dworkin04","y":2004,"sub":"CCM combines two sequential views of the message and is not a one-pass online AEAD."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2007-GCM","s":"dworkin07-aes-gcm","title":"AES-GCM","key":"Dworkin07","y":2007,"sub":"The row makes nonce uniqueness prominent because GCM’s failure mode under reuse is a defining deployment constraint."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2008-AESSIV","s":"harkins08-aes-siv","title":"AES-SIV","key":"Harkins08","y":2008,"sub":"“Misuse resistant” is not “misuse proof”: deterministic equality leakage and usage limits remain."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2008-CHACHA","s":"bernstein08-chacha-stream-cipher-family","title":"ChaCha stream cipher family","key":"Bernstein08","y":2008,"sub":"The original family and the later 96-bit-nonce IETF profile are kept as distinct rows."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2018-CHACHAPOLY","s":"nl18-chacha20-poly1305","title":"ChaCha20-Poly1305","key":"NL18","y":2018,"sub":"The RFC is a stable algorithm reference; its Informational status is not silently relabeled as an Internet Standard."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2019-GCMSIV","s":"gll19-aes-gcm-siv","title":"AES-GCM-SIV","key":"GLL19","y":2019,"sub":"GCM-SIV is a distinct construction from GCM; their nonce-failure behavior must not be merged."},{"t":"symmetric-aead","k":"scheme","id":"SYM-CONSTRUCTION-2025-ASCONAEAD128","s":"tmkkc25-ascon-aead128","title":"Ascon-AEAD128","key":"TMKKC25","y":2025,"sub":"This row uses the final 2025 NIST profile, not the byte-order and naming conventions of earlier Ascon submissions."},{"t":"symmetric-aead","k":"problem","id":"SYM-OP-001","s":"op-1","title":"Ascon mode security with related inner and outer permutations","key":null,"y":null,"sub":"Open problem · Can the Ascon AEAD mode be proved secure in an ideal model that treats its inner permutation as the last rounds of its outer one? Every proof so far models the two as the same random permutation or as inde"},{"t":"symmetric-aead","k":"problem","id":"SYM-OP-002","s":"op-2","title":"Ascon security from assumptions weaker than ideal permutations","key":null,"y":null,"sub":"Open problem · Can the Ascon AEAD mode be proved secure from an assumption on its permutations weaker than modeling them as random? Every proof uses an ideal permutation, which the actual permutations are not."},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-1977-DES","s":"nbs77","title":"Data Encryption Standard","key":"NBS77","y":1977,"sub":"National Bureau of Standards · FIPS PUB 46"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2001-AES","s":"nist01","title":"Advanced Encryption Standard (AES)","key":"NIST01","y":2001,"sub":"National Institute of Standards and Technology · FIPS 197"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2001-SP80038A","s":"dworkin01","title":"Recommendation for Block Cipher Modes of Operation — Methods and Techniques","key":"Dworkin01","y":2001,"sub":"Morris Dworkin · NIST SP 800-38A"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2002-AEAD","s":"rogaway02","title":"Authenticated-Encryption with Associated-Data","key":"Rogaway02","y":2002,"sub":"Phillip Rogaway · ACM CCS 2002"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2004-CCM","s":"dworkin04","title":"Recommendation for Block Cipher Modes of Operation — The CCM Mode for Authentication and Confidentiality","key":"Dworkin04","y":2004,"sub":"Morris Dworkin · NIST SP 800-38C"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2004-EAX","s":"brw04","title":"The EAX Mode of Operation (A Two-Pass Authenticated-Encryption Scheme Optimized for Simplicity and Efficiency)","key":"BRW04","y":2004,"sub":"Mihir Bellare, Phillip Rogaway, David Wagner · FSE 2004"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2007-GCM","s":"dworkin07","title":"Recommendation for Block Cipher Modes of Operation — Galois/Counter Mode (GCM) and GMAC","key":"Dworkin07","y":2007,"sub":"Morris Dworkin · NIST SP 800-38D"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2008-CHACHA","s":"bernstein08","title":"ChaCha, a Variant of Salsa20","key":"Bernstein08","y":2008,"sub":"Daniel J. Bernstein · SASC 2008"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2008-SIV","s":"harkins08","title":"Synthetic Initialization Vector (SIV) Authenticated Encryption Using AES","key":"Harkins08","y":2008,"sub":"Dan Harkins · RFC 5297"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2014-ASCON","s":"dems14","title":"Ascon v1 — Submission to the CAESAR Competition","key":"DEMS14","y":2014,"sub":"Christoph Dobraunig, Maria Eichlseder, Florian Mendel, Martin Schläffer · CAESAR round-one submission"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2018-RFC8439","s":"nl18","title":"ChaCha20 and Poly1305 for IETF Protocols","key":"NL18","y":2018,"sub":"Yoav Nir, Adam Langley · RFC 8439"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2019-GCMSIV","s":"gll19","title":"AES-GCM-SIV — Nonce Misuse-Resistant Authenticated Encryption","key":"GLL19","y":2019,"sub":"Shay Gueron, Adam Langley, Yehuda Lindell · RFC 8452"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2022-ADGKLS","s":"adg22","title":"How to Abuse and Fix Authenticated Encryption Without Key Commitment","key":"ADG+22","y":2022,"sub":"Ange Albertini, Thai Duong, Shay Gueron, Stefan Kölbl, Atul Luykx, Sophie Schmieg · USENIX Security 2022"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2023-CDN","s":"cdn23","title":"Exact Security Analysis of ASCON","key":"CDN23","y":2023,"sub":"Bishwajit Chakraborty, Chandranan Dhar, Mridul Nandi · ASIACRYPT 2023"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2023-MLGR","s":"mlgr23","title":"Context Discovery and Commitment Attacks: How to Break CCM, EAX, SIV, and More","key":"MLGR23","y":2023,"sub":"Sanketh Menda, Julia Len, Paul Grubbs, Thomas Ristenpart · EUROCRYPT 2023"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2024-BH","s":"bh24","title":"Succinctly-Committing Authenticated Encryption","key":"BH24","y":2024,"sub":"Mihir Bellare, Viet Tung Hoang · CRYPTO 2024"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2024-LM","s":"lm24","title":"Generic Security of the Ascon Mode: On the Power of Key Blinding","key":"LM24","y":2024,"sub":"Charlotte Lefevre, Bart Mennink · SAC 2024"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2025-ASCON-SOK","s":"lm25","title":"SoK: Security of the Ascon Modes","key":"LM25","y":2025,"sub":"Charlotte Lefevre, Bart Mennink · IACR Transactions on Symmetric Cryptology (ToSC) 2025"},{"t":"symmetric-aead","k":"paper","id":"SYM-PAPER-2025-SP800232","s":"tmkkc25","title":"Ascon-Based Lightweight Cryptography Standards for Constrained Devices","key":"TMKKC25","y":2025,"sub":"Meltem Sönmez Turan, Kerry McKay, Jinkeon Kang, John Kelsey, Donghoon Chang · NIST SP 800-232"},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-1977-DES-DES-64-BIT-BLOCK-CIPHER-STANDARD","s":"nbs77-federal-standardization-of-t","title":"Federal standardization of the 56-bit-key DES block cipher","key":"NBS77","y":1977,"sub":"FIPS PUB 46 normatively specifies DES as a 64-bit-block cipher with a 56-bit effective key."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2001-AES-AES-128-BIT-BLOCK-CIPHER-STANDARD","s":"nist01-federal-standardization-of-1","title":"Federal standardization of 128-bit-block AES with three key sizes","key":"NIST01","y":2001,"sub":"FIPS 197 normatively specifies AES with a 128-bit block and 128-, 192-, or 256-bit keys."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2001-SP80038A-CBC-CONFIDENTIALITY-MODE","s":"dworkin01-nist-specification-of-cbc","title":"NIST specification of CBC as a confidentiality-only block-cipher mode","key":"Dworkin01","y":2001,"sub":"SP 800-38A specifies CBC chaining for confidentiality under an approved block cipher and does not provide integrated ciphertext authentication."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2001-SP80038A-CTR-CONFIDENTIALITY-MODE","s":"dworkin01-nist-specification-of-parall","title":"NIST specification of parallel counter-mode confidentiality","key":"Dworkin01","y":2001,"sub":"SP 800-38A specifies CTR mode by encrypting distinct counter blocks to form a keystream that is XORed with plaintext."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2004-CCM-CCM-CTR-CBC-MAC-AEAD","s":"dworkin04-nist-specification-of-ccm","title":"NIST specification of CCM's CTR-plus-CBC-MAC AEAD composition","key":"Dworkin04","y":2004,"sub":"SP 800-38C specifies CCM authenticated encryption by combining counter-mode encryption with CBC-MAC over formatted plaintext and associated data."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2007-GCM-GCM-COUNTER-MODE-PLUS-UNIVERSAL-HASH-AEAD","s":"dworkin07-nist-specification-of-gcm","title":"NIST specification of GCM's CTR-plus-GHASH AEAD composition","key":"Dworkin07","y":2007,"sub":"SP 800-38D specifies GCM authenticated encryption by combining counter-mode encryption with GHASH polynomial authentication over ciphertext and associated data."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2008-CHACHA-CHACHA-ARX-STREAM-CIPHER","s":"bernstein08-chacha-s-revised-arx","title":"ChaCha's revised ARX round function for software stream encryption","key":"Bernstein08","y":2008,"sub":"ChaCha revises Salsa20's add-rotate-XOR round function and state update to define a family of stream ciphers with changed diffusion behavior."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2008-SIV-AES-SIV-NONCE-MISUSE-RESISTANT-AEAD","s":"harkins08-informational-rfc-profile-fo","title":"Informational RFC profile for AES-SIV deterministic and nonce-misuse-resistant AEAD","key":"Harkins08","y":2008,"sub":"RFC 5297 specifies AES-SIV, which computes a synthetic IV with S2V and then applies AES-CTR to provide deterministic or nonce-based authenticated encryption."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2014-ASCON-ASCON-PERMUTATION-BASED-LIGHTWEIGHT-AEAD","s":"dems14-ascon-permutation-duplex-non","title":"Ascon permutation-duplex nonce AEAD family for constrained environments","key":"DEMS14","y":2014,"sub":"The initial Ascon v1 submission defines nonce-based authenticated encryption around one 320-bit permutation, a keyed duplex-style state, and domain-separated processing phases."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2018-RFC8439-CHACHA20-POLY1305-AEAD","s":"nl18-ietf-profile-of-chacha20","title":"IETF profile of ChaCha20-Poly1305 with a 96-bit nonce","key":"NL18","y":2018,"sub":"RFC 8439 specifies the ChaCha20 stream-cipher profile, Poly1305 one-time authenticator use, and their AEAD composition with a 256-bit key, 96-bit nonce, and 128-bit tag."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2019-GCMSIV-AES-GCM-SIV-MISUSE-RESISTANT-AEAD","s":"gll19-cfrg-profile-of-aes","title":"CFRG profile of AES-GCM-SIV with per-record keys and bounded nonce-reuse resistance","key":"GLL19","y":2019,"sub":"RFC 8452 specifies AES-GCM-SIV, deriving per-record keys and a synthetic IV with POLYVAL before counter-mode encryption."},{"t":"symmetric-aead","k":"result","id":"SYM-RESULT-2025-SP800232-ASCON-AEAD128-NORMATIVE-STANDARD","s":"tmkkc25-nist-standardization-of-the","title":"NIST standardization of the Ascon-AEAD128 lightweight profile","key":"TMKKC25","y":2025,"sub":"SP 800-232 normatively specifies Ascon-AEAD128 for authenticated encryption in constrained-device settings."},{"t":"symmetric-aead","k":"assumption","id":"ASM-AES-PRP","s":"aes-prp","title":"AES as a pseudorandom permutation (AES PRP)","key":null,"y":null,"sub":"AES is the block cipher \\( E : \\{0,1\\}^{\\kappa} \\times \\{0,1\\}^{128} \\to \\{0,1\\}^{128} \\) with key length \\( \\kappa \\in \\{128, 192, 256\\} \\) specified in FIPS 197 (`SYM-PAPER-2001-AES`)."},{"t":"symmetric-aead","k":"assumption","id":"ASM-ASCON","s":"ascon","title":"Security of Ascon-AEAD128 (Ascon permutation in duplex mode)","key":null,"y":null,"sub":"Ascon-AEAD128 (`SYM-PAPER-2025-SP800232`, derived from `SYM-PAPER-2014-ASCON`) is a nonce-based authenticated encryption scheme built from a 320-bit permutation \\( p \\) used in a duplex sponge mode, with 12 rounds of \\( "},{"t":"symmetric-aead","k":"assumption","id":"ASM-CHACHA20","s":"chacha20","title":"ChaCha20 block function as a PRF (ChaCha20)","key":null,"y":null,"sub":"The ChaCha block function maps a 256-bit key \\( k \\), a block counter and a nonce to a 512-bit output by applying 20 rounds (10 double rounds) of add-rotate-xor quarter-round operations to a \\( 4 \\times 4 \\) matrix of 32"},{"t":"symmetric-aead","k":"assumption","id":"ASM-DES-PRP","s":"des-prp","title":"DES as a pseudorandom permutation (DES PRP)","key":null,"y":null,"sub":"DES is the 16-round Feistel block cipher \\( E : \\{0,1\\}^{56} \\times \\{0,1\\}^{64} \\to \\{0,1\\}^{64} \\) of FIPS 46 (`SYM-PAPER-1977-DES`)."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-1996-GJKR-DSS","s":"gjkr96b-gjkr-robust-threshold-dss","title":"GJKR robust threshold DSS","key":"GJKR96b","y":1996,"sub":"Robust threshold DSS. The signing key and a fresh nonce are Shamir-shared among the \\( n \\) servers; \\( 2t_c+1 \\) of them compute \\( r \\) and their signature shares, and error correction lets the honest servers finish de"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-1996-GJKR-RSA","s":"gjkr96a-gjkr-robust-threshold-rsa","title":"GJKR robust threshold RSA line","key":"GJKR96a","y":1996,"sub":"Robust threshold RSA. A dealer shares the RSA exponent among the \\( n \\) servers; each applies its share to the message, and the combiner checks the shares, interactively or non-interactively, before assembling an ordina"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2000-SHOUP","s":"shoup00-shoup-practical-threshold-rs","title":"Shoup practical threshold RSA","key":"Shoup00","y":2000,"sub":"Practical threshold RSA. A trusted dealer shares the RSA exponent; each server outputs a signature share with a non-interactive proof that it is correct, and any \\( t \\) valid shares combine into a standard RSA signature"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2003-BOLDYREVA","s":"boldyreva03-boldyreva-threshold-bls-gdh","title":"Boldyreva threshold BLS/GDH signature","key":"Boldyreva03","y":2003,"sub":"Threshold BLS. Servers hold Shamir shares of the BLS key and sign the hashed message with them; each share can be checked with a pairing, and any \\( t \\) shares combine by interpolation in the exponent into a standard BL"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2017-LINDELL","s":"lindell17-lindell-fast-two-party","title":"Lindell fast two-party ECDSA","key":"Lindell17","y":2017,"sub":"Fast two-party ECDSA. One party holds a Paillier encryption of its key share; the other computes an encryption of its part of the signature homomorphically, and the first decrypts it and completes the ECDSA signature."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2018-DKLS2","s":"dkls18-dkls-ot-based-2","title":"DKLs OT-based 2-of-2 threshold ECDSA","key":"DKLs18","y":2018,"sub":"Two-party ECDSA from oblivious transfer. The two parties hold multiplicative shares of the key and compute the products ECDSA needs with OT-based Gilboa multiplication instead of Paillier encryption."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2018-DKLS2N","s":"dkls18-dkls-ot-based-2-2","title":"DKLs OT-based 2-of-n threshold ECDSA","key":"DKLs18","y":2018,"sub":"The 2-of-\\( n \\) version of the two-party OT-based ECDSA protocol. Lagrange coefficients turn two parties' Shamir shares of the key into additive shares, and the two sign with three OT-based products."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2018-GG","s":"gg18-gennaro-goldfeder-threshold","title":"Gennaro-Goldfeder threshold ECDSA","key":"GG18","y":2018,"sub":"Threshold ECDSA with fast, dealerless setup. Signers convert multiplicative shares of the nonce and key products into additive ones with a Paillier-based multiplicative-to-additive (MtA) protocol, and check the result be"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2019-DKLSN","s":"dkls19-dkls-threshold-ecdsa-from","title":"DKLs threshold ECDSA from ECDSA assumptions","key":"DKLs19","y":2019,"sub":"Threshold ECDSA for any \\( t \\)-of-\\( n \\) from ECDSA's own assumptions. The OT-based two-party multiplication runs between every pair of signers, and every round but the last can run before the message is known."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2020-CGGMP","s":"cggmp20-uc-noninteractive-online-thr","title":"UC noninteractive-online threshold ECDSA with identifiable aborts","key":"CGGMP20","y":2020,"sub":"UC-secure threshold ECDSA with identifiable abort and proactive key refresh. A three-round presigning phase, run before the message is known, leaves one non-interactive signing round."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2020-FROST","s":"kg20-frost-threshold-schnorr","title":"FROST threshold Schnorr","key":"KG20","y":2020,"sub":"Two-round threshold Schnorr. In a preprocessing round signers publish nonce commitments; once the message is known each sends one response, bound to all commitments by a binding factor, and an aggregator combines them in"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2021-DOTT","s":"dott21-dott-n-out-of","title":"DOTT n-out-of-n lattice signature","key":"DOTT21","y":2021,"sub":"Two-round \\( n \\)-of-\\( n \\) lattice signature with rejection sampling (Fiat–Shamir with aborts). Signers commit to their masking terms with a lattice trapdoor commitment, so a rejected attempt leaks nothing, and restart"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2021-GKMN","s":"gkmn21-gkmn-deterministic-nonce-thr","title":"GKMN deterministic-nonce threshold Schnorr","key":"GKMN21","y":2021,"sub":"\\( n \\)-of-\\( n \\) Schnorr without nonce state. Each party derives its nonce from the message with a PRF and proves, with a zero-knowledge proof from garbled circuits, that it did so honestly."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2022-DILIZIUM2","s":"lsv22-dilizium-2-0-two","title":"DiLizium 2.0 two-party Dilithium-line signature","key":"LSV22","y":2022,"sub":"Two-party Dilithium-like signing. The parties commit to their masking vectors with a homomorphic lattice commitment, combine them into one challenge, and restart whenever rejection sampling fails for either party."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2023-GKS","s":"gks23-gks-threshold-he-lattice","title":"GKS threshold-HE lattice signature","key":"GKS23","y":2023,"sub":"Two-round threshold lattice signature without aborts. Signers hide their contributions with large noise and compute the signature through threshold homomorphic encryption and zero-knowledge proofs, for any \\( t \\)-of-\\( "},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2023-OLAF","s":"cgrs23-olaf-frost3-with-pedersen","title":"Olaf FROST3 with Pedersen DKG","key":"CGRS23","y":2023,"sub":"Threshold Schnorr in the FROST family with an untrusted coordinator: one message-independent preprocessing round, then one signing round, proved secure under AOMDL in the random oracle model without the algebraic group m"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2024-TANG","s":"tpcz23-functionally-interchangeable","title":"Functionally interchangeable lattice threshold signature","key":"TPCZ23","y":2023,"sub":"Functionally interchangeable threshold lattice signature built on MPC. Shared random bits and multiplication triples are preprocessed, and signing runs Dilithium-style rejection sampling on secret-shared values."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2024-AOMMLWE","s":"ekt24-two-round-threshold-signatur","title":"Two-round threshold signature from AOM-MLWE","key":"EKT24","y":2024,"sub":"Two-round threshold lattice signature in the Raccoon style. Signers publish message-independent tokens in a preprocessing round and sign in one round; large noise hides the key, so no attempt is rejected."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2024-FLOOD","s":"enp24-robust-hash-and-sign","title":"Robust hash-and-sign lattice threshold signature","key":"ENP24","y":2024,"sub":"Robust threshold lattice hash-and-sign (a threshold Plover). Signers jointly sample a short preimage of the hashed message, hidden by noise flooding and shared with verifiable short secret sharing, in four rounds, for th"},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2024-GLACIUS","s":"bdlr24-glacius-fully-adaptive-thres","title":"Glacius fully adaptive threshold Schnorr from DDH","key":"BDLR24","y":2024,"sub":"Threshold Schnorr with adaptive security. Five signing rounds, no secure erasures, and a proof under DDH in the random oracle model."},{"t":"threshold-signature","k":"scheme","id":"TSIG-CONSTRUCTION-2024-RACCOON","s":"pkm24-threshold-raccoon-practical","title":"Threshold Raccoon practical lattice signature","key":"PKM+24","y":2024,"sub":"Threshold Raccoon. A three-round threshold lattice signature in which signers mask their shares with large noise and pairwise PRF-derived zero shares, so no attempt is rejected, for any \\( t \\le n \\)."},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-001","s":"op-1","title":"Few-round threshold ML-DSA for many parties","key":null,"y":null,"sub":"Open problem · Can any \\( t \\) of \\( n \\) parties produce ordinary ML-DSA signatures in at most three rounds, with cost polynomial in \\( n \\) and security against \\( t-1 \\) malicious parties, without homomorphic or gener"},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-002","s":"op-2","title":"Three-round threshold ML-DSA for at most six parties","key":null,"y":null,"sub":"Solved problem · Few-round threshold ML-DSA against a dishonest majority when there are at most six parties. Solved with short replicated secret sharing and hyperball rejection sampling in three rounds per attempt."},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-003","s":"op-3","title":"Few-round threshold ML-DSA with an honest majority","key":null,"y":null,"sub":"Open problem · Few-round threshold ML-DSA when each signing session includes an honest majority: at most three rounds, any number of parties, malicious security. The known honest-majority protocol needs tens of rounds."},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-004","s":"op-4","title":"Honest-majority threshold ML-DSA with tens of rounds","key":null,"y":null,"sub":"Solved problem · Threshold ML-DSA for any number of parties with an honest majority, when signing may take tens of rounds and evaluate the rejection test by MPC. Solved by an MPC-friendly variant of signing whose hash ru"},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-005","s":"op-5","title":"Threshold ML-DSA by homomorphic evaluation of signing","key":null,"y":null,"sub":"Solved problem · Few-round threshold ML-DSA for any \\( t \\) and \\( n \\) when the parties may evaluate the whole signing algorithm under threshold FHE. Solved in one round by the universal thresholdizer, which evaluates a"},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-006","s":"op-6","title":"Three-round threshold lattice signatures for large thresholds","key":null,"y":null,"sub":"Solved problem · Few-round threshold signing for many parties when the scheme may be a lattice signature designed for thresholds, with its own verifier. Solved by Threshold Raccoon in three rounds for thresholds up to 10"},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-007","s":"op-7","title":"Two-round fully adaptive threshold Schnorr without the AGM","key":null,"y":null,"sub":"Open problem · Is there a two-round, stateless threshold Schnorr scheme with standard Schnorr signatures that stays unforgeable when up to \\( t-1 \\) parties are corrupted adaptively, proved in the random oracle model und"},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-008","s":"op-8","title":"Two-round threshold Schnorr with half-threshold adaptive security","key":null,"y":null,"sub":"Solved problem · Two-round stateless threshold Schnorr in the random oracle model when the adversary adaptively corrupts only about half the threshold. Solved for FROST under AOMDL."},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-009","s":"op-9","title":"Fully adaptive two-round threshold Schnorr in the algebraic group model","key":null,"y":null,"sub":"Solved problem · Two-round fully adaptive threshold Schnorr with standard signatures when the proof may use the algebraic group model. Solved by a FROST variant with pairwise masking of partial signatures under AOMDL, fo"},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-010","s":"op-10","title":"Fully adaptive two-round threshold Schnorr with periodic key refresh","key":null,"y":null,"sub":"Solved problem · Two-round fully adaptive threshold Schnorr with standard signatures when signers refresh part of their public key shares after a bounded number of signing queries. Solved from DDH in the random oracle mo"},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-011","s":"op-11","title":"Fully adaptive three-round threshold Schnorr without the AGM","key":null,"y":null,"sub":"Solved problem · Fully adaptive threshold Schnorr with standard signatures in three stateless signing rounds, without the algebraic group model. Solved by masking FROST under AOMDL in the random oracle model; with state "},{"t":"threshold-signature","k":"problem","id":"TSIG-OP-012","s":"op-12","title":"Fully adaptive two-round threshold signatures with Schnorr-type output","key":null,"y":null,"sub":"Solved problem · Two-round fully adaptive threshold signing when the signature may contain one more scalar than a Schnorr signature and is checked by its own verifier. Solved from DL in the random oracle model."},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-1989-DF","s":"df89","title":"Threshold Cryptosystems","key":"DF89","y":1989,"sub":"Yvo Desmedt, Yair Frankel · CRYPTO 1989"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-1991-PEDERSEN","s":"pedersen91","title":"A Threshold Cryptosystem without a Trusted Party","key":"Pedersen91","y":1991,"sub":"Torben Pryds Pedersen · EUROCRYPT 1991"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-1996-GJKR-DSS","s":"gjkr96b","title":"Robust Threshold DSS Signatures","key":"GJKR96b","y":1996,"sub":"Rosario Gennaro, Stanisław Jarecki, Hugo Krawczyk, Tal Rabin · EUROCRYPT 1996"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-1996-GJKR-RSA","s":"gjkr96a","title":"Robust and Efficient Sharing of RSA Functions","key":"GJKR96a","y":1996,"sub":"Rosario Gennaro, Stanisław Jarecki, Hugo Krawczyk, Tal Rabin · CRYPTO 1996"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-1999-GJKR-DKG","s":"gjkr99","title":"Secure Distributed Key Generation for Discrete-Log Based Cryptosystems","key":"GJKR99","y":1999,"sub":"Rosario Gennaro, Stanisław Jarecki, Hugo Krawczyk, Tal Rabin · EUROCRYPT 1999"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2000-SHOUP","s":"shoup00","title":"Practical Threshold Signatures","key":"Shoup00","y":2000,"sub":"Victor Shoup · EUROCRYPT 2000"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2003-BOLDYREVA","s":"boldyreva03","title":"Threshold Signatures, Multisignatures and Blind Signatures Based on the Gap-Diffie-Hellman-Group Signature Scheme","key":"Boldyreva03","y":2003,"sub":"Alexandra Boldyreva · PKC 2003"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2017-LINDELL","s":"lindell17","title":"Fast Secure Two-Party ECDSA Signing","key":"Lindell17","y":2017,"sub":"Yehuda Lindell · CRYPTO 2017"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2018-BGGJKRS","s":"bgg18","title":"Threshold Cryptosystems From Threshold Fully Homomorphic Encryption","key":"BGG+18","y":2018,"sub":"Dan Boneh, Rosario Gennaro, Steven Goldfeder, Aayush Jain, Sam Kim, Peter M. R. Rasmussen, Amit Sahai · CRYPTO 2018"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2018-DKLS-2P","s":"dkls18","title":"Secure Two-party Threshold ECDSA from ECDSA Assumptions","key":"DKLs18","y":2018,"sub":"Jack Doerner, Yashvanth Kondi, Eysa Lee, abhi shelat · IEEE S&P 2018"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2018-GG","s":"gg18","title":"Fast Multiparty Threshold ECDSA with Fast Trustless Setup","key":"GG18","y":2018,"sub":"Rosario Gennaro, Steven Goldfeder · ACM CCS 2018"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2019-DKLS-N","s":"dkls19","title":"Threshold ECDSA from ECDSA Assumptions: The Multiparty Case","key":"DKLs19","y":2019,"sub":"Jack Doerner, Yashvanth Kondi, Eysa Lee, abhi shelat · IEEE Symposium on Security and Privacy 2019"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2020-CGGMP","s":"cggmp20","title":"UC Non-Interactive, Proactive, Threshold ECDSA with Identifiable Aborts","key":"CGGMP20","y":2020,"sub":"Ran Canetti, Rosario Gennaro, Steven Goldfeder, Nikolaos Makriyannis, Udi Peled · ACM CCS 2020"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2020-FROST","s":"kg20","title":"FROST: Flexible Round-Optimized Schnorr Threshold Signatures","key":"KG20","y":2020,"sub":"Chelsea Komlo, Ian Goldberg · SAC 2020"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2021-DOTT","s":"dott21","title":"Two-round n-out-of-n and Multi-Signatures and Trapdoor Commitment from Lattices","key":"DOTT21","y":2021,"sub":"Ivan Damgård, Claudio Orlandi, Akira Takahashi, Mehdi Tibouchi · PKC 2021; Journal of Cryptology 2022"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2021-GKMN","s":"gkmn21","title":"Threshold Schnorr with Stateless Deterministic Signing from Standard Assumptions","key":"GKMN21","y":2021,"sub":"François Garillot, Yashvanth Kondi, Payman Mohassel, Valeria Nikolaenko · CRYPTO 2021"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2022-BTZ","s":"btz22","title":"Stronger Security for Non-Interactive Threshold Signatures: BLS and FROST","key":"BTZ22","y":2022,"sub":"Mihir Bellare, Stefano Tessaro, Chenzhi Zhu · CRYPTO 2022 (merged as Bellare, Crites, Komlo, Maller, Tessaro and Zhu, \"Better than Advertised Security for Non-Interactive Threshold Signatures\")"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2022-DILIZIUM2","s":"lsv22","title":"DiLizium 2.0: Revisiting Two-Party Crystals-Dilithium","key":"LSV22","y":2022,"sub":"Peeter Laud, Nikita Snetkov, Jelizaveta Vakarjuk · Journal of Computer Security final version"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2023-GKS","s":"gks23","title":"Two-Round Threshold Lattice-Based Signatures from Threshold Homomorphic Encryption","key":"GKS23","y":2023,"sub":"Kamil Doruk Gur, Jonathan Katz, Tjerand Silde · PQCrypto 2024"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2023-OLAF","s":"cgrs23","title":"Practical Schnorr Threshold Signatures Without the Algebraic Group Model","key":"CGRS23","y":2023,"sub":"Hien Chu, Paul Gerhart, Tim Ruffing, Dominique Schröder · CRYPTO 2023"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2024-TANG","s":"tpcz23","title":"Efficient Lattice-Based Threshold Signatures with Functional Interchangeability","key":"TPCZ23","y":2023,"sub":"Guofeng Tang, Bo Pang, Long Chen, Zhenfeng Zhang · IEEE Transactions on Information Forensics and Security 18, 4173–4187"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2024-AOMMLWE","s":"ekt24","title":"Two-Round Threshold Signature from Algebraic One-More Learning with Errors","key":"EKT24","y":2024,"sub":"Thomas Espitau, Shuichi Katsumata, Kaoru Takemure · CRYPTO 2024; Journal of Cryptology revision"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2024-FLOOD","s":"enp24","title":"Flood and Submerse: Distributed Key Generation and Robust Threshold Signature from Lattices","key":"ENP24","y":2024,"sub":"Thomas Espitau, Guilhem Niot, Thomas Prest · CRYPTO 2024"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2024-GLACIUS","s":"bdlr24","title":"Glacius: Threshold Schnorr Signatures from DDH with Full Adaptive Security","key":"BDLR24","y":2024,"sub":"Renas Bacho, Sourav Das, Julian Loss, Ling Ren · EUROCRYPT 2025"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2024-RACCOON","s":"pkm24","title":"Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions","key":"PKM+24","y":2024,"sub":"Rafael del Pino, Shuichi Katsumata, Mary Maller, Fabrice Mouhartem, Thomas Prest, Markku-Juhani Saarinen · EUROCRYPT 2024"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2025-CCKM","s":"cckm25","title":"On the Adaptive Security of Key-Unique Threshold Signatures","key":"CCKM25","y":2025,"sub":"Michele Ciampi, Elizabeth Crites, Chelsea Komlo, Mary Maller · IACR ePrint 2025/943"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2025-CHEN","s":"chen25","title":"Round-Efficient Adaptively Secure Threshold Signatures with Rewinding","key":"Chen25","y":2025,"sub":"Yanbo Chen · IACR Communications in Cryptology 2(2)"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2025-CKKTZ","s":"ckktz25","title":"On the Adaptive Security of FROST","key":"CKKTZ25","y":2025,"sub":"Elizabeth Crites, Jonathan Katz, Chelsea Komlo, Stefano Tessaro, Chenzhi Zhu · CRYPTO 2025"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2025-FAFROST","s":"bgc25","title":"Fully Adaptive FROST with Identifiable Aborts from AOMDL","key":"BGC+25","y":2025,"sub":"Ruben Baecker, Paul Gerhart, Davide Li Calsi, Luigi Russo, Dominique Schröder, Arkady Yerukhimovich · ASIACRYPT 2026"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2025-GLRS","s":"gcrs25","title":"Fully-Adaptive Two-Round Threshold Schnorr Signatures from DDH","key":"GCRS25","y":2025,"sub":"Paul Gerhart, Davide Li Calsi, Luigi Russo, Dominique Schröder · EUROCRYPT 2026"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2025-MSFROST","s":"bcltz25","title":"Adaptively Secure Partially Non-Interactive Threshold Schnorr Signatures in the AGM","key":"BCLTZ25","y":2025,"sub":"Renas Bacho, Yanbo Chen, Julian Loss, Stefano Tessaro, Chenzhi Zhu · EUROCRYPT 2026"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2026-CELI","s":"cpenp26","title":"Efficient Threshold ML-DSA","key":"CPENP26","y":2026,"sub":"Sofía Celi, Rafael del Pino, Thomas Espitau, Guilhem Niot, Thomas Prest · USENIX Security 2026"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2026-GEPTW","s":"geptw26","title":"Thresholdizing Standardized FALCON Signatures","key":"GEPTW26","y":2026,"sub":"Radhika Garg, Daniel Escudero, Antigoni Polychroniadou, Akira Takahashi, Xiao Wang · Cryptology ePrint Archive"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2026-NIST8214C","s":"nist26","title":"NIST First Call for Multi-Party Threshold Schemes","key":"NIST26","y":2026,"sub":"National Institute of Standards and Technology · NIST Interagency/Internal Report"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2026-PASSELEGUE","s":"pas26","title":"Concerning Lattice-Based Cryptography, and other matters","key":"Pas26","y":2026,"sub":"Alain Passelègue · Habilitation thesis"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2026-QUORUS","s":"bcept26","title":"Quorus: Efficient, Scalable Threshold ML-DSA Signatures from MPC","key":"BCEPT26","y":2026,"sub":"Alexander Bienstock, Leo de Castro, Daniel Escudero, Antigoni Polychroniadou, Akira Takahashi · USENIX Security 2026"},{"t":"threshold-signature","k":"paper","id":"TSIG-PAPER-2026-THED","s":"pps26","title":"THED: Threshold Dilithium from FHE","key":"PPS26","y":2026,"sub":"Jai Hyun Park, Alain Passelègue, Damien Stehlé · ACM CCS 2026"},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-1989-DF-DISTRIBUTED-RSA-SIGNING-ROOT","s":"df89-distributed-rsa-signing","title":"Distributed RSA signing","key":"DF89","y":1989,"sub":"The threshold-cryptosystem framework distributes RSA-style private exponentiation across multiple servers."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-1989-DF-THRESHOLD-CRYPTOSYSTEM-PARADIGM","s":"df89-distributed-private-key-oper","title":"Distributed private-key operations","key":"DF89","y":1989,"sub":"Desmedt and Frankel formulate threshold cryptosystems in which a quorum jointly performs a private-key operation without reconstructing the full secret at one party."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-1991-PEDERSEN-DISTRIBUTED-KEY-GENERATION-WITHOUT-DEALER","s":"pedersen91-dealerless-discrete-log-dkg","title":"Dealerless discrete-log DKG","key":"Pedersen91","y":1991,"sub":"Pedersen gives a protocol in which participants jointly generate a discrete-log public key and shares of its secret without a trusted dealer."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-1996-GJKR-DSS-ROBUST-THRESHOLD-DSS","s":"gjkr96b-robust-threshold-dss","title":"Robust threshold DSS","key":"GJKR96b","y":1996,"sub":"GJKR constructs threshold DSS signing for an honest-majority-style resilience bound while producing signatures accepted by ordinary DSS verification."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-1996-GJKR-RSA-ROBUST-THRESHOLD-RSA-FUNCTION-SHARING","s":"gjkr96a-robust-rsa-function-sharing","title":"Robust RSA function sharing","key":"GJKR96a","y":1996,"sub":"GJKR develops verifiable, robust sharing of RSA private operations for threshold signing and decryption."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-1999-GJKR-DKG-MALICIOUS-MINORITY-SECURITY","s":"gjkr99-malicious-minority-security","title":"Malicious-minority security for discrete-log DKG","key":"GJKR99","y":1999,"sub":"The GJKR analysis specifies when malicious participants cannot bias or make inconsistent the jointly generated discrete-log key."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-1999-GJKR-DKG-ROBUST-DISCRETE-LOG-DKG","s":"gjkr99-robust-discrete-log-dkg","title":"Robust discrete-log DKG","key":"GJKR99","y":1999,"sub":"GJKR gives a distributed key-generation protocol that produces a consistent discrete-log public key despite a bounded malicious minority."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2000-SHOUP-NONINTERACTIVE-SHARE-GENERATION","s":"shoup00-noninteractive-generation-an","title":"Noninteractive generation and verification of RSA signature shares","key":"Shoup00","y":2000,"sub":"After setup, each Shoup signing server independently produces a signature share that a combiner can verify and combine without an interactive signing round among servers."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2000-SHOUP-PRACTICAL-ROBUST-THRESHOLD-RSA","s":"shoup00-verifiable-share-threshold-r","title":"Verifiable-share threshold RSA","key":"Shoup00","y":2000,"sub":"Shoup constructs robust threshold RSA signing with publicly verifiable shares and ordinary RSA signature output."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2003-BOLDYREVA-THRESHOLD-BLS-SIGNATURE","s":"boldyreva03-exponent-share-threshold-bls","title":"Exponent-share threshold BLS signing","key":"Boldyreva03","y":2003,"sub":"Boldyreva distributes the BLS secret exponent so a quorum can produce and combine partial signatures without reconstructing the signing key."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2003-BOLDYREVA-UNIQUE-COMPACT-OUTPUT","s":"boldyreva03-unique-compact-threshold-out","title":"Unique compact threshold output compatible with BLS verification","key":"Boldyreva03","y":2003,"sub":"Combining valid threshold BLS shares yields a unique one-group-element signature with the ordinary BLS verification interface."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2017-LINDELL-EFFICIENT-TWO-PARTY-ECDSA","s":"lindell17-paillier-based-two-party","title":"Paillier-based two-party ECDSA","key":"Lindell17","y":2017,"sub":"Lindell gives a Paillier-based two-party protocol that jointly computes a standard ECDSA signature without reconstructing the signing key."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2017-LINDELL-MALICIOUS-SECURITY","s":"lindell17-malicious-security-for-linde","title":"Malicious security for Lindell's Paillier-based two-party ECDSA","key":"Lindell17","y":2017,"sub":"The two-party ECDSA protocol includes proofs and checks intended to preserve security when one participant deviates maliciously."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2018-DKLS-2P-OT-BASED-MULTIPLICATION","s":"dkls18-hardened-ot-based-multiplica","title":"Hardened OT-based multiplication for ECDSA signing","key":"DKLs18","y":2018,"sub":"DKLs hardens Gilboa's semi-honest multiplication-by-oblivious-transfer against malicious parties with randomized input encoding and a consistency check, so the two secret multiplications in ECDSA signing need no homomorp"},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2018-DKLS-2P-TWO-PARTY-ECDSA-WITHOUT-PAILLIER","s":"dkls18-ot-based-two-party","title":"OT-based two-party ECDSA","key":"DKLs18","y":2018,"sub":"DKLs gives 2-of-\\( n \\) threshold ECDSA whose signing multiplications use oblivious transfer rather than Paillier encryption, proved secure against malicious adversaries in the random-oracle model from CDH and the assump"},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2018-GG-DISTRIBUTED-SETUP","s":"gg18-dealerless-setup-for-multipa","title":"Dealerless setup for multiparty threshold ECDSA","key":"GG18","y":2018,"sub":"GG18's key generation has each player commit to a random value, Feldman-share it, and prove knowledge of its resulting share, so the threshold ECDSA key is created without a trusted dealer and without jointly generating "},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2018-GG-MULTIPARTY-THRESHOLD-ECDSA","s":"gg18-multiparty-threshold-ecdsa","title":"Multiparty threshold ECDSA","key":"GG18","y":2018,"sub":"GG18 gives threshold-optimal \\( t \\)-out-of-\\( n \\) ECDSA for any \\( t \\le n \\) against a malicious dishonest majority, combining dealerless Feldman-VSS key generation with pairwise Paillier-based share conversions, and "},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2019-DKLS-N-GENERAL-THRESHOLD-ECDSA","s":"dkls19-ot-based-t-of","title":"OT-based t-of-n ECDSA","key":"DKLs19","y":2019,"sub":"DKLs19 extends the DKLs18 protocols to \\( t \\)-of-\\( n \\) threshold ECDSA with ordinary signatures, proved UC-secure against a malicious adversary statically corrupting up to \\( t-1 \\) parties under CDH in the global ran"},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2020-CGGMP-IDENTIFIABLE-ABORT","s":"cggmp20-identifiable-abort-for-malic","title":"Identifiable abort for malicious threshold-ECDSA failures","key":"CGGMP20","y":2020,"sub":"When CGGMP signing aborts because of malicious behavior, the protocol provides evidence identifying a misbehaving participant under its model."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2020-CGGMP-ONE-MESSAGE-DEPENDENT-ONLINE-ROUND","s":"cggmp20-one-online-cggmp-round","title":"One online CGGMP round","key":"CGGMP20","y":2020,"sub":"In both CGGMP protocols, all rounds except the last can be completed before the message is known, leaving one message-dependent online round."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2020-CGGMP-PROACTIVE-SECURITY","s":"cggmp20-proactive-ecdsa-share-refres","title":"Proactive ECDSA share refresh","key":"CGGMP20","y":2020,"sub":"CGGMP supports refreshing distributed key shares so compromise across separated epochs need not accumulate against one static sharing."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2020-CGGMP-UC-THRESHOLD-ECDSA","s":"cggmp20-adaptive-uc-threshold-ecdsa","title":"Adaptive UC threshold ECDSA","key":"CGGMP20","y":2020,"sub":"CGGMP realizes threshold ECDSA in the UC framework against adaptive corruptions in the global random-oracle model under its stated assumptions."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2020-FROST-IDENTIFIABLE-MISBEHAVING-PARTICIPANT","s":"kg20-frost-identifies-invalid-sig","title":"FROST identifies invalid signature-share senders","key":"KG20","y":2020,"sub":"FROST's share verification lets the coordinator detect which participant supplied an invalid signing share."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2020-FROST-ONE-ROUND-WITH-PREPROCESSING","s":"kg20-one-online-frost-round","title":"One online FROST round","key":"KG20","y":2020,"sub":"FROST can move nonce commitments to preprocessing so the message-dependent online phase uses one round."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2020-FROST-TWO-ROUND-THRESHOLD-SCHNORR","s":"kg20-two-round-t-out","title":"Two-round t-out-of-n FROST","key":"KG20","y":2020,"sub":"FROST produces ordinary Schnorr signatures with two rounds of interaction among a selected threshold of signers."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2021-DOTT-ABORT-LEAKAGE-COUNTERMEASURE","s":"dott21-abort-leakage-trapdoor-commi","title":"Abort-leakage trapdoor commitments","key":"DOTT21","y":2021,"sub":"DOTT uses a homomorphic trapdoor-commitment mechanism so abort transcripts do not expose accumulated information about distributed lattice signing secrets."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2021-DOTT-TWO-ROUND-N-OUT-OF-N-LATTICE-SIGNING","s":"dott21-two-round-n-out","title":"Two-round n-out-of-n lattice signing","key":"DOTT21","y":2021,"sub":"DOTT constructs a two-round distributed lattice signature in which all \\( n \\) signers participate and the output follows a Fiat–Shamir-with-aborts line."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2021-GKMN-STATELESS-DETERMINISTIC-THRESHOLD-SCHNORR","s":"gkmn21-stateless-deterministic-thre","title":"Stateless deterministic threshold Schnorr","key":"GKMN21","y":2021,"sub":"GKMN constructs threshold Schnorr with deterministic nonce derivation and no evolving long-term signing state under its standard-assumption toolchain."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2022-BTZ-FROST1-STRONG-UNFORGEABILITY-UNDER-OMDL","s":"btz22-frost-is-strongly-unforgeabl","title":"FROST is strongly unforgeable (TS-SUF-3) under OMDL in the random oracle model","key":"BTZ22","y":2022,"sub":"FROST as Komlo and Goldberg specify it (FROST1) is TS-SUF-3 secure under the one-more discrete logarithm assumption in the random oracle model, with trusted key generation and static corruptions."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2022-DILIZIUM2-TWO-PARTY-DILITHIUM-LINE","s":"lsv22-three-round-two-party","title":"Three-round two-party Dilithium","key":"LSV22","y":2022,"sub":"DiLizium 2.0 revisits two-party lattice signing and incorporates Dilithium compression techniques into the DOTT-related construction line."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2023-GKS-ACTIVELY-SECURE-THRESHOLD-LINEAR-HE","s":"gks23-actively-secure-threshold-li","title":"Actively secure threshold linear-HE as a signing component","key":"GKS23","y":2023,"sub":"GKS builds an actively secure threshold linearly homomorphic-encryption layer to aggregate masked lattice signing values for arbitrary thresholds."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2023-GKS-TWO-ROUND-ARBITRARY-THRESHOLD-LATTICE-SIGNATURE","s":"gks23-two-round-t-out","title":"Two-round t-out-of-n lattice signing","key":"GKS23","y":2023,"sub":"GKS constructs a two-round lattice signature for arbitrary \\( t \\)-out-of-\\( n \\) participation using threshold linearly homomorphic encryption."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2023-OLAF-PROOF-WITHOUT-AGM","s":"cgrs23-frost-proof-without-agm","title":"FROST proof without AGM","key":"CGRS23","y":2023,"sub":"Olaf combines a FROST variant with Pedersen-style DKG and proves unforgeability without the algebraic group model under AOMDL in the random-oracle model."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-TANG-FUNCTIONAL-INTERCHANGEABILITY","s":"tpcz23-functionally-interchangeable-2","title":"Functionally interchangeable lattice threshold signing","key":"TPCZ23","y":2023,"sub":"Tang et al. give a \\( t \\)-out-of-\\( n \\) lattice threshold signature whose output is accepted by the verification algorithm of the paper's own non-threshold signature (Section 4, a lattice Fiat–Shamir signature with an "},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-TANG-IMPLEMENTED-T-OUT-OF-N-LATTICE-SIGNATURE","s":"tpcz23-implemented-t-out-of","title":"Implemented \\( t \\)-out-of-\\( n \\) lattice threshold signing","key":"TPCZ23","y":2023,"sub":"Tang et al. implement arbitrary-threshold lattice signing and report a 15-round, 1.417 MB-per-party online profile with 0.5-second LAN signing for two parties under their stated parameters."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-TANG-PROACTIVE-REFRESH","s":"tpcz23-proactive-lattice-share-refr","title":"Proactive lattice share refresh","key":"TPCZ23","y":2023,"sub":"The Tang et al. package refreshes distributed lattice signing shares while preserving the public verification key and threshold functionality."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-AOMMLWE-OFFLINE-ONLINE-SIGNING","s":"ekt24-signer-independent-offline-l","title":"Signer-independent offline lattice phase","key":"EKT24","y":2024,"sub":"The first AOM-MLWE signing round can be computed before the message and participating signer set are known, leaving a short online completion phase."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-AOMMLWE-TWO-ROUND-LATTICE-THRESHOLD-WITHOUT-FHE","s":"ekt24-two-round-lattice-signing","title":"Two-round lattice signing without FHE","key":"EKT24","y":2024,"sub":"The AOM-MLWE construction obtains two-round threshold lattice signing without fully homomorphic encryption or homomorphic trapdoor commitments."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-FLOOD-FIRST-HASH-AND-SIGN-LATTICE-THRESHOLD-SIGNATURE","s":"enp24-robust-lattice-threshold-has","title":"Robust lattice threshold hash-and-sign","key":"ENP24","y":2024,"sub":"The Flood and Submerse work constructs a robust threshold signature from a GPV-style lattice hash-and-sign route using distributed short-secret machinery."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-FLOOD-RANDOM-SUBMERSIONS","s":"enp24-random-submersions-verify-sh","title":"Random submersions verify shares of short lattice secrets","key":"ENP24","y":2024,"sub":"Random submersions support verifiable sharing and reconstruction of short lattice secrets used by the Flood and Submerse threshold hash-and-sign construction."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-GLACIUS-FULLY-ADAPTIVE-THRESHOLD-SCHNORR-FROM-DDH","s":"bdlr24-adaptive-threshold-schnorr-w","title":"Adaptive threshold Schnorr with identifiable abort","key":"BDLR24","y":2024,"sub":"Glacius proves threshold Schnorr secure against fully adaptive corruptions from DDH in the random-oracle model, with constant-size signing keys and identifiable abort."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-RACCOON-EFFICIENT-LARGE-THRESHOLD-LATTICE-SIGNING","s":"pkm24-three-round-lattice-signing","title":"Three-round lattice signing through T=1024","key":"PKM+24","y":2024,"sub":"Threshold Raccoon gives concrete 128-bit parameters up to threshold 1024 with a 3.9 KB verification key, 12.7 KB signature, and a three-round implementation profile."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2024-RACCOON-ONE-TIME-ADDITIVE-MASK-DEFENSE","s":"pkm24-additive-mask-abort-leakage","title":"Additive-mask abort-leakage defense","key":"PKM+24","y":2024,"sub":"Threshold Raccoon uses fresh additive masks to prevent repeated partial-signature and abort information from accumulating against a participant's lattice secret."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2026-NIST8214C-INTEROPERABLE-OUTPUT-EMPHASIS","s":"nist26-functional-interchangeabilit","title":"Functional interchangeability as a threshold-call eligibility coordinate","key":"NIST26","y":2026,"sub":"NIST IR 8214C requires submitted threshold schemes to specify how their outputs are interchangeable with a reference non-threshold primitive in the subsequent operation."},{"t":"threshold-signature","k":"result","id":"TSIG-RESULT-2026-NIST8214C-NIST-THRESHOLD-CRYPTOGRAPHY-PACKAGE-FRAMEWORK","s":"nist26-nist-call-requirements-for","title":"NIST call requirements for threshold-scheme submission packages","key":"NIST26","y":2026,"sub":"NIST IR 8214C calls for threshold-scheme packages containing a technical specification, reference implementation, and experimental-evaluation report."},{"t":"threshold-signature","k":"assumption","id":"ASM-AOM-MLWE","s":"aom-mlwe","title":"Algebraic one-more Module-LWE (AOM-MLWE)","key":null,"y":null,"sub":"The instance is a uniform matrix \\( A \\) over \\( R_q \\) and \\( T = [\\, t_0 \\mid \\cdots \\mid t_Q \\,] = A S \\) for a secret matrix \\( S \\) with short entries, so each column of \\( T \\) is a Module-LWE-type sample with the "},{"t":"threshold-signature","k":"assumption","id":"ASM-AOMDL","s":"aomdl","title":"Algebraic one-more discrete logarithm (AOMDL)","key":null,"y":null,"sub":"AOMDL is OMDL with a restricted adversary: every group element the adversary submits to the discrete-logarithm oracle must be accompanied by its representation as a linear combination of the generator and the challenges "},{"t":"threshold-signature","k":"assumption","id":"ASM-CDH","s":"cdh","title":"Computational Diffie-Hellman (CDH)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\)."},{"t":"threshold-signature","k":"assumption","id":"ASM-CO-CDH","s":"co-cdh","title":"Computational co-Diffie-Hellman (co-CDH)","key":null,"y":null,"sub":"Let \\( (\\mathbb{G}_1, \\mathbb{G}_2) \\) be groups of prime order \\( p \\) with generators \\( g_1, g_2 \\) and a pairing into \\( \\mathbb{G}_T \\)."},{"t":"threshold-signature","k":"assumption","id":"ASM-DCR","s":"dcr","title":"Decisional composite residuosity (DCR)","key":null,"y":null,"sub":"Let \\( N = pq \\) be an RSA modulus."},{"t":"threshold-signature","k":"assumption","id":"ASM-DDH","s":"ddh","title":"Decisional Diffie-Hellman (DDH)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\)."},{"t":"threshold-signature","k":"assumption","id":"ASM-DLOG","s":"dlog","title":"Discrete logarithm (DL)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\) output by a group generator (a subgroup of \\( \\mathbb{F}_q^* \\), or the group of points of an elliptic curve such as Curve25519 or its twi"},{"t":"threshold-signature","k":"assumption","id":"ASM-DSA-EUF","s":"dsa-euf","title":"Unforgeability of DSA and ECDSA ((EC)DSA EUF-CMA)","key":null,"y":null,"sub":"DSA (over a prime-order subgroup of \\( \\mathbb{F}_q^* \\)) and ECDSA (over an elliptic-curve group of prime order \\( n \\)) sign a message \\( m \\) with secret key \\( x \\) by choosing a nonce \\( k \\), computing \\( r = f(g^{"},{"t":"threshold-signature","k":"assumption","id":"ASM-GDH","s":"gdh","title":"Gap Diffie-Hellman (GDH)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) have prime order \\( p \\)."},{"t":"threshold-signature","k":"assumption","id":"ASM-HINT-MLWE","s":"hint-mlwe","title":"Module learning with errors with hints (Hint-MLWE)","key":null,"y":null,"sub":"Let \\( A \\leftarrow R_q^{k \\times \\ell} \\) be uniform and let \\( s \\in R^{\\ell} \\), \\( e \\in R^{k} \\) have discrete Gaussian entries."},{"t":"threshold-signature","k":"assumption","id":"ASM-MLWE","s":"mlwe","title":"Module learning with errors (Module-LWE)","key":null,"y":null,"sub":"Let \\( R = \\mathbb{Z}[x]/(x^n + 1) \\) (or another ring of integers of degree \\( n \\)), \\( R_q = R/qR \\), and let \\( d \\ge 1 \\) be the module rank."},{"t":"threshold-signature","k":"assumption","id":"ASM-MSIS","s":"msis","title":"Module short integer solution (Module-SIS)","key":null,"y":null,"sub":"Let \\( R_q = \\mathbb{Z}_q[x]/(x^n + 1) \\)."},{"t":"threshold-signature","k":"assumption","id":"ASM-PRF","s":"prf","title":"Pseudorandom functions (PRF)","key":null,"y":null,"sub":"A keyed function family \\( F : \\{0,1\\}^{\\lambda} \\times \\{0,1\\}^{n} \\to \\{0,1\\}^{m} \\) is a pseudorandom function if, for a uniformly random key \\( k \\), no probabilistic polynomial-time adversary with oracle access to \\"},{"t":"threshold-signature","k":"assumption","id":"ASM-RLWE","s":"rlwe","title":"Ring learning with errors (Ring-LWE)","key":null,"y":null,"sub":"Let \\( K \\) be a number field of degree \\( n \\) with ring of integers \\( R \\) (the standard choice is the power-of-two cyclotomic ring \\( R = \\mathbb{Z}[x]/(x^n + 1) \\)), let \\( q \\) be a modulus and \\( R_q = R / qR \\)."},{"t":"threshold-signature","k":"assumption","id":"ASM-ROM","s":"rom","title":"Random oracle model (ROM)","key":null,"y":null,"sub":"A proof in the random oracle model gives every party, honest or adversarial, oracle access to a uniformly random function \\( H : \\{0,1\\}^* \\to \\{0,1\\}^{\\ell} \\) (or to a random function into a group or another range)."},{"t":"threshold-signature","k":"assumption","id":"ASM-RSA","s":"rsa","title":"RSA assumption (RSA)","key":null,"y":null,"sub":"Let \\( N = pq \\) be a product of two random primes of equal length and let \\( e \\) be an exponent with \\( \\gcd(e, \\varphi(N)) = 1 \\) (fixed small values such as \\( e = 65537 \\), or random)."},{"t":"threshold-signature","k":"assumption","id":"ASM-RSIS","s":"rsis","title":"Ring short integer solution (Ring-SIS)","key":null,"y":null,"sub":"Let \\( R = \\mathbb{Z}[x]/(f(x)) \\) with \\( f \\) monic, irreducible and of degree \\( n \\) (the standard choice is \\( f = x^n + 1 \\) with \\( n \\) a power of two), and \\( R_q = R/qR \\)."},{"t":"threshold-signature","k":"assumption","id":"ASM-SELFTARGET-MSIS","s":"selftarget-msis","title":"Self-target Module-SIS (SelfTargetMSIS)","key":null,"y":null,"sub":"Let \\( A \\leftarrow R_q^{k \\times \\ell} \\) and \\( t \\leftarrow R_q^{k} \\) be uniform, and let \\( H : \\{0,1\\}^* \\to B_\\tau \\) be a hash function onto polynomials with \\( \\tau \\) coefficients in \\( \\{\\pm 1\\} \\) and the res"},{"t":"threshold-signature","k":"assumption","id":"ASM-STRONG-RSA","s":"strong-rsa","title":"Strong RSA assumption (strong RSA)","key":null,"y":null,"sub":"Let \\( N \\) be an RSA modulus (often a product of two safe primes)."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-YAO-GARBLED-CIRCUITS-NO-FURTHER-ASSUMPTION-STATED-FOR-THE-TWO-PARTY-CASE","s":"additively-homomorphic-encry","title":"Additively homomorphic encryption and Yao garbled circuits; no further assumption stated for the two-party case","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Additively homomorphic encryption and Yao garbled circuits; no further assumption stated for the two-party case."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-CDH-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES","s":"cdh-with-elligator-encoding","title":"CDH with elligator encoding, ideal permutation, and random oracles","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: CDH with elligator encoding, ideal permutation, and random oracles."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-CODE-CORRELATION-ROBUST-HASH-IN-THE-OOS-OT-EXTENSION-HYBRID-MODEL","s":"code-correlation-robust-hash","title":"Code-correlation-robust hash, in the OOS OT-extension hybrid model","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Code-correlation-robust hash, in the OOS OT-extension hybrid model."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-BATCHED-RANDOM-OT","s":"cpa-secure-additively-homomo","title":"CPA-secure additively homomorphic encryption and batched random OT","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: CPA-secure additively homomorphic encryption and batched random OT."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-EXPONENTIAL-ELGAMAL-AND-RING-LWE-IN-THE-MEASUREMENTS","s":"cpa-secure-additively-homomo-2","title":"CPA-secure additively homomorphic encryption (exponential ElGamal and Ring-LWE in the measurements)","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: CPA-secure additively homomorphic encryption (exponential ElGamal and Ring-LWE in the measurements)."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-DDH-AND-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-RANDOM-ORACLE-MODEL-PAILLIER-WITH-DAMG-RD-JURIK-IN-DEPLOYMENT","s":"ddh-and-cpa-secure","title":"DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment)","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment)."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-DECISIONAL-DIFFIE-HELLMAN-FOR-THE-OBLIVIOUS-TRANSFER-IN-THE-RANDOM-ORACLE-MODEL-WITH-AN-UNNAMED-HOMOMORPHIC-ENCRYPTION-SCHEME","s":"decisional-diffie-hellman-fo","title":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model, with an unnamed homomorphic encryption scheme","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model, with an unnamed homomorphic encryption scheme."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-HAMMING-CORRELATION-ROBUST-HASH-AND-PSEUDORANDOM-CODE-WITH-IDEAL-BASE-OTS","s":"hamming-correlation-robust-h","title":"Hamming correlation-robust hash and pseudorandom code, with ideal base OTs","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Hamming correlation-robust hash and pseudorandom code, with ideal base OTs."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-IND-CPA-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PAILLIER-OR-DAMG-RD-JURIK-AND-PASSIVELY-SECURE-OLE","s":"ind-cpa-additively-homomorph","title":"IND-CPA additively homomorphic encryption (Paillier or Damgård-Jurik) and passively secure OLE","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: IND-CPA additively homomorphic encryption (Paillier or Damgård-Jurik) and passively secure OLE."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-IND-CPA-LEVELED-FHE-WITH-CIRCUIT-PRIVACY-FV-OVER-RING-LWE","s":"ind-cpa-leveled-fhe","title":"IND-CPA leveled FHE with circuit privacy (FV over Ring-LWE)","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: IND-CPA leveled FHE with circuit privacy (FV over Ring-LWE)."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-LOWMC-AS-A-PSEUDORANDOM-FUNCTION-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF","s":"lowmc-as-a-pseudorandom","title":"LowMC as a pseudorandom function and maliciously secure OT, without a proof","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: LowMC as a pseudorandom function and maliciously secure OT, without a proof."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-NAOR-REINGOLD-PRF-OVER-P-256-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF","s":"naor-reingold-prf-over","title":"Naor-Reingold PRF over P-256 and maliciously secure OT, without a proof","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Naor-Reingold PRF over P-256 and maliciously secure OT, without a proof."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-NOT-STATED-DISCRETE-LOG-SETTING-MODULO-A-PRIME-WITH-AN-UNPREDICTABLE-HASH","s":"not-stated-discrete-log","title":"not stated; discrete-log setting modulo a prime with an unpredictable hash","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: not stated; discrete-log setting modulo a prime with an unpredictable hash."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-OBLIVIOUS-TRANSFER-OR-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-ANY-ASSUMPTION-IMPLYING-SECURE-COMPUTATION","s":"oblivious-transfer-or-additi","title":"Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation)","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation)."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ONE-MORE-GAP-DH-AND-RANDOM-ORACLES","s":"one-more-gap-dh","title":"One-More-Gap-DH and random oracles","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: One-More-Gap-DH and random oracles."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-H-LIMITED-LEVELED-FHE","s":"one-more-gap-diffie","title":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure H-limited leveled FHE","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure H-limited leveled FHE."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","s":"one-more-gap-diffie-2","title":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BGV","s":"one-more-gap-diffie-3","title":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BGV)","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BGV)."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ONE-MORE-RSA-INVERSION-AND-RANDOM-ORACLES","s":"one-more-rsa-inversion","title":"one-more RSA inversion and random oracles","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: one-more RSA inversion and random oracles."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-AND-RANDOM-ORACLES","s":"oracle-diffie-hellman-with","title":"oracle Diffie-Hellman with elligator encoding and random oracles","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: oracle Diffie-Hellman with elligator encoding and random oracles."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES","s":"oracle-diffie-hellman-with-2","title":"oracle Diffie-Hellman with elligator encoding, ideal permutation, and random oracles","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: oracle Diffie-Hellman with elligator encoding, ideal permutation, and random oracles."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL","s":"orr-orsini-scholl-ot","title":"Orrù-Orsini-Scholl OT extension in the programmable random oracle model","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Orrù-Orsini-Scholl OT extension in the programmable random oracle model."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-AN-IDEAL-TWO-PARTY-PSI-FUNCTIONALITY","s":"prf-and-random-oracle","title":"PRF and random oracle, with OKVS obliviousness and an ideal two-party PSI functionality","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: PRF and random oracle, with OKVS obliviousness and an ideal two-party PSI functionality."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-IDEAL-OPPRF-AND-ZERO-SHARING-FUNCTIONALITIES","s":"prf-and-random-oracle-2","title":"PRF and random oracle, with OKVS obliviousness and ideal OPPRF and zero-sharing functionalities","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: PRF and random oracle, with OKVS obliviousness and ideal OPPRF and zero-sharing functionalities."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF","s":"prf-and-random-oracle-3","title":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-PRF-CORRELATION-ROBUST-HASH-AND-ACTIVELY-SECURE-OT-EXTENSION-WITHOUT-RANDOM-ORACLES","s":"prf-correlation-robust-hash","title":"PRF, correlation-robust hash, and actively secure OT extension, without random oracles","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: PRF, correlation-robust hash, and actively secure OT extension, without random oracles."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-PROGRAMMABLE-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","s":"programmable-random-oracles","title":"Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-RANDOM-ORACLE-COMMITMENT-H-X-R-AND-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL","s":"random-oracle-commitment-h","title":"random-oracle commitment \\( H(x \\| r) \\) and Orrù-Orsini-Scholl OT extension in the programmable random oracle model","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: random-oracle commitment \\( H(x \\| r) \\) and Orrù-Orsini-Scholl OT extension in the programmable random oracle model."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-SILVER-FOR-SILENT-OT-AND-VOLE","s":"random-oracles-in-the","title":"Random oracles, in the OPPRF and generic two-party computation hybrid models; Silver for silent OT and VOLE","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Random oracles, in the OPPRF and generic two-party computation hybrid models; Silver for silent OT and VOLE."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-VOLE-FROM-LPN-WITH-REGULAR-NOISE","s":"random-oracles-in-the-2","title":"Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-SUBFIELD-VOLE-HYBRID-MODEL-VOLE-FOLLOWING-COUTEAU-RINDAL-RAGHURAMAN-2021-AND-BOYLE-ET-AL-2019","s":"random-oracles-in-the-3","title":"Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","s":"random-oracles-in-the-4","title":"Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-RANDOM-OT-EXTENSION-WITH-A-HASH-MODELED-AS-A-RANDOM-ORACLE","s":"random-ot-extension-with","title":"random OT extension with a hash modeled as a random oracle","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: random OT extension with a hash modeled as a random oracle."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE","s":"semantic-security-of-an","title":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-RANDOM-ORACLES","s":"semantically-secure-additive","title":"semantically secure additively homomorphic encryption and random oracles","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: semantically secure additively homomorphic encryption and random oracles."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PSEUDORANDOM-FUNCTION-AND-COLLISION-RESISTANT-HASH","s":"semantically-secure-additive-2","title":"semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-SEMI-HONEST-GENERIC-TWO-PARTY-COMPUTATION-GMW-OR-YAO-NO-ASSUMPTION-STATED","s":"semi-honest-generic-two","title":"Semi-honest generic two-party computation (GMW or Yao); no assumption stated","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Semi-honest generic two-party computation (GMW or Yao); no assumption stated."},{"t":"psi","k":"assumption","id":"PSI-ASSUMPTION-THRESHOLD-FHE-WITH-DISTRIBUTED-SETUP-FROM-CIRCULAR-SECURE-LWE-WITH-THRESHOLD-ADDITIVELY-HOMOMORPHIC-ENCRYPTION","s":"threshold-fhe-with-distribut","title":"Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption","key":null,"y":null,"sub":"Assumption used by one or more PSI construction records: Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption."},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-1999-HFH","s":"hfh99-hfh-preference-matching","title":"HFH preference matching","key":"HFH99","y":1999,"sub":"Two-party preference matching by commutative exponentiation: each party raises its hashed items to a secret exponent modulo a prime, the other re-exponentiates them, and both count equal values in the permuted lists. Per"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","s":"hfh99-hfh-intersection-variant","title":"HFH intersection variant","key":"HFH99","y":1999,"sub":"The variation of HFH preference matching in which the doubly exponentiated lists are returned in the order received, so each party learns which of its own items are shared rather than only how many. It is the Diffie-Hell"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","s":"fnp04-fnp-mathrm-pm-c","title":"FNP \\( \\mathrm{PM}_C \\) (cardinality)","key":"FNP04","y":2004,"sub":"Private cardinality matching: the FNP semi-honest protocol with the server encrypting a fixed string of zeros instead of its item, so the client learns only how many of her decryptions equal that string, the size of the "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","s":"fnp04-fnp-pm-malicious-client","title":"FNP PM-Malicious-Client","key":"FNP04","y":2004,"sub":"FNP private matching secure against a malicious client: she sends \\( L \\) copies of her bin polynomials over pseudorandom identities, the server opens half to check they hold at most \\( n_Y \\) nonzero roots, and evaluate"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","s":"fnp04-fnp-malicious-client-without","title":"FNP malicious client without hashing","key":"FNP04","y":2004,"sub":"The simple malicious-client protocol FNP describe before the hashed one: PM-Semi-Honest without bins, with the polynomial's constant term fixed to one so that it cannot be identically zero and has at most \\( n_Y \\) roots"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","s":"fnp04-fnp-pm-malicious-server","title":"FNP PM-Malicious-Server","key":"FNP04","y":2004,"sub":"FNP private matching secure against a malicious server in the random oracle model: for each item the server derives all its randomness from \\( H_1(s) \\) for a random \\( s \\) and returns \\( \\mathrm{Enc}(r'\\cdot P(y)+s) \\)"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","s":"fnp04-fnp-multi-party-pm","title":"FNP multi-party PM","key":"FNP04","y":2004,"sub":"FNP's sketch of multiparty PSI: the clients post encrypted polynomials and encrypted zero-XOR share matrices, the leader evaluates each client's polynomial at its items with XOR shares of the item as payloads, and the cl"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2004-FNP-SH","s":"fnp04-fnp-pm-semi-honest","title":"FNP PM-Semi-Honest with balanced allocations","key":"FNP04","y":2004,"sub":"The client encodes her set as the roots of polynomials, one per bin of a balanced-allocation hash, and sends their encrypted coefficients; the server evaluates the two candidate bin polynomials homomorphically at each of"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","s":"dt10-dt10-blind-rsa-psi","title":"DT10 blind-RSA PSI","key":"DT10","y":2010,"sub":"One-way PSI from RSA blind signatures: the server publishes hashes of its RSA signatures on its hashed items, and the client obtains signatures on her own hashed items blindly, unblinds, hashes and compares. The server s"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2010-DT-FIG3","s":"dt10-dt10-psi-figure-3","title":"DT10 PSI (Figure 3)","key":"DT10","y":2010,"sub":"One-way PSI in a prime-order subgroup: the client blinds a product of her item hashes and each of its complements, the server raises them to a fresh secret and sends hashed tags of its own items under the same secret, an"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2012-HEK-BWA","s":"hek12-hek-bwa","title":"HEK BWA","key":"HEK12","y":2012,"sub":"PSI for a small universe by Yao's garbled circuits: each set is a bit-vector over the \\( 2^{\\sigma} \\) possible elements and the circuit ANDs the two vectors bit by bit, so the cost is independent of the set sizes."},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2012-HEK-PWC","s":"hek12-hek-pwc","title":"HEK PWC","key":"HEK12","y":2012,"sub":"PSI by garbled-circuit equality tests on every pair of elements, each match revealed as soon as it is found so that later comparisons with matched elements are skipped; random permutation of the inputs hides the order of"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","s":"hek12-hek-scs-he","title":"HEK SCS-HE","key":"HEK12","y":2012,"sub":"Sort-compare-shuffle PSI whose final shuffle is homomorphic: the garbled circuit leaves additive shares of the filtered outputs, Alice sends her shares encrypted under her key, and Bob combines them with his, permutes th"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","s":"hek12-hek-scs-sort","title":"HEK SCS-SORT","key":"HEK12","y":2012,"sub":"The sort-compare-shuffle variant that hides the positions of the matches by obliviously sorting the filtered outputs with Batcher sorters instead of shuffling them; it can beat shuffling when the intersection is small re"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","s":"hek12-hek-scs-wn","title":"HEK SCS-WN","key":"HEK12","y":2012,"sub":"Sort-compare-shuffle PSI by Yao's garbled circuits: each party sorts its set locally, a bitonic merger sorts the union, DupSelect-3 circuits keep the duplicates, and a Waksman switching network programmed by the generato"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2016-KKRT","s":"kkrt16-kkrt-psi","title":"KKRT PSI","key":"KKRT16","y":2016,"sub":"Semi-honest PSI from BaRK-OPRF, an IKNP-style OT extension whose width is a pseudorandom code rather than a repetition code, so one OPRF instance costs one matrix row whatever the item length. Bob cuckoo-hashes his items"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2017-CLR","s":"clr17-clr17-fhe-psi","title":"CLR17 FHE PSI","key":"CLR17","y":2017,"sub":"Unbalanced PSI from leveled FV: the receiver sends its cuckoo table batched and encrypted, and the sender homomorphically evaluates, slot by slot, the polynomial whose roots are its items in the matching bin. Windowing, "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","s":"kmprt17-kmprt-three-party-psi","title":"KMPRT three-party PSI","key":"KMPRT17","y":2017,"sub":"Three-party PSI computed incrementally through three OPPRFs in a ring. The leader programs random encodings of its items to the second party, which reprograms what it receives to the third, which reprograms back to the l"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","s":"kmprt17-kmprt-augmented-semi-honest","title":"KMPRT augmented semi-honest multiparty PSI","key":"KMPRT17","y":2017,"sub":"The KMPRT protocol with the conditional zero-sharing replaced by unconditional zero-sharing from pairwise PRF seeds. Each party programs one OPPRF to the leader with its PRF share of zero per item, so only the reconstruc"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2017-KMPRT-SH","s":"kmprt17-kmprt-semi-honest-multiparty","title":"KMPRT semi-honest multiparty PSI","key":"KMPRT17","y":2017,"sub":"Multiparty PSI from oblivious programmable PRFs. The parties first deal each other shares of zero conditioned on holding an item, through pairwise OPPRFs; each then programs an OPPRF to the leader with its share, and the"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","s":"rr17-rr17-de-rom","title":"RR17 DE-ROM","key":"RR17","y":2017,"sub":"Malicious PSI that applies dual execution to the PSZ paradigm: each bin position runs an oblivious encoding in each direction, and Alice sends the XOR of both encodings for her items, aggregated across bins. Simple hashi"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","s":"rr17-rr17-ec-rom","title":"RR17 EC-ROM","key":"RR17","y":2017,"sub":"Malicious PSI in which Bob obliviously encodes his binned items and Alice commits to each of her items, sending decommitments masked under PRFs of her encodings with tags that let Bob find which to open. Commitments are "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","s":"rr17-rr17-sm","title":"RR17 SM","key":"RR17","y":2017,"sub":"The dual-execution PSI of RR17 with each oblivious encoding built from σ chosen-message OTs combined through a PRF, so no random oracle is needed. The cost grows with the item length σ."},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2018-CHLR","s":"chlr18-chlr18-psi","title":"CHLR18 PSI","key":"CHLR18","y":2018,"sub":"The CLR17 protocol run on OPRF outputs: both sets pass through a Diffie-Hellman OPRF keyed by the sender, which removes noise flooding and lets the receiver be extracted, and extension-field SIMD slots carry long items. "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","s":"chlr18-chlr18-labeled-psi","title":"CHLR18 labeled PSI","key":"CHLR18","y":2018,"sub":"Labeled PSI on the CHLR18 protocol: the sender pads each label with the second half of its item's OPRF output and interpolates, per subset, a polynomial that maps items to padded labels. It evaluates these polynomials on"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","s":"chlr18-chlr18-leaky-malicious-psi","title":"CHLR18 leaky malicious PSI","key":"CHLR18","y":2018,"sub":"Labeled PSI with the label of each item set to a random-oracle hash of its OPRF value, so a correct label for a receiver item requires knowing that item. Under the assumption that the FHE parameters cannot evaluate the h"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2018-PSWW-2D","s":"psww18-psww-2d-cuckoo-circuit","title":"PSWW 2D cuckoo circuit-PSI","key":"PSWW18","y":2018,"sub":"Circuit-based PSI from iterative two-dimensional cuckoo hashing: Alice places each item in both bins of one of two tables with two-item bins and no stash, Bob places each item once in each table with one combined stash, "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","s":"psww18-psww-mirror-cuckoo-circuit","title":"PSWW mirror cuckoo circuit-PSI","key":"PSWW18","y":2018,"sub":"Circuit-based PSI from mirror cuckoo hashing: Alice maps each item to two subtables of one column of four tables by reusing her cuckoo placements, Bob runs cuckoo hashing four times, and a generic circuit compares each b"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2018-PSZ-OT","s":"psz18-psz18-ot-hashing","title":"PSZ18 OT + hashing","key":"PSZ18","y":2018,"sub":"Semi-honest OT-based PSI in which P2 cuckoo-hashes and P1 simple-hashes into the same bins, and one random 1-out-of-N OT per bin realizes an OPRF on items shortened by permutation-based hashing. P1 sends the OPRF values "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2019-GS-AHE","s":"gs19-ghosh-simkin-ahe-threshold","title":"Ghosh-Simkin AHE threshold PSI","key":"GS19","y":2019,"sub":"Two-party threshold PSI in two steps: a private intersection cardinality test that encodes each set as a sum of monomials and tests the sparsity of their difference through an encrypted Hankel matrix, then noisy polynomi"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2019-GS-FHE","s":"gs19-ghosh-simkin-fhe-threshold","title":"Ghosh-Simkin FHE threshold PSI","key":"GS19","y":2019,"sub":"The communication upper bound for two-party threshold PSI: the Minsky–Trachtenberg–Zippel set reconciliation protocol run under FHE. Alice sends encrypted evaluations of her root polynomial; Bob interpolates the rational"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2019-KRSSW-GC","s":"krssw19-lowmc-gc-psi","title":"LowMC-GC-PSI","key":"KRSSW19","y":2019,"sub":"Unbalanced PSI with precomputation: the server sends a compressed cuckoo filter of LowMC values of its whole set once; in a base phase it garbles LowMC circuits for the client and runs correlated OTs with it; online the "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2019-KRSSW-NR","s":"krssw19-ecc-nr-psi","title":"ECC-NR-PSI","key":"KRSSW19","y":2019,"sub":"Unbalanced PSI with precomputation from the Naor-Reingold PRF: the server sends a compressed cuckoo filter of PRF values of its whole set once, and online the client, using precomputed random OTs, receives either a mask "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","s":"psty19-psty-advanced-dual-execution","title":"PSTY advanced (dual-execution) OPPRF circuit-PSI","key":"PSTY19","y":2019,"sub":"Circuit-based PSI with linear communication: a first OPPRF phase covers P1's cuckoo-table items, a second phase with roles reversed maps P1's stashed items against P2's cuckoo table, and the circuit compares only the two"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","s":"psty19-psty-basic-opprf-circuit","title":"PSTY basic OPPRF circuit-PSI","key":"PSTY19","y":2019,"sub":"Circuit-based PSI in which P1 cuckoo-hashes into 2.4n bins and a stash, a batched OPPRF gives one value per bin to compare, and a generic two-party circuit compares each bin once and each stashed item with all of P2's it"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","s":"psty19-psty-no-stash-opprf","title":"PSTY no-stash OPPRF circuit-PSI","key":"PSTY19","y":2019,"sub":"Circuit-based PSI in which P1 cuckoo-hashes with three hash functions into 1.27n bins and no stash, a batched OPPRF from per-mega-bin hint polynomials gives one value per bin, and the circuit makes one γ-bit equality tes"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2020-ION-BF","s":"ikn20-ion-et-al-encrypted","title":"Ion et al. encrypted Bloom filter intersection-sum","key":"IKN+20","y":2020,"sub":"Private intersection-sum with cardinality from an encrypted Bloom filter: P1 sends its Bloom filter encrypted bit by bit, P2 computes for each item a ciphertext that is zero exactly on a match and sends it shuffled with "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2020-ION-DDH","s":"ikn20-ion-et-al-ddh","title":"Ion et al. DDH intersection-sum (deployed)","key":"IKN+20","y":2020,"sub":"Private intersection-sum with cardinality from double-exponentiated hashed Diffie-Hellman: each party exponentiates hashed identifiers with its key in shuffled order, P2 attaches Paillier encryptions of its values, and P"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","s":"ikn20-ion-et-al-ddh-2","title":"Ion et al. DDH intersection-sum (Ring-LWE)","key":"IKN+20","y":2020,"sub":"The deployed DDH-based intersection-sum protocol with the associated values encrypted under slotted Ring-LWE instead of Paillier, which the paper finds about 40% faster for similar communication."},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2020-ION-ROT","s":"ikn20-ion-et-al-random","title":"Ion et al. random-OT intersection-sum","key":"IKN+20","y":2020,"sub":"Private intersection-sum with cardinality from batched random-OT OPRFs: P1 cuckoo-hashes its items, encrypts its OPRF outputs for P2 to re-mask and shuffle, and matches them against P2's masked OPRF values to sum P2's en"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2020-PRTY-MAL","s":"prty20-paxos-psi-malicious-2","title":"PaXoS-PSI (malicious, 2-core table)","key":"PRTY20","y":2020,"sub":"Malicious PaXoS-PSI: the receiver encodes (y, H1(y)) into the 2-core garbled cuckoo table and uses it as its OOS choice strings, and the sender sends H2(x, ·) of each item, so a simulator extracts both parties' sets from"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","s":"prty20-paxos-psi-malicious-dfs","title":"PaXoS-PSI (malicious, DFS table)","key":"PRTY20","y":2020,"sub":"Malicious PaXoS-PSI over the DFS-based garbled cuckoo table of Appendix B, with 2n main positions instead of 2.4n. It sends the least of the paper's malicious configurations."},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2020-PRTY-SH","s":"prty20-paxos-psi-semi-honest","title":"PaXoS-PSI (semi-honest, 2-core table)","key":"PRTY20","y":2020,"sub":"PSI from a PaXoS (garbled cuckoo table): the receiver encodes its items into the table and uses it as its choice strings in the OOS OT extension, whose XOR-homomorphism lets the sender evaluate each item's mask. This row"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","s":"prty20-paxos-psi-semi-honest-2","title":"PaXoS-PSI (semi-honest, DFS table)","key":"PRTY20","y":2020,"sub":"PaXoS-PSI with the alternative garbled cuckoo table of Appendix B, built by a DFS traversal that turns each cycle into one constraint on the extra positions. Its 2n main positions give the paper's lowest semi-honest comm"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","s":"bmrr21-bmrr-two-party-ahe","title":"BMRR two-party AHE threshold PSI","key":"BMRR21","y":2021,"sub":"The two-party case of BMRR's TAHE route, offered as the answer to the open problem of Ghosh–Simkin: the monomial encoding and sparsity test, with the Hankel singularity test done by half-GCD inside Yao's garbled circuits"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","s":"bmrr21-bmrr-tahe-threshold-psi","title":"BMRR TAHE threshold PSI (diff)","key":"BMRR21","y":2021,"sub":"Multiparty threshold PSI for the union-minus-intersection threshold: each party encodes its set as a sum of monomials, the parties test the sparsity of a weighted difference through a Hankel matrix whose singularity is d"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","s":"bmrr21-bmrr-tfhe-threshold-psi","title":"BMRR TFHE threshold PSI (diff)","key":"BMRR21","y":2021,"sub":"Multiparty threshold PSI for the union-minus-intersection threshold from threshold FHE: the central party homomorphically reconstructs, for each other party, the encrypted set differences with its own set and tests the s"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","s":"bmrr21-bmrr-tfhe-threshold-psi-2","title":"BMRR TFHE threshold PSI (int)","key":"BMRR21","y":2021,"sub":"Multiparty threshold PSI for the per-set threshold from threshold FHE: each party sends encrypted evaluations of its randomized root polynomial, the central party homomorphically interpolates one rational function and te"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-CONG","s":"cmg21-cmgd21-psi-seal","title":"CMGD21 PSI (SEAL)","key":"CMG+21","y":2021,"sub":"The CHLR18 protocol with a mandatory OPRF, items split over prime-field SIMD slots instead of extension fields, Paterson–Stockmeyer evaluation of each partition's intersection polynomial, and query powers chosen by extre"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","s":"cmg21-cmgd21-psi-helib-frobenius","title":"CMGD21 PSI (HElib, Frobenius)","key":"CMG+21","y":2021,"sub":"A low-communication configuration of CMGD21 over HElib BGV: with a small plaintext prime, the sender obtains most powers of the receiver's query by depth-free Frobenius operations, so a constant number of encrypted power"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-CONG-LABELED","s":"cmg21-cmgd21-labeled-psi-seal","title":"CMGD21 labeled PSI (SEAL)","key":"CMG+21","y":2021,"sub":"Labeled PSI over prime-field slots: each label is encrypted under a key from the extended OPRF output, split into item-length fragments, and interpolated fragment by fragment per bin and partition. The sender evaluates t"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","s":"gprty21-paxos-psi-with-3h","title":"PaXoS-PSI with 3H-GCT (malicious)","key":"GPRTY21","y":2021,"sub":"PaXoS-PSI with its binary OKVS replaced by a three-hash garbled cuckoo table of about \\( 1.3n \\) slots. The receiver encodes its items in the table and runs one OOS OT per slot; the sender hashes its decoded values, and "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","s":"gprty21-paxos-psi-with-star","title":"PaXoS-PSI with star-architecture OKVS (malicious)","key":"GPRTY21","y":2021,"sub":"PaXoS-PSI over the star-architecture OKVS, which hashes items into leaf three-hash tables and adds a centre table that absorbs any one leaf failure. Amplification turns an empirically measured leaf failure rate into a sm"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","s":"gprty21-malicious-multiparty-psi-fro","title":"Malicious multiparty PSI from OPRF and OKVS","key":"GPRTY21","y":2021,"sub":"The KMPRT augmented semi-honest protocol over any OKVS and a malicious two-party OPRF, with each OPRF output hashed by a random oracle before it is masked with a PRF zero-share. The added hash lets the simulator extract "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","s":"gprty21-generalized-paxos-psi-over","title":"Generalized PaXoS-PSI over vOLE","key":"GPRTY21","y":2021,"sub":"PaXoS-PSI generalized to any linear OKVS by replacing the OOS correlation with vector OLE over \\( \\mathrm{GF}(2^{\\ell_1}) \\). The receiver's OKVS of its hashed items is the vOLE input, so no error-correcting code is need"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","s":"nty21-nty-multiparty-psi-arbitrary","title":"NTY multiparty PSI, arbitrary collusion","key":"NTY21","y":2021,"sub":"Malicious multiparty PSI calibrated to the number of corruptions. Clients deliver a conditional zero-sharing to a pivot and \\( t_c \\) servers through one OKVS and \\( t_c \\) PRF keys each, and those \\( t_c + 1 \\) parties "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","s":"nty21-nty-multiparty-psi-no","title":"NTY multiparty PSI, no collusion","key":"NTY21","y":2021,"sub":"Malicious multiparty PSI against a single corrupt party from PRF keys and OKVS encodings alone. One party deals PRF keys and an OKVS so that the intersection of all sets reduces to a two-party PSI between the last two pa"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","s":"rs21-vole-psi-circuit-psi","title":"VOLE-PSI circuit-PSI","key":"RS21","y":2021,"sub":"Circuit-PSI after Pinkas, Schneider, Tkachenko and Yanai with a VOLE-based OPPRF programmed through XoPaXoS: the receiver cuckoo-hashes, the sender simple-hashes and programs a random value per bin, and GMW compares the "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","s":"rs21-vole-psi-circuit-psi-2","title":"VOLE-PSI circuit-PSI (SilentOT)","key":"RS21","y":2021,"sub":"The VOLE-PSI circuit-PSI with GMW's offline OTs generated by SilentOT instead of IKNP, which removes the κ factor from the comparison phase's communication. It is the faster variant on slow networks."},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RS-MAL","s":"rs21-vole-psi-malicious-paxos","title":"VOLE-PSI (malicious, PaXoS)","key":"RS21","y":2021,"sub":"The VOLE-based OPRF with a random-oracle encoding of the receiver's set and a coin-tossed offset, giving malicious security at almost no extra cost. The sender's OPRF values need only κ bits, by the paper's sharper analy"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","s":"rs21-vole-psi-malicious-interpola","title":"VOLE-PSI (malicious, interpolation)","key":"RS21","y":2021,"sub":"The malicious VOLE-PSI with the PaXoS encoding replaced by polynomial interpolation, an OKVS of rate one: the receiver's encoding shrinks from about \\( 2.4\\kappa \\) to \\( \\kappa \\) bits per item, at quasi-linear interpol"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RS-SH","s":"rs21-vole-psi-semi-honest","title":"VOLE-PSI (semi-honest, PaXoS)","key":"RS21","y":2021,"sub":"PSI from an OPRF built on VOLE: the receiver solves a PaXoS for its items, derandomizes a random VOLE of that length with one κ-bit element per position, and the sender evaluates the OPRF on its own set and sends the val"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","s":"rs21-vole-psi-semi-honest-2","title":"VOLE-PSI (semi-honest, interpolation)","key":"RS21","y":2021,"sub":"The semi-honest VOLE-PSI with the PaXoS encoding replaced by polynomial interpolation, an OKVS of rate one: the receiver's encoding shrinks from about \\( 2.4\\kappa \\) to \\( \\kappa \\) bits per item, at quasi-linear interp"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RT-MAL","s":"rt21-rt21-malicious","title":"RT21 malicious","key":"RT21","y":2021,"sub":"Malicious PSI from a key agreement with pseudorandom, non-malleable messages: the sender sends one Diffie-Hellman message, the receiver encodes its responses through an ideal permutation as a polynomial at hashed items, "},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RT-SH-V1","s":"rt21-rt21-semi-honest-variant","title":"RT21 semi-honest variant 1","key":"RT21","y":2021,"sub":"Semi-honest variant of the key-agreement PSI: the receiver interpolates its Diffie-Hellman responses, through an inverse ideal permutation, at its plain items, and the sender returns keys shortened to the statistical par"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2021-RT-SH-V2","s":"rt21-rt21-semi-honest-variant-2","title":"RT21 semi-honest variant 2","key":"RT21","y":2021,"sub":"Semi-honest key-agreement PSI without an ideal permutation: the receiver interpolates its Diffie-Hellman responses directly at its items and adds a random point at zero, which lets the simulator program one evaluation at"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","s":"rr22-raghuraman-rindal-circuit-ps","title":"Raghuraman-Rindal circuit-PSI","key":"RR22","y":2022,"sub":"The VOLE-PSI circuit-PSI with the row-weight-3 triangulation OKVS in its doubly oblivious form and Silver for the VOLE and OT correlations. The paper describes it only through VOLE-PSI and one benchmark row."},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2022-RR-FAST","s":"rr22-raghuraman-rindal-psi-semi","title":"Raghuraman-Rindal PSI (semi-honest, fast)","key":"RR22","y":2022,"sub":"VOLE-PSI with the triangulation OKVS of row weight 3, clustered for speed, and no subfield: the receiver derandomizes a VOLE into its OKVS and the sender sends OPRF values. The new OKVS encodes in near-linear time with o"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2022-RR-MAL","s":"rr22-raghuraman-rindal-psi-malici","title":"Raghuraman-Rindal PSI (malicious)","key":"RR22","y":2022,"sub":"The malicious VOLE-PSI protocol of Rindal and Schoppmann run with the triangulation OKVS in place of PaXoS. The authors observe almost no overhead over their semi-honest protocol."},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2022-RR-SD","s":"rr22-raghuraman-rindal-psi-semi-2","title":"Raghuraman-Rindal PSI (semi-honest, subfield VOLE)","key":"RR22","y":2022,"sub":"VOLE-PSI over subfield VOLE: the OKVS lives in a base field just large enough to avoid false matches, about \\( \\lambda + \\log(n_X n_Y) \\) bits, while the VOLE key is in a \\( 2^{\\kappa} \\) extension, so communication is \\"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","s":"gs23-ghosh-simkin-2023-multiparty","title":"Ghosh-Simkin 2023 multiparty threshold PSI","key":"GS23","y":2023,"sub":"Multiparty threshold PSI with communication quasilinear in the threshold, from generic secure computation. Each party hashes its set into \\( t \\) buckets under \\( \\lambda \\) functions, the parties test each bucket's inte"},{"t":"psi","k":"scheme","id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","s":"gs23-ghosh-simkin-2023-two","title":"Ghosh-Simkin 2023 two-party threshold PSI","key":"GS23","y":2023,"sub":"Two-party threshold PSI that hashes both sets into \\( t \\) buckets under \\( \\lambda \\) functions and runs the Ghosh-Simkin cardinality test at a logarithmic threshold on every bucket, combining the secret-shared results."},{"t":"psi","k":"problem","id":"PSI-OP-001","s":"op-1","title":"Unbalanced PSI against a malicious sender with sublinear communication","key":null,"y":null,"sub":"Open problem · Can a receiver with a small set learn its intersection with a much larger sender set, with full simulation-based security against either party acting maliciously, while communication stays sublinear in the"},{"t":"psi","k":"problem","id":"PSI-OP-002","s":"op-2","title":"Unbalanced PSI against a malicious receiver with sublinear communication","key":null,"y":null,"sub":"Solved problem · Unbalanced PSI with communication sublinear in the sender's set, secure against a malicious receiver and only private against a malicious sender: the sender learns nothing about the receiver's set, but t"},{"t":"psi","k":"problem","id":"PSI-OP-003","s":"op-3","title":"Semi-honest unbalanced PSI with sublinear communication","key":null,"y":null,"sub":"Solved problem · Unbalanced PSI with communication sublinear in the sender's set, for parties that follow the protocol. Solved with leveled homomorphic encryption, batching, and hashing: communication \\( O(|Y| \\log |X|) "},{"t":"psi","k":"problem","id":"PSI-OP-004","s":"op-4","title":"Unbalanced PSI against a malicious sender with bounded leakage","key":null,"y":null,"sub":"Solved problem · Unbalanced PSI with sublinear communication, secure against a malicious sender when the receiver's output may be \\( X \\cap Y \\cap L(Y) \\) for a leakage function \\( L \\) that the sender chooses. Solved un"},{"t":"psi","k":"problem","id":"PSI-OP-005","s":"op-5","title":"Multiparty threshold PSI with optimal communication without FHE","key":null,"y":null,"sub":"Open problem · Can many parties learn the intersection of their sets exactly when it is large, with communication matching the \\( \\Omega(\\ell t) \\) lower bound up to polylogarithmic and security-parameter factors, withou"},{"t":"psi","k":"problem","id":"PSI-OP-006","s":"op-6","title":"Multiparty threshold PSI with optimal communication from threshold FHE","key":null,"y":null,"sub":"Solved problem · Multiparty threshold PSI at the optimal communication, with threshold fully homomorphic encryption allowed. Solved with \\( O(\\ell t \\cdot \\mathrm{poly}(\\lambda)) \\) communication in a constant number of "},{"t":"psi","k":"problem","id":"PSI-OP-007","s":"op-7","title":"Two-party threshold PSI with quasi-linear communication without FHE","key":null,"y":null,"sub":"Solved problem · Threshold PSI without FHE at quasi-linear communication, for two parties, posed by Ghosh and Simkin. Solved: a Hankel-matrix singularity test of quasi-linear cost gives communication quasi-linear in \\( t"},{"t":"psi","k":"problem","id":"PSI-OP-008","s":"op-8","title":"Two-party intersection cardinality test with quasi-linear communication","key":null,"y":null,"sub":"Solved problem · A two-party protocol, without FHE, that decides whether two sets of \\( n \\) elements share at least \\( n - t \\) of them, with communication quasi-linear in \\( t \\). By the Ghosh-Simkin reduction it settl"},{"t":"psi","k":"problem","id":"PSI-OP-009","s":"op-9","title":"Multiparty threshold PSI without FHE when broadcasts count once","key":null,"y":null,"sub":"Solved problem · Multiparty threshold PSI without FHE at near-optimal communication, in a network with a broadcast channel whose messages count once. Solved from oblivious transfer or additively homomorphic encryption wi"},{"t":"psi","k":"problem","id":"PSI-OP-010","s":"op-10","title":"Multiparty intersection cardinality test with optimal communication without FHE","key":null,"y":null,"sub":"Open problem · An \\( \\ell \\)-party protocol, without FHE, that tells all parties whether their intersection has at least \\( n - t \\) elements, with \\( \\ell t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) comm"},{"t":"psi","k":"problem","id":"PSI-OP-011","s":"op-11","title":"Malicious PSI deployable for contact discovery","key":null,"y":null,"sub":"Open problem · Can PSI secure against a malicious client and a malicious server check 10,000 contacts against \\( 10^{9} \\) users in under 2 s, with one server core handling 1,600 contacts per second, as Signal's develope"},{"t":"psi","k":"paper","id":"PSI-PAPER-1999-HFH","s":"hfh99","title":"Enhancing Privacy and Trust in Electronic Communities","key":"HFH99","y":1999,"sub":"Bernardo A. Huberman, Matt Franklin, Tad Hogg · ACM EC 1999"},{"t":"psi","k":"paper","id":"PSI-PAPER-2004-FNP","s":"fnp04","title":"Efficient Private Matching and Set Intersection","key":"FNP04","y":2004,"sub":"Michael J. Freedman, Kobbi Nissim, Benny Pinkas · EUROCRYPT 2004"},{"t":"psi","k":"paper","id":"PSI-PAPER-2010-DT","s":"dt10","title":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","key":"DT10","y":2010,"sub":"Emiliano De Cristofaro, Gene Tsudik · FC 2010"},{"t":"psi","k":"paper","id":"PSI-PAPER-2012-HEK","s":"hek12","title":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","key":"HEK12","y":2012,"sub":"Yan Huang, David Evans, Jonathan Katz · NDSS 2012"},{"t":"psi","k":"paper","id":"PSI-PAPER-2016-KKRT","s":"kkrt16","title":"Efficient Batched Oblivious PRF with Applications to Private Set Intersection","key":"KKRT16","y":2016,"sub":"Vladimir Kolesnikov, Ranjit Kumaresan, Mike Rosulek, Ni Trieu · ACM CCS 2016"},{"t":"psi","k":"paper","id":"PSI-PAPER-2017-CLR","s":"clr17","title":"Fast Private Set Intersection from Homomorphic Encryption","key":"CLR17","y":2017,"sub":"Hao Chen, Kim Laine, Peter Rindal · ACM CCS 2017"},{"t":"psi","k":"paper","id":"PSI-PAPER-2017-KMPRT","s":"kmprt17","title":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","key":"KMPRT17","y":2017,"sub":"Vladimir Kolesnikov, Naor Matania, Benny Pinkas, Mike Rosulek, Ni Trieu · ACM CCS 2017"},{"t":"psi","k":"paper","id":"PSI-PAPER-2017-RR-CCS","s":"rr17","title":"Malicious-Secure Private Set Intersection via Dual Execution","key":"RR17","y":2017,"sub":"Peter Rindal, Mike Rosulek · ACM CCS 2017"},{"t":"psi","k":"paper","id":"PSI-PAPER-2018-CHLR","s":"chlr18","title":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","key":"CHLR18","y":2018,"sub":"Hao Chen, Zhicong Huang, Kim Laine, Peter Rindal · ACM CCS 2018"},{"t":"psi","k":"paper","id":"PSI-PAPER-2018-EKR","s":"ekr18","title":"A Pragmatic Introduction to Secure Multi-Party Computation","key":"EKR18","y":2018,"sub":"David Evans, Vladimir Kolesnikov, Mike Rosulek · NOW Publishers, 2018"},{"t":"psi","k":"paper","id":"PSI-PAPER-2018-PSWW","s":"psww18","title":"Efficient Circuit-based PSI via Cuckoo Hashing","key":"PSWW18","y":2018,"sub":"Benny Pinkas, Thomas Schneider, Christian Weinert, Udi Wieder · EUROCRYPT 2018"},{"t":"psi","k":"paper","id":"PSI-PAPER-2018-PSZ","s":"psz18","title":"Scalable Private Set Intersection Based on OT Extension","key":"PSZ18","y":2018,"sub":"Benny Pinkas, Thomas Schneider, Michael Zohner · ACM Transactions on Privacy and Security 21(2)"},{"t":"psi","k":"paper","id":"PSI-PAPER-2019-GS","s":"gs19","title":"The Communication Complexity of Threshold Private Set Intersection","key":"GS19","y":2019,"sub":"Satrajit Ghosh, Mark Simkin · CRYPTO 2019"},{"t":"psi","k":"paper","id":"PSI-PAPER-2019-KRSSW","s":"krssw19","title":"Mobile Private Contact Discovery at Scale","key":"KRSSW19","y":2019,"sub":"Daniel Kales, Christian Rechberger, Thomas Schneider, Matthias Senker, Christian Weinert · USENIX Security 2019"},{"t":"psi","k":"paper","id":"PSI-PAPER-2019-PSTY","s":"psty19","title":"Efficient Circuit-based PSI with Linear Communication","key":"PSTY19","y":2019,"sub":"Benny Pinkas, Thomas Schneider, Oleksandr Tkachenko, Avishay Yanai · EUROCRYPT 2019"},{"t":"psi","k":"paper","id":"PSI-PAPER-2020-ION","s":"ikn20","title":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","key":"IKN+20","y":2020,"sub":"Mihaela Ion, Ben Kreuter, Ahmet Erhan Nergiz, Sarvar Patel, Shobhit Saxena, Karn Seth, Mariana Raykova, David Shanahan, Moti Yung · IEEE EuroS&P 2020"},{"t":"psi","k":"paper","id":"PSI-PAPER-2020-PRTY","s":"prty20","title":"PSI from PaXoS: Fast, Malicious Private Set Intersection","key":"PRTY20","y":2020,"sub":"Benny Pinkas, Mike Rosulek, Ni Trieu, Avishay Yanai · EUROCRYPT 2020"},{"t":"psi","k":"paper","id":"PSI-PAPER-2021-BMRR","s":"bmrr21","title":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","key":"BMRR21","y":2021,"sub":"Saikrishna Badrinarayanan, Peihan Miao, Srinivasan Raghuraman, Peter Rindal · PKC 2021"},{"t":"psi","k":"paper","id":"PSI-PAPER-2021-CONG","s":"cmg21","title":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","key":"CMG+21","y":2021,"sub":"Kelong Cong, Radames Cruz Moreno, Mariana Botelho da Gama, Wei Dai, Ilia Iliashenko, Kim Laine, Michael Rosenberg · ACM CCS 2021"},{"t":"psi","k":"paper","id":"PSI-PAPER-2021-GPRTY","s":"gprty21","title":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","key":"GPRTY21","y":2021,"sub":"Gayathri Garimella, Benny Pinkas, Mike Rosulek, Ni Trieu, Avishay Yanai · CRYPTO 2021"},{"t":"psi","k":"paper","id":"PSI-PAPER-2021-NTY","s":"nty21","title":"Simple, Fast Malicious Multiparty Private Set Intersection","key":"NTY21","y":2021,"sub":"Ofri Nevo, Ni Trieu, Avishay Yanai · ACM CCS 2021"},{"t":"psi","k":"paper","id":"PSI-PAPER-2021-RS","s":"rs21","title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","key":"RS21","y":2021,"sub":"Peter Rindal, Phillipp Schoppmann · EUROCRYPT 2021"},{"t":"psi","k":"paper","id":"PSI-PAPER-2021-RT","s":"rt21","title":"Compact and Malicious Private Set Intersection for Small Sets","key":"RT21","y":2021,"sub":"Mike Rosulek, Ni Trieu · ACM CCS 2021"},{"t":"psi","k":"paper","id":"PSI-PAPER-2022-RR","s":"rr22","title":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","key":"RR22","y":2022,"sub":"Srinivasan Raghuraman, Peter Rindal · ACM CCS 2022"},{"t":"psi","k":"paper","id":"PSI-PAPER-2023-GS","s":"gs23","title":"Threshold Private Set Intersection with Better Communication Complexity","key":"GS23","y":2023,"sub":"Satrajit Ghosh, Mark Simkin · PKC 2023"},{"t":"psi","k":"paper","id":"PSI-PAPER-2024-VCE","s":"vce24","title":"SoK: Collusion-resistant Multi-party Private Set Intersections in the Semi-honest Model","key":"VCE24","y":2024,"sub":"Jelle Vos, Mauro Conti, Zekeriya Erkin · IEEE S&P 2024"},{"t":"psi","k":"result","id":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","s":"hfh99-diffie-hellman-preference-ma","title":"Diffie-Hellman preference matching","key":"HFH99","y":1999,"sub":"Two parties holding lists \\( x_1, \\ldots, x_{n_X} \\) and \\( y_1, \\ldots, y_{n_Y} \\) each raise hashes of their own items modulo a prime \\( p \\) to a secret random exponent, exchange the permuted results, raise the other "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","s":"fnp04-lower-bound-for-approximate","title":"Lower bound for approximate intersection size","key":"FNP04","y":2004,"sub":"For sets given as characteristic strings of \\( u \\) bits, \\( u \\) the domain size, any protocol that outputs an \\( (\\varepsilon, \\delta) \\)-approximation of \\( |X \\cap Y| \\), that is a value within a factor \\( 1 \\pm \\var"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","s":"fnp04-server-exponentiations-o-n","title":"Server exponentiations \\( O(n_Y + n_X \\ln\\ln n_Y) \\) in polynomial-evaluation PSI via balanced-allocation hashing into low-degree bin polynomials, semi-honest","key":"FNP04","y":2004,"sub":"In polynomial-evaluation PSI, the client maps her items into \\( B \\) bins with the two-choice balanced-allocation hash of Azar et al., pads each bin with zero roots to a common degree \\( M \\), and sends one encrypted pol"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","s":"fnp04-intersection-size-or-a","title":"Intersection size or a threshold decision on it, instead of the intersection, from polynomial-evaluation PSI, semi-honest","key":"FNP04","y":2004,"sub":"In polynomial-evaluation PSI, if the server encodes a fixed string \\( 0^{s} \\) of \\( s \\) zero bits instead of its item as the payload, the client learns only how many of its decryptions equal that string, that is \\( |X "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","s":"fnp04-malicious-secure-polynomial","title":"Malicious-secure polynomial-evaluation PSI","key":"FNP04","y":2004,"sub":"Against a malicious client, the client builds L copies of her bin polynomials over pseudorandom identities \\( F_s(G(x)) \\) of her items, the server opens \\( L/2 \\) copies to check that each has \\( n_Y \\) nonzero roots an"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","s":"fnp04-multi-party-set-intersection","title":"Multi-party set intersection from encrypted client polynomials and XOR-shared payloads with re-randomizing zero shares, semi-honest (protocol sketch)","key":"FNP04","y":2004,"sub":"For \\( \\ell \\) parties with \\( n \\) items each, \\( \\ell - 1 \\) clients publish polynomials encoding their items under their own additively homomorphic keys, together with encrypted random shares that XOR to zero for each"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2004-FNP-OPE-PSI","s":"fnp04-polynomial-evaluation-psi","title":"Polynomial-evaluation PSI","key":"FNP04","y":2004,"sub":"The client encodes her \\( n_Y \\) items as the roots of a polynomial P and sends its coefficients encrypted under a semantically secure additively homomorphic scheme; for each of his \\( n_X \\) items y the server homomorph"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2004-FNP-OT-REDUCTION","s":"fnp04-private-matching-implies-obl","title":"Private matching implies oblivious transfer, so set intersection has no black-box construction from one-way functions","key":"FNP04","y":2004,"sub":"Semi-honest 1-out-of-2 bit oblivious transfer reduces to private matching: the sender inputs the set \\( \\{0|b_0, 1|b_1\\} \\), the chooser inputs \\( \\{\\sigma|0, \\sigma|1\\} \\), and the chooser's output of the matching proto"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2010-DT-BLIND-RSA","s":"dt10-psi-from-rsa-blind","title":"PSI from RSA blind signatures with server precomputation and no online client exponentiations, semi-honest, random oracle model","key":"DT10","y":2010,"sub":"The server signs the full-domain hash of each of its \\( n_X \\) items with its RSA key offline and sends the tags \\( H'(H(s_j)^d) \\); the client blinds each hashed item as \\( H(c_i) \\cdot R_i^e \\), the server returns \\( ("},{"t":"psi","k":"result","id":"PSI-CONTRIB-2010-DT-LINEAR-APSI","s":"dt10-authorized-psi-with-computat","title":"Authorized PSI with computation and communication linear in both set sizes, \\( O(n_X + n_Y) \\), and its prime-order-group PSI version, semi-honest, random oracle model","key":"DT10","y":2010,"sub":"In authorized PSI, where each client item must carry an RSA signature issued by an offline certification authority, the client sends one aggregate value X built from the product of its signatures and one blinded value pe"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","s":"hek12-measured-running-time-and","title":"Measured running time and bandwidth of garbled-circuit PSI against the fastest custom public-key PSI, semi-honest two-party","key":"HEK12","y":2012,"sub":"With both protocols implemented on the same two desktops (Intel Core 2 Duo E8400, 100 Mbps LAN), the garbled-circuit SCS-WN protocol computed the intersection of two sets of 1024 elements in 10.5 to 22.7 seconds for 32-b"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2012-HEK-SIZE-AUDITING","s":"hek12-size-based-auditing-inside","title":"Size-based auditing inside garbled-circuit PSI: the intersection is withheld when its size exceeds a threshold","key":"HEK12","y":2012,"sub":"Because the PSI protocols are pure garbled circuits, the circuit can obliviously count the intersection size \\( \\hat{n} \\) and compare it with a threshold, revealing nothing but that fact when \\( \\hat{n} \\) exceeds it; i"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","s":"hek12-sort-compare-shuffle-psi","title":"Sort-compare-shuffle PSI circuit","key":"HEK12","y":2012,"sub":"Against semi-honest parties holding \\( n \\) elements of \\( \\sigma \\) bits each, the intersection can be computed by evaluating with Yao's garbled-circuit protocol a circuit that merges the two locally sorted sets with a "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","s":"kkrt16-batched-related-key-oprf","title":"Batched related-key OPRF","key":"KKRT16","y":2016,"sub":"Against semi-honest adversaries, the BaRK-OPRF protocol produces a batch of m oblivious PRF instances with related keys, each of which the receiver evaluates on one input from \\( \\{0,1\\}^* \\), using k base OTs and symmet"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","s":"kkrt16-semi-honest-two-party","title":"Semi-honest two-party PSI with OT-extension cost per bin independent of item length, from BaRK-OPRF in the cuckoo-hashing paradigm of Pinkas, Schneider, Segev, and Zohner","key":"KKRT16","y":2016,"sub":"Replacing the OPRF implicit in the PSSZ protocol, which spends one 1-out-of-256 random OT per byte of the effective item length, with BaRK-OPRF gives a semi-honest PSI protocol whose OT-extension cost is 424-448 bits per"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","s":"clr17-fhe-based-psi-communication","title":"FHE-based PSI, communication logarithmic in the larger set","key":"CLR17","y":2017,"sub":"Against semi-honest adversaries, a two-party PSI protocol in which the receiver, holding \\( n_Y \\) items, encrypts its cuckoo hash table under a leveled fully homomorphic encryption scheme with SIMD batching, and the sen"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","s":"kmprt17-augmented-semi-honest-multip","title":"Augmented semi-honest multiparty PSI with per-client communication \\( O(n \\lambda) \\), by replacing the pairwise OPPRF zero-sharing phase with zero-sharing from pairwise PRF seeds","key":"KMPRT17","y":2017,"sub":"In the multiparty PSI protocol with conditional zero-sharing, the pairwise OPPRF phase is replaced by unconditional zero-sharing: each pair of parties exchanges a PRF seed once, and each party derives its share of zero f"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2017-KMPRT-OPPRF","s":"kmprt17-oblivious-programmable-prf","title":"Oblivious programmable PRF","key":"KMPRT17","y":2017,"sub":"A programmable PRF takes a set of \\( n \\) points at key generation and outputs a key and a public hint; it is \\( (n, Q) \\)-secure if the hint and \\( Q \\) outputs do not reveal which points were programmed when the progra"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","s":"kmprt17-multiparty-psi-from-opprf","title":"Multiparty PSI from OPPRF zero-sharing","key":"KMPRT17","y":2017,"sub":"For \\( \\ell \\) parties with \\( n \\) items each, every party deals XOR-shares of zero for each of its items and, through a pairwise multi-query OPPRF, lets each other party obtain its share only for items both hold (condi"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT","s":"rr17-encode-commit-malicious-psi","title":"Encode-commit malicious PSI with commitments to the sender's items and decommitments masked under oblivious encodings, trading communication for computation and fixing the sender's set size, UC","key":"RR17","y":2017,"sub":"Instead of acting as encoding receiver, Alice sends for each item a commitment \\( \\mathrm{Comm}(x; r_x) \\) and, for each position of the item's bin, a tag and the decommitment \\( r_x \\) masked under two PRF values derive"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","s":"rr17-dual-execution-malicious-psi","title":"Dual-execution malicious PSI","key":"RR17","y":2017,"sub":"Both parties act as receiver of an oblivious encoding for every position of every bin, so each obtains one-sided encodings of its own items; for each of her items Alice sends the \\( \\mu \\) common encodings that combine h"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","s":"chlr18-labeled-psi-sublinear-in","title":"Labeled PSI sublinear in the sender's set","key":"CHLR18","y":2018,"sub":"In labeled PSI the sender holds a label \\( v_i \\) of \\( \\sigma_{\\mathrm{L}} \\) bits for each item \\( x_i \\) and the receiver learns the labels of the items in the intersection; if, besides the intersection polynomial, th"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","s":"chlr18-leaky-security-against-a","title":"Leaky security against a malicious sender","key":"CHLR18","y":2018,"sub":"If the receiver accepts an item y only when the sender returns, as its label, an encryption of \\( H(\\mathrm{OPRF}_k(y)) \\) for a hash function H modeled as a random oracle, the intersection polynomial is no longer return"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","s":"chlr18-arbitrary-length-items-in","title":"Arbitrary-length items in FHE-based unbalanced PSI without a plaintext modulus of the item length, via SIMD slots over extension fields","key":"CHLR18","y":2018,"sub":"Encoding each hashed item into one SIMD slot holding an element of an extension field \\( \\mathbb{F}_{p^d} \\), with \\( m/d \\) slots per BFV plaintext of ring dimension \\( m \\) and an encoder that skips the slot-permutatio"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","s":"chlr18-oprf-pre-processing-against","title":"OPRF pre-processing against a malicious receiver","key":"CHLR18","y":2018,"sub":"If both sets are first mapped through a Diffie-Hellman-based oblivious PRF \\( F_\\alpha(x) = H'(H(x)^\\alpha) \\) whose key the sender holds, and the FHE-based intersection of Chen, Laine, and Rindal is run on the outputs, "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","s":"psww18-two-dimensional-cuckoo-hashi","title":"Two-dimensional cuckoo hashing for circuit-PSI","key":"PSWW18","y":2018,"sub":"In two-dimensional cuckoo hashing one party places each item in both subtables of one of two tables, using an iterative insertion that moves evicted items to the other table, and the other party places each item in one s"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","s":"psww18-circuit-based-psi-with","title":"Circuit-based PSI with \\( \\omega(n) \\) comparisons and negligible failure probability from mirror cuckoo hashing, semi-honest two-party","key":"PSWW18","y":2018,"sub":"For two parties with \\( n \\) items of \\( \\sigma \\) bits each, mirror cuckoo hashing places every item of each party into four standard cuckoo tables of total size \\( 8(1 + \\varepsilon)n \\) so that an item held by both me"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","s":"psz18-ot-based-psi-with","title":"OT-based PSI with communication independent of item bit length for up to \\( 2^{37} \\) items, from per-bin OPRFs on 1-out-of-N random OT over a 512-bit BCH code, semi-honest","key":"PSZ18","y":2018,"sub":"P1 hashes its items into \\( b \\) bins by simple hashing with \\( k \\) hash functions and P2 by cuckoo hashing with a stash of size \\( s \\), \\( b \\) the number of bins and \\( k \\) the number of hash functions, with permuta"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","s":"psz18-concrete-simple-and-cuckoo","title":"Concrete simple- and cuckoo-hashing parameters for PSI at hashing failure probability \\( 2^{-30} \\) and \\( 2^{-40} \\), covering bin sizes, stash sizes, hash-function count, and bins for unequal set sizes","key":"PSZ18","y":2018,"sub":"By evaluating the balls-into-bins bound numerically and running \\( 2^{30} \\) cuckoo-hashing trials, the paper gives concrete hashing parameters for PSI: maximum simple-hashing bin sizes for \\( n \\) items in \\( n \\) bins "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","s":"gs19-threshold-psi-from-additive","title":"Threshold PSI from additive HE via cardinality testing","key":"GS19","y":2019,"sub":"Against passive adversaries, two-party threshold PSI is realized with communication \\( \\tilde O(t^2) \\) in the plain model from IND-CPA additively homomorphic encryption and OLE: a private intersection cardinality test e"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","s":"gs19-two-party-threshold-psi","title":"Two-party threshold PSI with \\( O(t \\log p) \\) communication from fully homomorphic encryption, almost matching the \\( \\Omega(t) \\) bound","key":"GS19","y":2019,"sub":"Against passive adversaries, two parties can run threshold PSI with communication \\( O(t \\log p) \\) bits for set elements in \\( \\mathbb{F}_p \\), that is \\( \\tilde O(t) \\) independent of the set size \\( n \\): Alice sends "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-GS-LOWER-BOUND","s":"gs19-omega-t-communication-lower","title":"\\( \\Omega(t) \\) communication lower bound for threshold PSI","key":"GS19","y":2019,"sub":"Any two-party protocol that outputs the intersection of two sets whenever their symmetric difference is at most \\( t \\) must communicate \\( \\Omega(t) \\) bits, unconditionally: a protocol with \\( o(t) \\) communication, ru"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","s":"krssw19-correlated-ot-precomputation","title":"Correlated-OT precomputation that halves the online OT communication of precomputed garbled-circuit and Naor-Reingold OPRF evaluation in unbalanced PSI","key":"KRSSW19","y":2019,"sub":"In unbalanced PSI whose client-side OPRF evaluations rely on OTs precomputed in an input-independent base phase, the online OT messages can come from correlated OTs: in garbled-circuit OPRF evaluation the garbler builds "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","s":"krssw19-smaller-transfer-of-the","title":"Smaller transfer of the server set in precomputed unbalanced PSI: compressed cuckoo filters, 4.3x smaller updates, and false-positive rates near \\( 2^{-29} \\)","key":"KRSSW19","y":2019,"sub":"In unbalanced PSI where the server sends its set once as a cuckoo filter of PRF values, transmitting an occupancy bit per entry plus the nonempty tags, or the number of tags per bucket in \\( \\log_2(b + 1) \\) bits, \\( b \\"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","s":"krssw19-lowmc-instead-of-aes","title":"LowMC instead of AES-128 as the PRF of the garbled-circuit OPRF in unbalanced PSI: 8.2x fewer AND gates per client item","key":"KRSSW19","y":2019,"sub":"Instantiating the PRF evaluated by garbled circuits in GC-PSI with the LowMC instance of block and key size 128, one S-box per round, data complexity \\( 2^{64} \\), and 208 rounds gives 624 AND gates per client item, agai"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION","s":"krssw19-native-smartphone-implementa","title":"Native smartphone implementation of precomputed unbalanced PSI with malicious-client security: 1024 contacts against \\( 2^{28} \\) users in about 3 s","key":"KRSSW19","y":2019,"sub":"C/C++ implementations of precomputed LowMC-GC-PSI and ECC-NR-PSI for Android, using ARMv8 Cryptography Extensions for fixed-key AES garbling, the P-256 curve for the Naor-Reingold PRF, and an ARMv8 port of libOTe with Ch"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","s":"psty19-batched-opprf-with-one","title":"Batched OPPRF with one polynomial hint","key":"PSTY19","y":2019,"sub":"A one-time programmable PRF publishes as hint the polynomial interpolated through the points \\( (x, F'_k(x) \\oplus v) \\) for each programmed input x with target \\( v \\), so that a single evaluation returns \\( v \\) on pro"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","s":"psty19-linear-communication-circuit","title":"Linear-communication circuit-PSI","key":"PSTY19","y":2019,"sub":"Against semi-honest parties with \\( n \\) items each, letting the sender program a batched OPPRF so that all of its items in a cuckoo bin map to one random target lets the circuit test a single equality per bin; handling "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2019-PSTY-PAYLOAD","s":"psty19-payloads-of-both-parties","title":"Payloads of both parties in OPPRF-based circuit-PSI through a second batched OPPRF, at the asymptotic cost of the basic protocol","key":"PSTY19","y":2019,"sub":"In OPPRF-based circuit-PSI, where the sender maps several items with different payloads to one bin, a second batched OPPRF in which the sender programs each item y of bin j to the target \\( \\widetilde{t}_j \\oplus V(y) \\)"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","s":"ikn20-deployed-diffie-hellman-inte","title":"Deployed Diffie-Hellman intersection-sum with cardinality","key":"IKN+20","y":2020,"sub":"In the private intersection-sum-with-cardinality functionality, P1 holds identifiers, P2 holds identifier-value pairs, both learn the intersection size, and P2 also learns the sum of values over the intersection; a three"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","s":"ikn20-private-intersection-sum-wit","title":"Private intersection-sum with cardinality from batched random OT with shuffled, re-masked OPRF outputs, semi-honest","key":"IKN+20","y":2020,"sub":"Against semi-honest parties, private intersection-sum with cardinality can be computed from batched random OT: P1 cuckoo-hashes its identifiers and obtains one OPRF value per bin and stash slot, encrypts these values und"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","s":"prty20-garbled-cuckoo-table-a","title":"Garbled cuckoo table: a PaXoS of size \\( (2 + \\varepsilon)n + d + \\lambda \\) with \\( O(n\\lambda) \\) encoding and \\( O(\\lambda) \\)-position decoding, hash functions independent of the keys","key":"PRTY20","y":2020,"sub":"Two hash functions map each key to an edge of a cuckoo graph on the m main positions L, and a random vector r(x) selects positions among \\( d + \\lambda \\) extra positions R. The encoder solves the constraints of the edge"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","s":"prty20-malicious-psi-with-linear","title":"Malicious PSI with linear communication","key":"PRTY20","y":2020,"sub":"The receiver encodes the pairs \\( (y, H_1(y)) \\) for its set into a PaXoS D and uses the strings of D as its choice inputs to the OOS 1-out-of-N OT extension. Because the code C is linear and PaXoS decoding is XOR-homomo"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2020-PRTY-PAXOS","s":"prty20-paxos-key-value-encoding","title":"PaXoS key-value encoding","key":"PRTY20","y":2020,"sub":"An \\( (n, m, 2^{-\\lambda}) \\)-PaXoS is a randomized map v from strings to m-bit vectors such that, for any \\( n \\) distinct inputs, the vectors are linearly independent except with probability \\( 2^{-\\lambda} \\) over the"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","s":"prty20-bound-on-the-number","title":"Bound on the number of random-oracle values a malicious receiver can encode in a PaXoS of m strings, by an incompressibility argument","key":"PRTY20","y":2020,"sub":"If an adversary makes \\( Q \\) queries to a random oracle H1 with \\( \\ell_1 \\)-bit outputs and then outputs a PaXoS D of m strings, the probability that \\( \\mathrm{Decode}(D, y) = H_1(y) \\) holds for at least \\( n' \\) of "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","s":"bmrr21-two-multiparty-threshold-psi","title":"Two multiparty threshold PSI functionalities: release when every party's set is close to the intersection, or when the union is close to it","key":"BMRR21","y":2021,"sub":"For \\( \\ell \\) parties each holding \\( n \\) elements with intersection I, \\( F_{\\text{TPSI-int}} \\) releases I to every party if and only if \\( |S_i \\setminus I| \\le t \\) for all i, equivalently \\( |I| \\ge n - t \\), and "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-BMRR-LOWER-BOUND","s":"bmrr21-omega-nt-lower-bound","title":"\\( \\Omega(nT) \\) lower bound for multiparty threshold PSI","key":"BMRR21","y":2021,"sub":"In any multiparty threshold PSI protocol for \\( F_{\\text{TPSI-int}} \\) or \\( F_{\\text{TPSI-diff}} \\) secure against a semi-honest adversary corrupting up to \\( \\ell - 1 \\) of \\( \\ell \\) parties, every party sends and rec"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","s":"bmrr21-tilde-o-nt-threshold","title":"\\( \\tilde O(nT) \\) threshold PSI from threshold additive HE","key":"BMRR21","y":2021,"sub":"Assuming \\( \\ell \\)-out-of-\\( \\ell \\) threshold additively homomorphic encryption with distributed setup, \\( F_{\\text{TPSI-diff}} \\) is securely realized against a semi-honest adversary corrupting up to \\( \\ell - 1 \\) pa"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","s":"bmrr21-multiparty-threshold-psi-wit","title":"Multiparty threshold PSI with \\( O(\\ell t) \\) communication and \\( O(1) \\) rounds from threshold FHE, matching the \\( \\Omega(\\ell t) \\) bound, semi-honest","key":"BMRR21","y":2021,"sub":"Assuming \\( \\ell \\)-out-of-\\( \\ell \\) threshold FHE with distributed setup, both \\( F_{\\text{TPSI-int}} \\) and \\( F_{\\text{TPSI-diff}} \\) are securely realized against a semi-honest adversary corrupting up to \\( \\ell - 1"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","s":"cmg21-online-communication-nearly","title":"Online communication nearly constant in the larger set for FHE-based unbalanced PSI, from depth-free Frobenius powers","key":"CMG+21","y":2021,"sub":"Since the Frobenius automorphism maps an encryption of y to an encryption of \\( y^{p^i} \\) without consuming a multiplicative level, the sender can compute all powers \\( y, y^2, \\ldots, y^{e_D} \\) within depth D from the"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","s":"cmg21-o-sqrt-b-multiplications","title":"\\( O(\\sqrt{B}) \\) multiplications per sender bin","key":"CMG+21","y":2021,"sub":"In FHE-based unbalanced PSI, the sender can evaluate each bin's intersection polynomial of degree \\( B = LH - 1 \\) on the receiver's encrypted item by computing the low powers \\( y^2, \\ldots, y^{L-1} \\) and the high powe"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","s":"cmg21-fewer-encrypted-query-powers","title":"Fewer encrypted query powers at a fixed multiplicative depth in FHE-based unbalanced PSI, from extremal postage-stamp bases instead of windowing","key":"CMG+21","y":2021,"sub":"If the receiver sends encryptions of \\( y^{a_1}, \\ldots, y^{a_k} \\) for an extremal postage-stamp basis \\( \\{a_1 = 1 < \\cdots < a_k\\} \\), in which every integer up to \\( r \\) is a sum of at most \\( h \\) basis elements, t"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","s":"cmg21-arbitrary-length-items-and","title":"Arbitrary-length items and labels in FHE-based unbalanced PSI over prime-field SIMD slots, enabled by mandatory OPRF hashing","key":"CMG+21","y":2021,"sub":"If the OPRF step is always applied, each hashed item can be split across several consecutive prime-field SIMD slots, with the intersection polynomial evaluated on each part independently, instead of occupying one extensi"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-GPRTY-3H-GCT","s":"gprty21-three-hash-garbled-cuckoo","title":"Three-hash garbled cuckoo table: binary OKVS with about \\( 1.3n \\) main positions instead of the \\( 2.4n \\) of PaXoS, by peeling a random 3-hypergraph","key":"GPRTY21","y":2021,"sub":"Each key is mapped to a hyperedge of three distinct positions in a table L and to a random vector r(k) over \\( d + \\lambda \\) extra positions R, with \\( d = d(n) \\). Encoding peels the hypergraph, solves the constraints "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","s":"gprty21-okvs-correctness-amplificati","title":"OKVS correctness amplification: replication and star architectures turn \\( \\varepsilon \\), the empirically validated failure probability, into about \\( \\varepsilon^2 \\), or \\( O(\\varepsilon^d) \\) for \\( d \\) the replication factor of the central OKVS, at nearly the same size","key":"GPRTY21","y":2021,"sub":"From an OKVS that fails with probability \\( \\varepsilon \\), replication with \\( c \\) copies fails with probability \\( \\varepsilon^c \\) at \\( c \\) times the size. The star architecture hashes keys into \\( b \\) leaf OKVS a"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","s":"gprty21-malicious-two-party-psi","title":"Malicious two-party PSI from any linear OKVS and vector OLE, generalizing PaXoS-PSI and removing its error-correcting code","key":"GPRTY21","y":2021,"sub":"The OOS correlation \\( r_i = q_i \\oplus C(d_i) \\wedge s \\) of PaXoS-PSI is replaced by the vector-OLE correlation \\( q_i = r_i \\oplus d_i \\cdot s \\) over \\( \\mathrm{GF}(2^{\\ell_1}) \\). The receiver's vOLE input is a line"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","s":"gprty21-malicious-multiparty-psi-fro-2","title":"Malicious multiparty PSI from OPRF and OKVS","key":"GPRTY21","y":2021,"sub":"A central party P0 runs a malicious-secure two-party OPRF with every other party, and each party \\( P_i \\) sends P0 an OKVS mapping each of its items h to \\( H(\\mathrm{PRF}_i(h), h) + sh_i(h) \\), where the \\( sh_i \\) are"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-GPRTY-OKVS","s":"gprty21-oblivious-key-value-store","title":"Oblivious key-value store","key":"GPRTY21","y":2021,"sub":"A key-value store is a pair of algorithms (Encode, Decode) such that \\( \\mathrm{Decode}(S, k) = v \\) for every pair (k, v) used to create S, where Encode may fail with small probability depending only on the keys. It is "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION","s":"nty21-malicious-multiparty-psi-wit","title":"Malicious multiparty PSI with at most one corrupted party from symmetric-key primitives only, by reducing \\( \\ell \\)-party PSI to server-aided two-party PSI over OKVS encodings","key":"NTY21","y":2021,"sub":"Against a malicious adversary corrupting at most one of \\( \\ell \\) parties, P1 sends PRF keys \\( k_i \\) to parties \\( P_2, \\ldots, P_{\\ell-2} \\) and sends \\( P_\\ell \\) an OKVS mapping each of its items to the XOR of the "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","s":"nty21-malicious-multiparty-psi-cal","title":"Malicious multiparty PSI calibrated to t","key":"NTY21","y":2021,"sub":"For \\( \\ell \\) parties with \\( n \\) items each and at most \\( t_c < \\ell \\) corrupted and colluding, the parties split into \\( \\ell - t_c - 1 \\) clients, one pivot, and \\( t_c \\) servers. Each client sends a PRF key to e"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","s":"rs21-circuit-psi-from-vole","title":"Circuit-PSI from VOLE-based OPPRF","key":"RS21","y":2021,"sub":"An OPPRF is obtained from any OPRF by having the sender encode the corrections \\( z_i - F_k(y_i) \\) with XoPaXoS, a PaXoS variant whose output is uniformly distributed when the encoded values are uniform. In the circuit-"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","s":"rs21-malicious-oprf-to-psi","title":"Malicious OPRF-to-PSI transformation with \\( \\kappa \\)-bit instead of \\( 2\\kappa \\)-bit sender messages, by extracting only non-colliding OPRF queries","key":"RS21","y":2021,"sub":"In the transformation where the receiver learns F(x) for its set from a batched OPRF and the sender sends {F(y)} for its set, a simulator for a malicious sender that extracts only those queried y whose output collides wi"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-RS-VOLE-OPRF","s":"rs21-batched-oprf-from-vector","title":"Batched OPRF from vector OLE","key":"RS21","y":2021,"sub":"The receiver solves for P with \\( \\langle \\mathrm{row}(x), P \\rangle = H_F(x) \\) for every x in its set using a PaXoS solver, and sends \\( A = P + A' \\), where the receiver's \\( (A', C) \\) and the sender's \\( (\\Delta, B)"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","s":"rt21-key-agreement-to-malicious","title":"Key agreement to malicious PSI","key":"RT21","y":2021,"sub":"The sender sends one key-agreement message m; for each item \\( y_i \\) the receiver computes a fresh response \\( m'_i \\) and sends the polynomial P with \\( P(H_1(y_i)) = \\Pi^{-1}(m'_i) \\); the sender computes \\( k_i = \\ma"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","s":"rt21-semi-honest-diffie-hellman","title":"Semi-honest Diffie-Hellman PSI communication of one key-agreement message, one field element per receiver item, and one short key per sender item, from polynomial-encoded key-agreement responses","key":"RT21","y":2021,"sub":"Dropping the random oracles used only for extraction, the receiver interpolates P with \\( \\Pi(P(y_i)) = m'_i \\) and the sender returns its keys shortened to \\( \\lambda + 2 \\log n \\) bits (variant 1), which is secure agai"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","s":"rr22-subfield-vole-psi","title":"Subfield-VOLE PSI","key":"RR22","y":2022,"sub":"In semi-honest VOLE-based PSI, a subfield VOLE \\( C = A\\Delta + B \\), with \\( A \\) over a small base field \\( \\mathbb{B} \\) and \\( \\Delta, B, C \\) over an extension \\( \\mathbb{F} \\) of size at least \\( 2^{\\kappa} \\), let"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","s":"rr22-triangulation-okvs","title":"Triangulation OKVS","key":"RR22","y":2022,"sub":"Each key's row has \\( w \\) ones among \\( m' = en \\) sparse positions plus a short dense part, either random bits or powers of a hashed element of a large field. The encoder permutes rows and columns into approximately lo"},{"t":"psi","k":"result","id":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","s":"gs23-multiparty-threshold-psi-wit","title":"Multiparty threshold PSI with communication quasilinear in \\( t \\), \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\) bits, from oblivious transfer or additively homomorphic encryption, passive security","key":"GS23","y":2023,"sub":"Assuming oblivious transfer or additively homomorphic encryption, there is a passively secure protocol for \\( \\ell \\) parties holding sets of \\( n \\) elements that outputs the intersection if it has at least \\( n - t \\) "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2023-GS-PICT-COMPILER","s":"gs23-bucketing-compiler-for-cardi","title":"Bucketing compiler for cardinality tests","key":"GS23","y":2023,"sub":"Against a static passive adversary corrupting all but one of \\( \\ell \\) parties, any private intersection cardinality test (PICT) with secret-shared output and communication \\( O(\\kappa\\ell \\,\\mathrm{poly}(t)) \\) yields "},{"t":"psi","k":"result","id":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON","s":"vce24-operation-counts-for-semi","title":"Operation counts for semi-honest multiparty PSI","key":"VCE24","y":2024,"sub":"For semi-honest multiparty PSI protocols that resist \\( t_c \\) colluding parties and give the output to a leader, the latest homomorphic-encryption-based protocols are instantiated with elliptic-curve ElGamal and costed "},{"t":"psi","k":"assumption","id":"ASM-DCR","s":"dcr","title":"Decisional composite residuosity (DCR)","key":null,"y":null,"sub":"Let \\( N = pq \\) be an RSA modulus."},{"t":"psi","k":"assumption","id":"ASM-DDH","s":"ddh","title":"Decisional Diffie-Hellman (DDH)","key":null,"y":null,"sub":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\)."},{"t":"psi","k":"assumption","id":"ASM-LWE","s":"lwe","title":"Learning with errors (LWE)","key":null,"y":null,"sub":"Fix a dimension \\( n \\), a modulus \\( q \\), a number of samples \\( m \\), and an error distribution \\( \\chi \\) over \\( \\mathbb{Z} \\), typically a discrete Gaussian of width \\( \\alpha q \\) with \\( \\alpha q > 2\\sqrt{n} \\)."},{"t":"psi","k":"assumption","id":"ASM-PRF","s":"prf","title":"Pseudorandom functions (PRF)","key":null,"y":null,"sub":"A keyed function family \\( F : \\{0,1\\}^{\\lambda} \\times \\{0,1\\}^{n} \\to \\{0,1\\}^{m} \\) is a pseudorandom function if, for a uniformly random key \\( k \\), no probabilistic polynomial-time adversary with oracle access to \\"},{"t":"psi","k":"assumption","id":"ASM-PRG","s":"prg","title":"Pseudorandom generators (PRG)","key":null,"y":null,"sub":"A deterministic polynomial-time function \\( G : \\{0,1\\}^{\\lambda} \\to \\{0,1\\}^{\\ell(\\lambda)} \\) with \\( \\ell(\\lambda) > \\lambda \\) is a pseudorandom generator if, for a uniformly random seed \\( s \\), no probabilistic po"},{"t":"psi","k":"assumption","id":"ASM-RLWE","s":"rlwe","title":"Ring learning with errors (Ring-LWE)","key":null,"y":null,"sub":"Let \\( K \\) be a number field of degree \\( n \\) with ring of integers \\( R \\) (the standard choice is the power-of-two cyclotomic ring \\( R = \\mathbb{Z}[x]/(x^n + 1) \\)), let \\( q \\) be a modulus and \\( R_q = R / qR \\)."},{"t":"psi","k":"assumption","id":"ASM-ROM","s":"rom","title":"Random oracle model (ROM)","key":null,"y":null,"sub":"A proof in the random oracle model gives every party, honest or adversarial, oracle access to a uniformly random function \\( H : \\{0,1\\}^* \\to \\{0,1\\}^{\\ell} \\) (or to a random function into a group or another range)."}]