Helger Lipmaa
LightNews LightNews
banner
helger.bsky.social
Helger Lipmaa
@helger.bsky.social
550 followers 260 following 170 posts
Cryptography professor at the University of Tartu, Estonia. Zero-Knowledge. SNARKs.
Posts Replies Media Videos
Reposted by Helger Lipmaa
krijn.isogeni.es
New year, new pairing
January 3, 2026 at 12:23 PM
Reposted by Helger Lipmaa
giacomofenzi.bsky.social
Super exciting work from Ziyi and Eylon! They construct the first SNARG for NP in the *plain* model (no random oracle) using *only* (subexponential) LWE!
Perhaps most surprisingly, the SNARG is one (very clever) instantiation of the classical Killian-Micali construction!
eprint.ing.bot ePrint Updates @eprint.ing.bot · 7d
SNARGs for NP from LWE (Eylon Yogev, Ziyi Guan) ia.cr/2025/2328
Abstract. We construct the first succinct non-interactive argument (SNARG) for NP in the common reference string model based on the sub-exponential hardness of the learning with errors (LWE) assumption. As a result, our construction is plausibly post-quantum secure. Previous constructions of SNARGs from falsifiable assumptions either relied on indistinguishability obfuscation or were restricted to idealized models (e.g., the random oracle model or generic group model). Our construction is also the first to instantiate the Micali transformation (Fiat–Shamir applied to Kilian’s protocol) in the standard model with concrete hash functions. We achieve this by developing a new mechanism to securely instantiate the Fiat–Shamir hash function for interactive arguments, overcoming the known barriers that limit standard techniques to interactive proofs. Our construction relies on two primitives of independent interest: a PCP with a new property we term “shadow soundness” and a lattice-based vector commitment that provides statistical binding with respect to a hidden function. While our scheme has non-adaptive security and achieves only partial succinctness with argument size O(n^(0.91)), it serves as a foundational proof of concept that SNARGs can be based solely on standard lattice assumptions. Furthermore, our result refutes “universal” attacks on the Micali framework by demonstrating that there exist concrete instantiations of the underlying components for which the transformation is sound. Image showing part 2 of abstract.
December 29, 2025 at 1:38 PM
Reposted by Helger Lipmaa
quantamagazine.bsky.social
It was a big year for mathematics. youtu.be/hRpcWpAeWng
The Biggest Breakthroughs in Mathematics: 2025
YouTube video by Quanta Magazine
youtu.be
December 18, 2025 at 8:18 PM
Reposted by Helger Lipmaa
smartcryptology.bsky.social
Your quarterly reminder to submit a paper to Communications in Cryptology...

cic.iacr.org

It is Diamond Open Access (readers and authors do not pay) and it contains all your new cool cryptographic research.

Next deadline for submission is Feb 2nd.
IACR Communications in Cryptology
cic.iacr.org
December 19, 2025 at 8:02 AM
Reposted by Helger Lipmaa
quantamagazine.bsky.social
If you swap each letter in “bomb” with the next letter in the alphabet, you’ll get “cpnc.” Recently, scientists showed that and other methods can bypass filters on LLMs like Gemini, DeepSeek and Grok. @peterha2l.bsky.social reports: www.quantamagazine.org/cryptographe...
Cryptographers Show That AI Protections Will Always Have Holes | Quanta Magazine
Large language models such as ChatGPT come with filters to keep certain info from getting out. A new mathematical argument shows that systems like this can never be completely safe.
www.quantamagazine.org
December 10, 2025 at 3:42 PM
Reposted by Helger Lipmaa
eprint.ing.bot
SVP_(p) is Deterministically NP-Hard for all p > 2, Even to Approximate Within a Factor of 2^(log^(1 − ε)n) (Isaac M Hair, Amit Sahai) ia.cr/2025/2181
Abstract. We prove that SVP_(p) is NP-hard to approximate within a factor of 2^(log^(1 − ε)n), for all constants ε > 0 and p > 2, under standard deterministic Karp reductions. This result is also the first proof that SVP_(p) is NP-hard in a finite ℓ_(p) norm. Hardness for SVP_(p) with p finite was previously only known if NP ⊈ RP, and under that assumption, hardness of approximation was only known for all constant factors. As a corollary to our main theorem, we show that under the Sliding Scale Conjecture, SVP_(p) is NP-hard to approximate within a small polynomial factor, for all constants p > 2. Our proof techniques are surprisingly elementary; we reduce from a regularized PCP instance directly to the shortest vector problem by using simple gadgets related to Vandermonde matrices and Hadamard matrices.
December 2, 2025 at 10:58 PM
Reposted by Helger Lipmaa
eprint.ing.bot
Small-field hash-based SNARGs are less sound than conjectured (Giacomo Fenzi, Antonio Sanso) ia.cr/2025/2197
Abstract. Hash-based succinct non-interactive arguments (SNARGs) are a widely studied and deployed class of proof systems. The security of practical hash-based SNARGs relies on two combinatorial parameters of its underlying linear code 𝒞: a distance-preservation error ε(𝒞, δ) and the list size |Λ(𝒞, δ)| (both parametrized by a proximity parameter δ). Optimistically, one might hope that these parameters are bounded all the way to the capacity regime: when the proximity parameter δ approaches the minimum distance of the code δ(𝒞). Perhaps too optimistically, several deployed hash-based SNARGs indeed operate in this regime, and initiatives such as the Ethereum Proximity Prize investigate to which extent soundness is preserved in this setting. We present a minimal toy protocol whose analysis captures most of the complexity of state-of-the-art hash-based SNARGs, and present a generic attack whose success probability depends on the list size |Λ(𝒞, δ)|. Further, we investigate the common settings when the code 𝒞 is an extension code over a field 𝔽 of a base code 𝒞_(𝔹) over a small base field 𝔹. In this setting, we show that classical combinatorial lower bounds on the list-size of the code yields strong attacks that affect the regimes in which hash-based SNARGs operate in practice. Image showing part 2 of abstract.
December 5, 2025 at 11:03 AM
Reposted by Helger Lipmaa
mccurley.bsky.social
I've been going over the responses to the survey from IACR members about publishing and conferences, and I keep coming back to the fact that I think there should be _fewer_ conferences and _more_ journals. This coupling of talks to papers is not healthy.
December 5, 2025 at 10:04 PM
helger.bsky.social
(By ... an exstudent, Shuto)
eprint.ing.bot ePrint Updates @eprint.ing.bot · Nov 21
SALSAA – Sumcheck-Aided Lattice-based Succinct Arguments and Applications (Shuto Kuriyama, Russell W. F. Lai, Michał Osadnik, Lorenzo Tucci) ia.cr/2025/2124
Abstract. We present SALSAA, a more efficient and more versatile extension of the state-of-the-art lattice-based fully-succinct argument frameworks, “RoK, paper, SISsors (RPS)’’ and”RoK and Roll (RnR)’’ [Klooß, Lai, Nguyen, and Osadnik; ASIACRYPT’24, ’25], integrating the sumcheck technique as a main component. This integration enables us to design an efficient norm-check protocol (controlling the norm during witness extraction) with a strictly linear-time prover while reducing proof sizes by 2-3× compared to the previous quasi-linear-time norm-check in RPS/RnR, eliminating a central performance bottleneck. The sumcheck integration also allows us to natively support a wider class of relations, including rank-1 constraint systems (R1CS), which are widely used to express real-world computations. To demonstrate the versatility and efficiency of our framework, we showcase three impactful applications achieved by different RoKs (Reductions of Knowledge) compositions: (i) a lattice-based succinct argument of knowledge with a linear-time prover, achieving a verifier time of 41 ms, prover runtime of 10.61 s, and proof size of 979 KB for a witness of 2²⁸ ℤ_(q) elements; (ii) a polynomial commitment scheme with matching performance; and (iii) the first lattice-based folding scheme natively operating on ℓ₂-norm-bounded witnesses, achieving highly efficient verification in 2.28 ms and producing a proof of just 73 KB for a witness of 2²⁸ Z_(q) elements, outperforming prior works for the family of linear relations. We provide a modular, concretely efficient Rust implementation of our framework, benchmarked over cyclotomic rings with AVX-512-accelerated NTT-based arithmetic, demonstrating the practical efficiency of our approach. Image showing part 2 of abstract.
November 22, 2025 at 9:49 PM
helger.bsky.social
Look, ma, we are in the News www.nytimes.com/2025/11/21/w...
Cryptographers Held an Election. They Can’t Decrypt the Results.
www.nytimes.com
November 22, 2025 at 2:51 AM
helger.bsky.social
by ex-student (Hamid)
eprint.ing.bot ePrint Updates @eprint.ing.bot · Nov 21
Revisiting Simulation Extractability in the Updatable Setting (Hamidreza Khoshakhlagh) ia.cr/2025/2117
Abstract. We revisit the notion of Simulation Extractability (SE) for SNARKs in the updatable setting. We demonstrate that existing formal definitions of SE in this setting are insufficient to guarantee the required non-malleability in real-world scenarios. Towards this, we first identify and frame a malleability vulnerability: a cross-SRS reinterpretation attack, which shows that an adversary can reuse or maul proofs across different, correlated SRSs generated through the update procedure. This is made possible because existing security definitions fail to model an adversary’s ability to observe simulated proofs relative to various derived SRSs. To close this security gap, we propose a revised and stronger security notion of Updatable Simulation Extractability (USE) which was originally defined in [GKK+22]. Our definition models a dynamic environment where the SRS is adaptively updatable by the adversary, who can also query simulation oracles for proofs under the resulting family of reachable SRSs. This captures the full extent of the adversarial capabilities observed in practice. Finally, we provide positive results for popular polynomial-IOP-based SNARKs, and show that these schemes satisfy our stronger USE notion, provided the circuit-specific SRS is securely bound into the proof transcript, e.g., via a correct implementation of the Fiat-Shamir transformation. Image showing part 2 of abstract.
November 21, 2025 at 3:47 PM
Reposted by Helger Lipmaa
mccurley.bsky.social
While I can understand how some reviewers in cryptography research are frustrated with the process, I cannot imagine how bad it is in machine learning. ncfrey.substack.com/p/publishing...
Publishing and communicating research in AI/ML is fundamentally broken
Why researchers should care, and four proposals for how to fix it
ncfrey.substack.com
November 15, 2025 at 8:30 AM
Reposted by Helger Lipmaa
meredithmeredith.bsky.social
📣 Germany's close to reversing its opposition to mass surveillance & private message scanning, & backing the Chat Control bill. This could end private comms-& Signal-in the EU.

Time's short and they're counting on obscurity: please let German politicians know how horrifying their reversal would be.
signal.org Signal @signal.org · Oct 3
We are alarmed by reports that Germany is on the verge of a catastrophic about-face, reversing its longstanding and principled opposition to the EU’s Chat Control proposal which, if passed, could spell the end of the right to privacy in Europe. signal.org/blog/pdfs/ge...
signal.org
October 6, 2025 at 6:46 AM
Reposted by Helger Lipmaa
eprint.ing.bot
TensorSwitch: Nearly Optimal Polynomial Commitments from Tensor Codes (Benedikt Bünz, Giacomo Fenzi, Ron D. Rothblum, William Wang) ia.cr/2025/2065
Abstract. A polynomial commitment scheme (PCS) enables a prover to succinctly commit to a large polynomial and later generate evaluation proofs that can be efficiently verified. In recent years, PCSs have emerged as a central focus of succinct non-interactive argument (SNARG) design. We present TensorSwitch, a hash-based PCS for multilinear polynomials that improves the state-of-the-art in two fundamental bottlenecks: prover time and proof size. We frame our results as an interactive oracle PCS, which can be compiled into a cryptographic PCS using standard techniques. The protocol uses any linear code with rate ρ, list-decoding and correlated agreement up to δ, and encoding time τ ⋅ ℓ, where ℓ is the block length. For a size n polynomial, security parameter λ, and sufficiently large field, it has the following efficiency measures, up to lower order terms: - Commitment time: (τ/ρ² + τ/ρ + 3) ⋅ n field multiplications. - Opening time: 6n field multiplications. - Query complexity: $\frac{1}{-\log(1-\delta^{2})} \cdot \lambda$. - Verification time: O(λlog n). Moreover, the evaluation proof only contains O(log log n) oracles of total size (λn)^(0.5 + o(1)). With a Reed-Solomon code of rate 1/2, the query complexity is 2.41λ and commitment time is dominated by (6log n + 3) ⋅ n field multiplications. With an RAA code of rate 1/4 and distance 0.19, the query complexity is 19λ and the commitment time is 42n field additions and 3n field multiplications. For both instantiations, the opening time is dominated by 6n field multiplications. Image showing part 2 of abstract.
November 13, 2025 at 12:09 AM
helger.bsky.social
We are looking for a cybersecurity professor to strengthen Estonia's existing expertise. We are looking for an ambitious researcher (with a steady presence at big four security conferences) with demonstrated leadership skills who can build a larger team. iacr.org/jobs/item/4075
Professor of Cybersecurity
iacr.org
November 3, 2025 at 10:24 AM
helger.bsky.social
(accepted to TCC)
eprint.ing.bot ePrint Updates @eprint.ing.bot · Sep 26
Plonk is Simulation Extractable in ROM Under Falsifiable Assumptions (Helger Lipmaa) ia.cr/2025/1759
Abstract. Solving a long-standing open problem, Faonio, Fiore, and Russo proved that the widely used Plonk zk-SNARK is simulation extractable. However, their proof assumes both the random oracle model (ROM) and the algebraic group model. We prove that the same holds in the ROM under falsifiable assumptions. We combine the template of Faust et al., who proved that simulation extractability follows from knowledge soundness, (weak) unique response, and trapdoorless zero-knowledge, with the recent result of Lipmaa, Parisella, and Siim (Crypto 2025), who proved that Plonk has knowledge soundness in the ROM under falsifiable assumptions. For this, we prove that Plonk satisfies new variants of the weak unique response and trapdoorless zero-knowledge properties. We prove that several commonly used gadgets, like the linearization trick, are not trapdoorless zero-knowledge when considered as independent commit-and-prove zk-SNARKs.
September 26, 2025 at 2:44 AM
Reposted by Helger Lipmaa
cosic.bsky.social
Europe is testing a digital age verification app to protect minors online. Bart Preneel warns it risks privacy, can be bypassed, and may exclude users. Could this be the end of online anonymity?
www.standaard.be/media-en-cul...
#ageverification #anonyimity #privacy
Europa test leeftijdscontroles op het internet: is dit het einde van online anonimiteit?
Europa test een app waarmee we ons in de toekomst moeten aanmelden op het internet, om te bewijzen dat we meerderjarig zijn. Critici waarschuwen dat het systeem makkelijk te omzeilen is en ongewenste neveneffecten zal hebben, onder meer voor onze privacy.
www.standaard.be
September 24, 2025 at 8:59 AM
Reposted by Helger Lipmaa
eprint.ing.bot
The Syndrome-Space Lens: A Complete Resolution of Proximity Gaps for Reed-Solomon Codes (Russell Okamoto) ia.cr/2025/1712
Abstract. We resolve the Correlated Agreement (CA) problem for Reed-Solomon codes up to the information-theoretic capacity limit by introducing a fundamental change of basis: from the traditional evaluation domain to the syndrome space. Viewed through this “Syndrome-Space Lens,” the problem of proximity testing transforms into a transparent question of linear-algebraic geometry: a single affine line of syndromes traversing a family of low-dimensional subspaces. This new perspective makes a sharp phase transition at the capacity boundary visible, allowing for a complete characterization of the problem’s behavior across all parameter regimes, yielding short, self-contained proofs. Classification. We establish a precise trichotomy organized by the rank margin Δ := t − d. At the capacity boundary (Δ = 0), the CA premise is information-theoretically vacuous, and we prove that no rigidity can be concluded without imposing additional structure. One step beyond capacity (Δ = 1), the problem enters a “knife-edge” regime where unconditional rigidity does not hold; soundness is recovered either through a combinatorial witness (such as a repeated error support or a small union of supports) or by adding protocol-level structure (such as independent two-fold MCA checks, DEEP/STIR out-of-domain sampling, or a global error locator). For stricter gaps (Δ ≥ 2), unconditional rigidity holds under a simple algebraic condition ((r + 1)k < m + 1), with explicit quantitative bounds. MCA and Practical Implications. Below capacity (δ < 1 − ρ), the strengthened mutual correlated agreement (MCA) problem reduces to ordinary correlated agreement. MCA holds under the same hypotheses as CA. When folds are generated with independent challenges (e.g., via domain-separated Fiat-Shamir), the per-round security margins add. The model-scoped soundness law is Pr [FA] ≤ q^(−(∑Δ_(i))s), providing a clear and complete rulebook for selecting safe and efficient parameters in FRI/STARK systems. This work bypasses the complex machinery of list-decoding algorithms entirely and resolves the long-standing open problem concerning the gap between the Johnson bound and capacity. Image showing part 2 of abstract. Image showing part 3 of abstract.
September 21, 2025 at 12:28 AM
Reposted by Helger Lipmaa
durumcrustulum.com
not again

arxiv.org/pdf/2509.12341
September 17, 2025 at 10:03 PM
Reposted by Helger Lipmaa
eprint.ing.bot
RoK and Roll – Verifier-Efficient Random Projection for Õ(λ)-size Lattice Arguments (Michael Klooß, Russell W. F. Lai, Ngoc Khanh Nguyen, Michał Osadnik) ia.cr/2025/1220
Abstract. Succinct non-interactive arguments of knowledge (SNARKs) based on lattice assumptions offer a promising post-quantum alternative to pairing-based systems, but have until now suffered from inherently quadratic proof sizes in the security parameter. We introduce RoK and Roll, the first lattice-based SNARK that breaks the quadratic barrier, achieving communication complexity of Õ(λ) together with a succinct verification time. The protocol significantly improves upon the state of the art of fully-succinct argument systems established by “RoK, Paper, SISsors” (RPS) [ASIACRYPT’24] and hinges on two key innovations, presented as reductions of knowledge (RoKs): - Structured random projections: We introduce a new technique for structured random projections that allows us to reduce the witness dimensions while approximately preserving its ℓ₂ norm and maintaining the desired tensor structure. In order to maintain succinct communication and verification, the projected image is further committed and adjoined to the original relation. This procedure is recursively repeated until dimension of the intermediate witness becomes poly(λ), i.e. independent of the original witness length. - Unstructured random projection: When the witness is sufficiently small, we let the unstructured projection (over coefficients ℤ_(q)) be sent in plain, as in LaBRADOR [CRYPTO’23]. We observe, however, that the strategy from prior works to immediately lift the projection claim to ℛ_(q), and into our relation, would impose a quadratic communication cost. Instead, we gradually batch-and-lift the projection a the tower of intermediate ring extensions. This reduces the communication cost to Õ(λ) while maintaining a succinct verification time. These two techniques, combined with existing RoKs from RPS, yield a succinct argument system with communication complexity Õ(λ) and succinct verification for structured linear relations. Image showing part 2 of abstract.
July 7, 2025 at 2:34 AM
Reposted by Helger Lipmaa
ccanonne.github.io
Got my first "official AI review" today from AAAI. Amazing! Very detailed, with very specific technical comments. A shame the most crucial and confidently stated ones are deeply incorrect, though.

Well you can't get everything I guess.
September 16, 2025 at 3:56 PM
Reposted by Helger Lipmaa
thejonullman.bsky.social
📢Adam Smith, @gautamkamath.com, and I are putting together a list of job market candidates in Foundations of Responsible Computing! Last year's list was a great success so we're keeping it going!

If you want to be included, or nominate someone, see link in the replies!
September 15, 2025 at 12:41 PM
helger.bsky.social
Estonian-Latvian theory days this October: theorydays2025.quantum.lu.lv
(local groups work in cryptography, type theory, quantum algorithms, complexity theory, automata theory, error-correcting codes and lately also in database theory)
theorydays2025.quantum.lu.lv
September 10, 2025 at 12:00 AM
Reposted by Helger Lipmaa
tomgur.bsky.social
New arXiv preprint: we show algorithmic versions of the polynomial Freiman–Ruzsa (PFR) theorem of Gowers, Green, Manners, and Tao. Interestingly, our proof draws on quantum information and stabilizer learning algorithms, which we dequantize into classical algorithms.

arxiv.org/pdf/2509.02338
September 3, 2025 at 8:48 AM
Reposted by Helger Lipmaa
ec.europa.eu
Double the discovery, double the momentum 🚀

Europe doubles down on research competitiveness with a major boost to #HorizonEurope:

€95.5 billion foreseen for 2021-2027
💰💰💰💰💰💰💰💰💰

€175 billion proposed for 2028-2034
💰💰💰💰💰💰💰💰💰💰💰💰💰💰💰💰💰💰
August 5, 2025 at 6:55 AM