Tianxin Tang
LightNews LightNews
banner
koptxin.bsky.social
Tianxin Tang
@koptxin.bsky.social
32 followers 61 following 11 posts
Cryptography researcher
Lab assistant at Muppets Lab
https://txin.dev
Posts Replies Media Videos
Reposted by Tianxin Tang
fakeiacr.bsky.social
How many cryptographers are does it take to run a successful election?
N+1 where N is the numbers of shareholders needed to decrypt and 1 with backups of the keys "just in case"

#DecryptTencrede
November 21, 2025 at 11:38 PM
Reposted by Tianxin Tang
mirohaller.bsky.social
The call for talks for CAW 2026 (a workshop affiliated with Eurocrypt) is out!

This year's motto is "cryptography under real-world constraints and threat models", but other applied cryptography is also very welcome.

All info is on: caw.cryptanalysis.fun.
November 11, 2025 at 6:38 PM
Reposted by Tianxin Tang
hansonmark.bsky.social
We wrote the Strain on scientific publishing to highlight the problems of time & trust. With a fantastic group of co-authors, we present The Drain of Scientific Publishing:

a 🧵 1/n

Drain: arxiv.org/abs/2511.04820
Strain: direct.mit.edu/qss/article/...
Oligopoly: direct.mit.edu/qss/article/...
A table showing profit margins of major publishers. A snippet of text related to this table is below. 1. The four-fold drain 1.1 Money Currently, academic publishing is dominated by profit-oriented, multinational companies for whom scientific knowledge is a commodity to be sold back to the academic community who created it. The dominant four are Elsevier, Springer Nature, Wiley and Taylor & Francis, which collectively generated over US$7.1 billion in revenue from journal publishing in 2024 alone, and over US$12 billion in profits between 2019 and 2024 (Table 1A). Their profit margins have always been over 30% in the last five years, and for the largest publisher (Elsevier) always over 37%. Against many comparators, across many sectors, scientific publishing is one of the most consistently profitable industries (Table S1). These financial arrangements make a substantial difference to science budgets. In 2024, 46% of Elsevier revenues and 53% of Taylor & Francis revenues were generated in North America, meaning that North American researchers were charged over US$2.27 billion by just two for-profit publishers. The Canadian research councils and the US National Science Foundation were allocated US$9.3 billion in that year. A figure detailing the drain on researcher time. 1. The four-fold drain 1.2 Time The number of papers published each year is growing faster than the scientific workforce, with the number of papers per researcher almost doubling between 1996 and 2022 (Figure 1A). This reflects the fact that publishers’ commercial desire to publish (sell) more material has aligned well with the competitive prestige culture in which publications help secure jobs, grants, promotions, and awards. To the extent that this growth is driven by a pressure for profit, rather than scholarly imperatives, it distorts the way researchers spend their time. The publishing system depends on unpaid reviewer labour, estimated to be over 130 million unpaid hours annually in 2020 alone (9). Researchers have complained about the demands of peer-review for decades, but the scale of the problem is now worse, with editors reporting widespread difficulties recruiting reviewers. The growth in publications involves not only the authors’ time, but that of academic editors and reviewers who are dealing with so many review demands. Even more seriously, the imperative to produce ever more articles reshapes the nature of scientific inquiry. Evidence across multiple fields shows that more papers result in ‘ossification’, not new ideas (10). It may seem paradoxical that more papers can slow progress until one considers how it affects researchers’ time. While rewards remain tied to volume, prestige, and impact of publications, researchers will be nudged away from riskier, local, interdisciplinary, and long-term work. The result is a treadmill of constant activity with limited progress whereas core scholarly practices – such as reading, reflecting and engaging with others’ contributions – is de-prioritized. What looks like productivity often masks intellectual exhaustion built on a demoralizing, narrowing scientific vision. A table of profit margins across industries. The section of text related to this table is below: 1. The four-fold drain 1.1 Money Currently, academic publishing is dominated by profit-oriented, multinational companies for whom scientific knowledge is a commodity to be sold back to the academic community who created it. The dominant four are Elsevier, Springer Nature, Wiley and Taylor & Francis, which collectively generated over US$7.1 billion in revenue from journal publishing in 2024 alone, and over US$12 billion in profits between 2019 and 2024 (Table 1A). Their profit margins have always been over 30% in the last five years, and for the largest publisher (Elsevier) always over 37%. Against many comparators, across many sectors, scientific publishing is one of the most consistently profitable industries (Table S1). These financial arrangements make a substantial difference to science budgets. In 2024, 46% of Elsevier revenues and 53% of Taylor & Francis revenues were generated in North America, meaning that North American researchers were charged over US$2.27 billion by just two for-profit publishers. The Canadian research councils and the US National Science Foundation were allocated US$9.3 billion in that year. The costs of inaction are plain: wasted public funds, lost researcher time, compromised scientific integrity and eroded public trust. Today, the system rewards commercial publishers first, and science second. Without bold action from the funders we risk continuing to pour resources into a system that prioritizes profit over the advancement of scientific knowledge.
November 11, 2025 at 11:52 AM
koptxin.bsky.social
arXiv CS category has stopped accepting review articles and position papers (e.g., SoK) unless they have been peer-reviewed

blog.arxiv.org/2025/10/31/a...
Attention Authors: Updated Practice for Review Articles and Position Papers in arXiv CS Category – arXiv blog
blog.arxiv.org
November 2, 2025 at 12:25 PM
Reposted by Tianxin Tang
cjpatton.bsky.social
Anonymous credentials are going to have a big year. In the realm of "fancy" cryptography, they're perhaps the most important primitive we'll need to make PQ. Where do we stand? Lena Heimberger spent part of the summer finding out.
blog.cloudflare.com/pq-anonymous...
Policy, privacy and post-quantum: anonymous credentials for everyone
The world is adopting anonymous credentials for digital privacy, but these systems are vulnerable to quantum computers. This post explores the cryptographic challenges and promising research paths tow...
blog.cloudflare.com
October 31, 2025 at 2:05 PM
Reposted by Tianxin Tang
agreenberg.bsky.social
Researchers pointed a satellite dish at the sky for 3 years and monitored what unencrypted data it picked up. The results were shocking: They obtained thousands of T-Mobile users' phone calls and texts, military and law enforcement secrets, much more: www.wired.com/story/satell... 🧵👇
Satellites Are Leaking the World’s Secrets: Calls, Texts, Military and Corporate Data
With just $800 in basic equipment, researchers found a stunning variety of data—including thousands of T-Mobile users’ calls and texts and even US military communications—sent by satellites unencrypte...
www.wired.com
October 14, 2025 at 1:03 AM
Reposted by Tianxin Tang
signal.org
In 2023, Signal was the first mainstream messenger to enable post-quantum cryptography. We’re still ahead of the (elliptical) curve, implementing a new hybrid PQ ratchet ensuring Forward Secrecy & Post-Compromise Security even in a post-quantum world. signal.org/blog/spqr/
Signal Protocol and Post-Quantum Ratchets
We are excited to announce a significant advancement in the security of the Signal Protocol: the introduction of the Sparse Post Quantum Ratchet (SPQR). This new ratchet enhances the Signal Protocol’s...
signal.org
October 2, 2025 at 4:09 PM
Reposted by Tianxin Tang
eprint.ing.bot
Computationally-Sound Symbolic Cryptography in Lean (Stefan Dziembowski, Grzegorz Fabiański, Daniele Micciancio, Rafał Stefański) ia.cr/2025/1700
Abstract. We present a formally-verified (in Lean 4) framework for translating symbolic cryptographic proofs into the computationally-sound ones. Symbolic cryptography is a well-established field that allows reasoning about cryptographic protocols in an abstract way and is relatively easy to verify using proof assistants. Unfortunately,  it often lacks a connection to the computational aspects of real-world cryptography. Computationally-sound cryptography, on the other hand, captures this connection much better, but it is often more complex, less accessible, and much harder to verify formally. Several works in the past have provided a bridge between the two, but, to our knowledge, none of them have been implemented in a proof assistant. We close this gap by formalizing the translation from symbolic to computationally-sound cryptography in Lean 4. Our framework is based on the work of Micciancio (Eurocrypt, 2010) and Li and Micciancio (CSF, 2018), which builds on the idea of using co-induction (instead of induction) for reasoning about an adversary’s knowledge in a symbolic setting. Our work encompasses (1) the formalization of the symbolic cryptography framework, (2) the formalization of the computationally sound cryptography framework, and (3) the formalization of the translation between the two. We also provide (4) an extended example of circuit garbling, which is a well-known cryptographic protocol frequently used in secure multi-party computation. We believe that our work will serve as a foundation for future research in the area of formal verification of cryptographic protocols, as it enables reasoning about cryptographic protocols more abstractly while still providing a formally verified connection to the computational aspects of real-world cryptography. Image showing part 2 of abstract.
September 19, 2025 at 2:23 AM
Reposted by Tianxin Tang
str4d.xyz
Another update: someone claims to have fixed the bug!
September 17, 2025 at 10:22 PM
koptxin.bsky.social
Stuck at level 44, not good at chess 🥲
neal.fun Neal Agarwal @neal.fun · Sep 16
I’m Not a Robot, a game about solving CAPTCHAs, is out now!

good luck :)

> neal.fun/not-a-robot/
September 16, 2025 at 4:26 PM
koptxin.bsky.social
Super cool!
lambda.bsky.social Daniel Hugenroth @lambda.bsky.social · Jul 29
One of my favourite CoverDrop details: out-of-band verification of the trusted organization key which signs the entire key hierarchy. Its digest is included in the imprint of every printed Guardian newspaper, removing the need to trust CAs 🔑🗞️ more details: www.coverdrop.org
The picture shows a smartphone and the imprint of a newspaper. The smartphone displays a screen from the SecureMessaging feature showing a key digest. The newspaper imprint shows the same digest. The digest consists of a number of randomly-looking letters and digits.
July 29, 2025 at 11:48 AM
Reposted by Tianxin Tang
rwc.iacr.org
The Call for Contributed Talks is now open for RWC 2026! And the deadline for submissions is now Oct. 10, 2025.
rwc.iacr.org/2026/contrib...
RWC 2026 call for papers
Real World Crypto Symposium
rwc.iacr.org
July 13, 2025 at 3:52 PM
Reposted by Tianxin Tang
eprint.ing.bot
May the Force not Be with you: Brute-Force Resistant Biometric Authentication and Key Reconstruction (Alexandra Boldyreva, Deep Inder Mohan, Tianxin Tang) ia.cr/2025/1211
Abstract. The use of biometric-based security protocols is on the steep rise. As biometrics become more popular, we witness more attacks. For example, recent BrutePrint/InfinityGauntlet attacks showed how to brute-force fingerprints stored on an Android phone in about 40 minutes. The attacks are possible because biometrics, like passwords, do not have high entropy. But unlike passwords, brute-force attacks are much more damaging for biometrics, because one cannot easily change biometrics in case of compromise. In this work, we propose a novel provably secure Brute-Force Resistant Biometrics (BFRB) protocol for biometric-based authentication and key reconstruction that protects against brute-force attacks even when the server storing biometric-related data is compromised. Our protocol utilizes a verifiable partially oblivious pseudorandom function, an authenticated encryption scheme, a pseudorandom function, and a hash. We formally define security for a BFRB protocol and reduce the security of our protocol to the security of the building blocks. We implement the protocol and study its performance for the ND-0405 iris dataset. Image showing part 2 of abstract.
July 2, 2025 at 3:13 AM
Reposted by Tianxin Tang
dulwichquantum.bsky.social
Last Friday Scott Aaronson gave a plenary talk at STOC titled "The Status of Quantum Speedups".
acm-stoc.org/stoc2025/key...
Here are his slides:
www.scottaaronson.com/talks/status...
June 29, 2025 at 9:25 AM
Reposted by Tianxin Tang
lambda.bsky.social
We launched CoverDrop 🎉 providing sources with a secure and anonymous way to talk to journalists. Having started five years ago as a PhD research project, this now ships within the Guardian app to millions of users—all of which provide cover traffic. Paper, code, and more info: www.coverdrop.org
CoverDrop: Blowing the Whistle Through A News App
www.coverdrop.org
June 9, 2025 at 1:00 PM
Reposted by Tianxin Tang
benadida.com
This is how you build secure systems: public source code, solid theoretical foundation, and third-party audits.

Impressive.

(Note: maybe we'll find flaws in this! And then they'll get fixed, thanks to transparency. That's also how secure systems work.)

www.theguardian.com/gnm-press-of...
The Guardian launches Secure Messaging, a world-first from a media organisation, in collaboration with the University of Cambridge
Secure Messaging is a new innovation for confidential story-sharing and source protection, underpinning the Guardian’s commitment to investigative journalism. The Guardian has published the open sourc...
www.theguardian.com
June 9, 2025 at 1:11 PM
koptxin.bsky.social
wow, they implemented OAuth with Claude and included the prompts used in the commit messages github.com/cloudflare/w...
GitHub - cloudflare/workers-oauth-provider: OAuth provider library for Cloudflare Workers
OAuth provider library for Cloudflare Workers. Contribute to cloudflare/workers-oauth-provider development by creating an account on GitHub.
github.com
June 3, 2025 at 10:46 AM
Reposted by Tianxin Tang
xkcd.com
Internet Roadtrip is my favorite thing on the internet right now—it’s basically Twitch Plays Google Street View. They started in Boston, spent several weeks on a quest to cross the Canadian border, and are now exploring New Brunswick. neal.fun/internet-roa...
Internet Roadtrip
Let's take a streetview roadtrip
neal.fun
May 31, 2025 at 3:27 AM
Reposted by Tianxin Tang
eprint.ing.bot
Diving Deep Into UC: Uncovering and Resolving Issues in Universal Composability (Céline Chevalier, Éric Sageloli) ia.cr/2025/934
Abstract. Introduced by Canetti in 2001, Universal Composability (UC) is a widely adopted security model that enables the specification and proof of security for a broad range of protocols, offering strong security guarantees. At its core lies the universal composition theorem (UC theorem), which ensures that protocols proven secure within the framework remain secure even when deployed in real-world environments with multiple instances of them. In this work, we present two key contributions. First, we identify several problems with the UC framework, in particular the UC Theorem. They include counterexamples, limitations that make it unusable for important classes of protocols, and weaknesses in its proof. These problems reveal flaws in nearly all the fundamental concepts of UC. Secondly, we update the main concepts of UC to address these problems. Although these revisions are nontrivial, our updated definitions are intended to stay as closely aligned with the original model as possible, while providing greater simplicity overall. To ensure the validity of these updates, we present a proof of the updated UC theorem, which is more detailed and modular than the original. Image showing part 2 of abstract.
May 23, 2025 at 2:58 AM
koptxin.bsky.social
I found it quite interesting that "compressed sensing" is also used here. We applied it more directly in a paper on recovering the secret sparse vector from inner products perturbed with noise, in the context of PSI.
eprint.ing.bot ePrint Updates @eprint.ing.bot · May 19
Practical cryptanalysis of pseudorandom correlation generators based on quasi-Abelian syndrome decoding (Charles Bouillaguet, Claire Delaplace, Mickaël Hamdad, Damien Vergnaud) ia.cr/2025/892
Abstract. Quasi-Abelian Syndrome Decoding (QA-SD) is a recently in- troduced generalization of Ring-LPN that uses multivariate polynomials rings. As opposed to Ring-LPN, it enables the use of small finite field such as GF(3) and GF(4). It was introduced by Bombar et al (Crypto 2023) in order to obtain pseudorandom correlation generators for Beaver triples over small fields. This theoretical work was turned into a concrete and efficient protocol called F4OLEage by Bombar et al. (Asiacrypt 2024) that allows several parties to generate Beaver triples over GF(2). We propose efficient algorithms to solve the decoding problem underlying the QA-SD assumption. We observe that it reduce to a sparse multivariate polynomial interpolation problem over a small finite field where the adversary only has access to random evaluation points, a blind spot in the otherwise rich landscape of sparse multivariate interpolation. We develop new algorithms for this problem: using simple techniques we interpolate polynomials with up to two monomials. By sending the problem to the field of complex numbers and using convex optimization techniques inspired by the field of “compressed sensing”, we can interpolate polynomials with more terms. This enables us to break in practice parameters proposed by Bombar et al. at Crypto’23 and Asiacrypt’24 as well as Li et al. at Eurocrypt’25 (IACR flagship conferences Grand Slam). In the case of the F4OLEage protocol, our implementation recovers all the secrets in a few hours with probability 60%. This not only invalidates the security proofs, but it yields real-life privacy attacks against multiparty protocols using the Beaver triples generated by the broken pseudorandom correlation generators. Image showing part 2 of abstract.
May 20, 2025 at 5:24 PM