To explore quantum phenomena, we must leave the familiar world and enter the abstract realm of Hilbert space.

The signature scheme Falcon, selected for standardization as FN-DSA (future FIPS-206), offers a compact yet efficient alternative to ML-DSA. However, it

Scott Aaronson, while working at OpenAI, largely solved AI text watermarking together with Hendrik Kirchner.

Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…

When checking that solutions to certain problems are correct, it turns out, you can’t get around the inherent complexity of the quantum world.

It’s been an interesting few weeks for counterexamples. This post is basically my perspective of what has been going on in the world of formalization, AI tools and, in particular, counterexam…

Mathematics is helping us move away from reacting to congestion, towards preventing it.

NIST is advancing nine new post-quantum signature algorithms as potential candidates for future standardization. We take a closer look at all of them, and argue that while they are in the works and sh...

On this week’s show: A roundup of the latest <cite>Science</cite>Insider stories on changes to science wrought by the Trump administration, solving the structure for the proteins behind color vision, ...

By exploiting a physically motivated principle, rather than a mathematical postulate, researchers offer a new perspective on how a real-valued quantum theory can be constructed.

Claude Opus 4.8 helped uncover a four-year-old critical flaw in Zcash that could have enabled undetectable creation of counterfeit coins.

Schnorr's signature scheme and many of its variants are among the most efficient group-based digital signature schemes. Schnorr's scheme has very compact signatures (consisting of only two exponents in its most compact form). However, its security reduction is notoriously non-tight and requires a strong (“programmable”) version of the random oracle model. Variants with a tight(er) security proof in a more realistic model exist, but are less compact and efficient. In this work, we investigate whether these disadvantages are inherent to Schnorr's signatures and its variants. In particular, we define a family of “Schnorr-like” signature schemes, which contains group-based signature schemes with verification similar to Schnorr's scheme. To explore the necessity of (heavy) random oracle abstractions for such schemes, we allow only for a very weak (“non-programmable, non-observable”) version of a random oracle in the security proof. Our main result is that there is no tight reduction of the security of any such “Schnorr-like” scheme to any group-based assumption that holds generically. We also show that this result itself is tight, in the sense that non-tightly secure schemes exist. Similarly, already for a slightly generalized definition of “extended Schnorr-like” schemes, tightly secure schemes exist. Our main result employs a meta-reduction with a new “filtering” technique that may be of independent interest.

With just $800 in basic equipment, researchers found a stunning variety of data—including thousands of T-Mobile users’ calls and texts and even US military communications—sent by satellites unencrypte...

When estimating the decryption failure rate (DFR) of structured lattice-based cryptography, some schemes implicitly assume that the coefficients of the decryption noise are independent. In practice, however, the decryption noise typically contains terms arising from convolutions of small polynomials, which introduce correlations among coefficients. These correlations can create a non-negligible gap between independence-based estimates and empirical failure rates, leading to underestimated DFRs, overestimated security levels, and exploitable attack surfaces. They also obscure the effect of error-correcting mechanisms in structured lattice-based encryption designs. To date, there has been no practical framework for characterizing such correlations. In this paper, we give the first systematic characterization of correlations among the coefficients of convolved polynomials with Gaussian coefficients, using the canonical embedding as the central viewpoint. We establish large-deviation results for the coefficients of the resulting polynomial. Our analysis shows that, as the norm grows, convolutional polynomials asymptotically concentrate near a finite set of fixed two-dimensional planes. This gives rise to directional tail structures in the n-dimensional joint probability density, which we call thorns. As a direct application, we prove that existing decryption-failure attacks succeed precisely by forcing the noise to lie on these thorns. This phenomenon endows the noise with extremely strong correlations, ultimately triggering decryption failures. Furthermore, adopting the canonical embedding perspective allows us to comprehensively illustrate how the independence assumption distorts the true noise distribution. We prove that the independence assumption systematically underestimates the noise norm, and we derive an analytic expression for the probability density function of the Euclidean norm of the decryption noise.

This is the second in a series of posts about anonymous credentials. You can find the first part here. In the previous post, we introduced the notion of anonymous credentials as a technique that al…

Charles Bennett and Gilles Brassard were recognized for their foundational work in quantum information science.

A graduate student recently harnessed the complexity of mathematical proofs to create a powerful new tool in cryptography.

Explaining the mathematics of cryptography

Two research groups say they have significantly reduced the amount of qubits and time required to crack common online security technologies.

Short-wave radio enthusiasts have eagerly reported the appearance of Farsi-language encoded messages being broadcast out of Western Europe. The messages are being transmitted via number stations, which are radio broadcasts used by intelligence agencies to send encrypted messages to agents in the field. It is one of the oldest forms of clandestine communication, dating back to the first World War, and is still used by modern intelligence agencies today because they're almost impossible to decipher.

This post has been on my back burner for well over a year. This has bothered me, since with every month that goes by, I become more convinced that anonymous authentication the most important topic …

Micro-cracks travel along the peeling tape at supersonic speeds, producing shock waves and sound pulses.

View More Papers

Sold for $962,500 | Jim Sanborn's original Kryptos archive that reveals the secrets of K4 and the much anticipated K5, plus an afternoon with Sanborn as he p

Cryptography is a tool for turning a whole swathe of problems into key management problems. Key management problems are way harder than (virtually all) cryptographers think.

International Association for Cryptologic Research runs secure vote and then loses the keys so nobody knows what the result is. As one commenter put it: “So a single member can collude to res…

What we've added for PQC, and how we got there.

Quantum mechanics has at last been formulated exclusively with real numbers, bringing a mathematical puzzle at the heart of the theory into a new era of inquiry.

Two people found the solution. They used the power of research, not cryptanalysis, finding clues amongst the Sanborn papers at the Smithsonian’s Archives of American Art. This comes as an awkward time, as Sanborn is auctioning off the solution. There were legal threats—I don’t understand their basis—and the solvers are not publishing their solution.