Michele Orrù @tumbolia.bsky.social · 11/06/2026the super secret project i've been working on the past year is out 2255
Michele Orrù @tumbolia.bsky.social · 16/05/2026Our work on sigma-rs and credentials was accepted to USENIX 2026! Huge thanks to my co-authors, the @torproject.org and @ooni.org communities for the real-world problems, feedback, and inspiration that shaped it. With pq-privacy is solved, the next step is post-quantum soundness. ia.cr/2026/794 051
Michele Orrù @tumbolia.bsky.social · 29/03/2026Went to Tsinghua, Peking, IETF 125 to talk about cryptography. Striking how technology is embedded in daily life. Chinese students are fantastic. 061
Michele Orrù @tumbolia.bsky.social · 14/10/2025Talk in just a few hours! 🗞️ eprint.iacr.org/2024/1552 Exciting to present it in the very same venue where I wrote a big chunk of it while attending @rightscon.org ! 030
Michele Orrù @tumbolia.bsky.social · 27/09/2025Would it be harder to believe Nicholas Bourbaki is a collective pseudonym or that Jean-Pierre Serre is a single person 020
Michele Orrù @tumbolia.bsky.social · 23/09/2025Got invited to @college-de-france.fr for a seminar about zero-knowledge and online anonymity! 🎉🎉🎉 www.college-de-france.fr/fr/agenda/se... 050
Michele Orrù @tumbolia.bsky.social · 30/08/2025A key takeaway: for 20 years, we’ve relied on a notion called indifferentiability to use random oracles over arbitrary-length spaces—but it’s not sufficient for knowledge soundness. 🗞️ eprint.iacr.org/2025/536eprint.iacr.orgA Fiat–Shamir Transformation From Duplex SpongesWe analyze a variant of the Fiat–Shamir transformation based on an ideal permutation. The transformation relies on the popular duplex sponge paradigm, and minimizes the number of calls to the permutat... 010
Michele Orrù @tumbolia.bsky.social · 30/08/2025Thrilled to announce that my latest paper with Alessandro Chiesa has been accepted to TCC, the IACR conference on the theory of cryptography! 160
Michele Orrù @tumbolia.bsky.social · 24/08/2025at this conference everyone has 4+ coauthors except me lol 030
Michele Orrù @tumbolia.bsky.social · 24/08/2025I'll present my latest paper on anonymous credentials and designated-verifier kzg at ACM CCS 2025 in Taipei! 2121
Michele Orrù @tumbolia.bsky.social · 17/08/2025Sorry for the late reply! Finally part of the CFRG! 010
Reposted by Michele OrrùSaber @rt-saber.bsky.social · 09/08/2025Phrack #72 release reveals TTPs, backdoors and targets of a Chinese/North Korean state actor mimicking Kimsuky A copy of his workstation is available for all researchers to analyze! Article: data.ddosecrets.com/APT%20Down%2... Data dump: ddosecrets.com/article/apt-...ddosecrets.comAPT Down - The North Korea Files - Distributed Denial of SecretsApproximately 9 GB of files exfiltrated from a North Korean threat actor's computer. The data is being released alongside Phrack, and South Korean victims were notified prior to publication. Resear... 02110
Reposted by Michele OrrùOpal @opalescentopal.bsky.social · 27/07/2025With Tom Lehrer's passing, I suppose this is a moment to share the story of the prank he played on the National Security Agency, and how it went undiscovered for nearly 60 years. 14386173600
Michele Orrù @tumbolia.bsky.social · 26/07/2025Yesterday, @cathie.bsky.social gave a great talk at @ietf.org 123 on the importance of standardizing Sigma protocols and our ongoing work toward a standard for zero-knowledge proofs! You can watch the talk here:youtube.comIETF 123: Crypto Forum (CFRG) 2025-07-24 15:00YouTube video by IETF - Internet Engineering Task Force 171
Michele Orrù @tumbolia.bsky.social · 15/07/2025The paper is huge — it’s been a journey to nail down a proof. I think it’s a solid step forward in narrowing down Fiat-Shamir attacks and characterizing the concrete security of ZKPs. It’s also been really helpful in shaping what a standard for Fiat-Shamir should look like. 030
Michele Orrù @tumbolia.bsky.social · 15/07/2025We updated our paper on Fiat-Shamir! We now take a closer look at the gap between what symmetric cryptography has focused on for over 10 years (indifferentiability) and what is actually needed for the soundness of ZKPs and SNARKs (something stronger!). eprint.iacr.org/2025/536eprint.iacr.orgA Fiat–Shamir Transformation From Duplex SpongesWe analyze a variant of the Fiat–Shamir transformation based on an ideal permutation. The transformation relies on the popular duplex sponge paradigm, and minimizes the number of calls to the permutat... 2155
Michele Orrù @tumbolia.bsky.social · 11/07/2025Yes! Right. Secret signature or verification key (the latter I think is more common) 010
Michele Orrù @tumbolia.bsky.social · 10/07/2025If the hash input is secret though you’ll be leaking some side channel information right? And the procedure is only terminating in expected time 100
Michele Orrù @tumbolia.bsky.social · 02/07/2025ACM CCS ? and I do remember them even welcoming economical studies on malware — www.youtube.com/watch?v=5uAK...youtube.comACM CCS 2017 - Economic Factors of Vulnerability Trade and Exploitation - Luca AllodiYouTube video by Association of Computing Machinery 2017 000
Reposted by Michele OrrùePrint Updates @eprint.ing.bot · 12/06/2025On the Concrete Security of BBS/BBS+ Signatures (Rutchathon Chairattana-Apirom, Stefano Tessaro) ia.cr/2025/1093 002
Reposted by Michele OrrùChristian Knabenhans @cknabs.bsky.social · 20/05/2025I'm happy to finally open-source lattirust, a library for lattice-based zero-knowledge/succinct arguments! Lattirust is somewhat like arkworks, but for lattices; and like lattigo, but for arguments. ➔ github.com/lattirustgithub.comlattirustLattice zero-knowledge/succinct arguments, and more - lattirust 23216
Michele Orrù @tumbolia.bsky.social · 17/05/2025that's not always the case right? If I am making an OR proof, I generate the commitment and the response of the simulated branch before getting the challenge of the verifier 000
Michele Orrù @tumbolia.bsky.social · 17/05/2025In any case Nico was in the original discussions for this project and knows the door is open :) 000
Michele Orrù @tumbolia.bsky.social · 17/05/2025Im not sure what thus means, are you saying that if a prover message is generated at the round i, it should be sent in the round i? 200
Michele Orrù @tumbolia.bsky.social · 16/05/2025The narg proof string (the « transcript ») is serialized from the prover messages, I think that’s what you are asking? 100
Michele Orrù @tumbolia.bsky.social · 10/05/2025so there's two nexus that do AI now, one is the world library and the other the world computer. here's the old one github.com/nexus-stc/stcgithub.comGitHub - nexus-stc/stc: Distributed free search engine and AI tools that grant access to knowledgeDistributed free search engine and AI tools that grant access to knowledge - nexus-stc/stc 010
Michele Orrù @tumbolia.bsky.social · 11/04/2025Our paper "Beyond the Circuit" was accepted at IACR's Communications in Cryptology! It contains a few simple protocols for simplifying foreign arithmetic in zero-knowledge proofs. Formally we introduce "Σ-reductions", a mix of "Σ-protocols" and "reductions of knowledge". 🗞️ cic.iacr.org/p/2/1/23/pdf 0111
Michele Orrù @tumbolia.bsky.social · 31/03/2025I have one of those,but to what end exactly is it useful? To nourish our egos, or so that our performance metrics are more accurate? 100
Reposted by Michele OrrùOONI @ooni.org · 24/03/2025How to protect the OONI dataset from attacks, while preserving the privacy of OONI Probe users? In our latest blog post, we outline some of the key requirements for OONI's anonymous credential system: ooni.org/post/2025-re... #AnonymousCredentials #ooniprobe #ooni 032
Michele Orrù @tumbolia.bsky.social · 17/03/2025The blog post has been translated in mandarin! ooni-research.ocf.tw/docs/zh-tw/b...ooni-research.ocf.tw去識別化的觀測資料安全 - OONI-Research 網路干預開放觀察計畫OONI 預計實作匿名憑證減緩假觀測資料影響觀測資料庫的可信度 000
Michele Orrù @tumbolia.bsky.social · 16/03/2025In the meantime, zkproof7's program, a "standards conference" 030
Michele Orrù @tumbolia.bsky.social · 16/03/2025Tomorrow I will venture outside research comfort zone to talk at the IETF about standardizing Fiat-Shamir and Σ-protocols. You can check out my slides here datatracker.ietf.org/meeting/122/... 283
Michele Orrù @tumbolia.bsky.social · 13/03/2025Went to a meeting where they told me the Force cannot be double-spent and it made a lot of sense 130
Michele Orrù @tumbolia.bsky.social · 25/02/2025Yes but I like more the example where you top up your account using your identity and then can spend your credit without being linked to your identity 010
Michele Orrù @tumbolia.bsky.social · 25/02/2025you're welcome, academics \newcommand{\promptinject}[1]{{\tiny\color{white} #1}} 023
Michele Orrù @tumbolia.bsky.social · 25/02/2025This work is part of the Slow Crypto movement, which advocates for a deliberate deceleration in theoretical cryptography, prioritizing carefully matured primitives, thorough analysis, and collaborative verification over rushed academic publishing and optimization races 040
Michele Orrù @tumbolia.bsky.social · 25/02/2025These systems are quite frequent and I personally find it's easier to deploy cryptography there (because it's a self-contained system). 130
Michele Orrù @tumbolia.bsky.social · 25/02/2025The paper tries to revisit anonymous credentials in the setting where the issuer and the verifier are the same person. We give some new notions of security, and change two historical schemes to make them (1) more efficient, and (2) perfectly private. 110
Michele Orrù @tumbolia.bsky.social · 25/02/2025I have updated my work on keyed-verification anonymous credentials, which is now 80 pages long and single authored. May it rest in peace 🪦 eprint.iacr.org/2024/1552.pdfeprint.iacr.org 2131
Michele Orrù @tumbolia.bsky.social · 21/02/2025did a small blog post introducing anonymous credentials on OONI, a tool that measures censorship across the globe 💅ooni.orgProbe Security Without IdentificationAn overview of the current literature on anonymous credentials and how we will be designing and implementing an anonymous credential system for use in OONI Probe. 182
