Missed a talk? A link to the recording (if available) and other relevant resources will be posted here a few days after each talk.

In this talk I will lay out the connection between the security of password-authenticated key exchange in a post-quantum world and quantum-accessible ideal ciphers. I will present a recent work (ia.cr/2025/458) where we demonstrate that for the probably most generic PAKE construction called encrypted key exchange (EKE) a security proof must implement a programmable ideal-cipher simulator. Afterwards, I will discuss a recent work (ia.cr/2026/146) where we make some progress in that direction, presenting an efficient ideal-cipher simulator that allows to do query-recording, adaptive reprogramming, as well as measure-and-reprogram. I will close with open problems in that area.

At SAC 2011, Bertoni et al. introduced the keyed duplex construction as a tool to build permutation based authenticated encryption schemes. The construction was generalized to full-state absorption by Mennink et al. (ASIACRYPT 2015). Daemen et al. (ASIACRYPT 2017) generalized it further to cover much more use cases, and proved security of this general construction, and Dobraunig and Mennink (ASIACRYPT 2019) derived a leakage resilience security bound for this construction. Due to its generality, the full-state keyed duplex construction that we know today has plethora applications, but the flip side of the coin is that the general construction is hard to grasp and the corresponding security bounds are very complex. Consequently, the state-of-the-art results on the full-state keyed duplex construction are not used to the fullest. In this work, we revisit the history of the duplex construction, give a comprehensive discussion of its possibilities and limitations, and demonstrate how the two security bounds (of Daemen et al. and Dobraunig and Mennink) can be interpreted in particular applications of the duplex.

In distributed systems, it’s common to use random nonces for authenticated encryption to avoid synchronization. Unfortunately, the national standard GCM has a relatively short nonce length (96 bits), resulting in poor security. Moreover, cloud systems now have to deal with an exponential growth of data, leading to a frequent key rotation of GCM. Both NIST and the industry have been calling for a solution for these issues. Ideally, such a solution should retain the speed of GCM, as using a slower encryption scheme would cost cloud servers millions of dollars per year, which is highly undesirable. In this talk, we consider two different approaches to address this problem.

1) Nonce-length extension transform: given a long (say 192-bit) nonce N and a key K, derive a 96-bit sub-nonce and a subkey, and then run GCM with the latter. We first revisit a particular nonce-length extension method called NX that is used in DNDK-GCM and XAES-256-GCM. We substantially improve its security guarantees by giving good (tight) bounds for both random-nonce and any-nonce security. We go on to give an even better transform that we call RtX. Both NX and RtX provide 96-bit security under the random-nonce setting.

2) Finally, towards longer-term mitigation, we give a new scheme GCX that provides optimal 128-bit security with 192-bit nonce at the speed of GCM. Our scheme GCX is very simple, and uses standard components (AES and GHASH), making it easy to implement and adopt for standardization. Unlike prior work that assumes message length is short, GCX can handle messages up to 2^{58} bytes.

In this talk, we will explore various lifting theorems establishing security in the quantum idealized models. The high-level theme of these lifting theorems is to relate the success probability of an arbitrary quantum adversary to that of a classical algorithm making only a small number of classical queries. We will see some example applications and limitations of the lifting theorems, as well as some open problems.

Several well-known beyond-birthday-bound PRFs are built by XORing outputs of permutations. In this talk, I will describe some of the main ideas used in recent Fourier-analytic tight security proofs of such PRFs. I will then discuss some open problems in the application of Fourier analysis in provable security of symmetric-key primitives.