SPRING2026

Invited Speakers

Tim Beyne (KU Leuven, Belgium) Title: Security analysis of arithmetization-oriented primitives. slides
Abstract: In this talk, I will give an overview of our recent work on the security analysis of arithmetization-oriented primitives. The first part of my talk will cover what we currently know about the security of these primitives against linear and differential cryptanalysis. In particular, I will explain how pairwise independence results for AES-like primitives yield strong security arguments in the key-averaged setting, and how (in some cases) fixed-key security arguments can be obtained using ideas from algebraic geometry. The second part of the talk turns to integral cryptanalysis and its connection to algebraic attacks. I will introduce recent advances in this area, with particular emphasis on ultrametric integral cryptanalysis.

Àlex Rodríguez García (Universitat Politècnica de Catalunya, Spain) slides
Title: Round skips for Poseidon.
Abstract: Recently a new round-skipping trick was discovered which exploits the structure of Poseidon2's external linear layer. As a consequence, MDS matrices have been proposed (again) for use in the Poseidon hash function. In this talk we discuss several round-skipping techniques that appear in the literature and why some matrices appear to be weaker than others.

Emmanuela Orsini (Bocconi, Italy)
Title: Applications of Symmetric Primitives in Secure Computation (From ZK Hashing to Silent Preprocessing).
Abstract: Secure computation often works over prime fields and integer rings, rather than over the bit strings used by standard symmetric cryptography. This changes what it means for a hash function, PRF, PRG, or cipher to be efficient. I will discuss examples from zero-knowledge proofs and multi-party computation where the choice of the underlying symmetric primitive can substantially reduce the cost of the protocol. These examples illustrate how the algebraic domain, the cost model, and the security role can shape the design of useful primitives.

Léo Perrin (Inria, France) slides
Title: Why do all these primitives defined over rings/prime fields get broken?
Abstract: Over the past few years, many primitives defined over integer rings or prime fields have been broken, in particular by attacks ultimately relying on POlynomial System SOlving (PoSSo). In this talk, we will go over the cryptanalytic techniques that enabled these breaks, the design decisions that lead to their efficiency, and will give directions on how to (hopefully) prevent such attacks in the future.

Christian Rechberger (TU Graz, Austria) slides
Title: Survey of ZK- and MPC-friendly symmetric cryptography.
Abstract: In this talk we introduce symmetric cryptography to researchers and practitioners in the areas of MPC and ZK, and introduce MPC and ZK to researchers in symmetric cryptography. We survey symmetric cryptography constructions that are MPC-friendly and/or ZK-friendly, with a focus on a combination of both properties.

François-Xavier Standaert (UC Louvain, Belgium) slides
Title: Prime Field Masking and Hard Physical Learning Problems: Design and (Crypt)Analysis Challenges.
Abstract: Protecting cryptographic implementations against side-channel attacks has been an important challenge over the last two decades. It is specially difficult in the context of symmetric cryptography, which is generally less (algebraically) structured than asymmetric cryptography and, therefore, offers less design features that are exploitable for countermeasures. For now, masking (i.e., secret sharing) and re-keying are the most studied and deployed protection mechanisms. Given the widespread belief that bit-oriented ciphers lead to the most efficient (unprotected) implementations, ciphers have in turn been optimized to reduce their multiplicative (AND) complexity, in order to enable efficient (Boolean) masking. Besides, modes of operation have been designed to leverage re-keying. In this talk, I will first argue that despite leading to efficient unprotected implementations, bit-oriented ciphers combined with Boolean masking may not lead to the most efficient protected implementations. Intuitively, this is because actual (e.g., Hamming weigh) leakages are quite "compatible" with computations in GF(2). For example, the least significant bit of the Hamming weight is a linear function of its input. As a result, the only way to ensure secure masking in this case is to ensure a sufficient level of physical noise, in order to "hide" this algebraic compatibility. Unfortunately, such a noise is not always present (e.g., in low-cost software implementations). Besides, it turns out exactly the same issue pops up with re-keying, which is only secure in GF(2) if leakages are sufficiently noisy. I will then browse solutions that can be considered to get rid of this limitation. As a more conservative change, one can consider prime-field masking applied to prime ciphers with limited multiplicative complexity -- a goal that is reminiscent of ciphers optimized for MPC or FHE, though with different constraints in terms of field size (in order to allow efficient implementation in embedded software and hardware). A more aggressive choice is to leverage so-called "hard physical learning problems", which are variants of LWE or LWR where the errors or rounding are defined by physical leakages, to produce fresh ephemeral secrets. Both options lead to promising optimizations, enable simple(r) implementations (than Boolean masking) and raise interesting design and (crypt)analysis challenges.

1st Workshop on Symmetric Primitives
over prime fields and integer RINGs

Welcome to the SPRING Workshop

Workshop Schedule

Invited Speakers

Funding