SPRING2026

Invited Speakers

Tim Beyne (KU Leuven, Belgium)
Title: Security analysis of arithmetization-oriented primitives.
Abstract: In this talk, I will give an overview of our recent work on the security analysis of arithmetization-oriented primitives. The first part of my talk will cover what we currently know about the security of these primitives against linear and differential cryptanalysis. In particular, I will explain how pairwise independence results for AES-like primitives yield strong security arguments in the key-averaged setting, and how (in some cases) fixed-key security arguments can be obtained using ideas from algebraic geometry. The second part of the talk turns to integral cryptanalysis and its connection to algebraic attacks. I will introduce recent advances in this area, with particular emphasis on ultrametric integral cryptanalysis.

Àlex Rodríguez García (Universitat Politècnica de Catalunya, Spain)
Title: Round skips for Poseidon.
Abstract: TBA.

Emmanuela Orsini (Bocconi, Italy)
Title: Applications of Symmetric Primitives in Secure Computation (From ZK Hashing to Silent Preprocessing).
Abstract: TBA.

Léo Perrin (Inria, France)
Title: TBA.
Abstract: TBA.

Christian Rechberger (TU Graz, Austria)
Title: TBA.
Abstract: TBA.

François-Xavier Standaert (UC Louvain, Belgium)
Title: Prime Field Masking and Hard Physical Learning Problems: Design and (Crypt)Analysis Challenges.
Abstract: Protecting cryptographic implementations against side-channel attacks has been an important challenge over the last two decades. It is specially difficult in the context of symmetric cryptography, which is generally less (algebraically) structured than asymmetric cryptography and, therefore, offers less design features that are exploitable for countermeasures. For now, masking (i.e., secret sharing) and re-keying are the most studied and deployed protection mechanisms. Given the widespread belief that bit-oriented ciphers lead to the most efficient (unprotected) implementations, ciphers have in turn been optimized to reduce their multiplicative (AND) complexity, in order to enable efficient (Boolean) masking. Besides, modes of operation have been designed to leverage re-keying. In this talk, I will first argue that despite leading to efficient unprotected implementations, bit-oriented ciphers combined with Boolean masking may not lead to the most efficient protected implementations. Intuitively, this is because actual (e.g., Hamming weigh) leakages are quite "compatible" with computations in GF(2). For example, the least significant bit of the Hamming weight is a linear function of its input. As a result, the only way to ensure secure masking in this case is to ensure a sufficient level of physical noise, in order to "hide" this algebraic compatibility. Unfortunately, such a noise is not always present (e.g., in low-cost software implementations). Besides, it turns out exactly the same issue pops up with re-keying, which is only secure in GF(2) if leakages are sufficiently noisy. I will then browse solutions that can be considered to get rid of this limitation. As a more conservative change, one can consider prime-field masking applied to prime ciphers with limited multiplicative complexity -- a goal that is reminiscent of ciphers optimized for MPC or FHE, though with different constraints in terms of field size (in order to allow efficient implementation in embedded software and hardware). A more aggressive choice is to leverage so-called "hard physical learning problems", which are variants of LWE or LWR where the errors or rounding are defined by physical leakages, to produce fresh ephemeral secrets. Both options lead to promising optimizations, enable simple(r) implementations (than Boolean masking) and raise interesting design and (crypt)analysis challenges.

1st Workshop on Symmetric Primitives
over prime fields and integer RINGs

Welcome to the SPRING Workshop

Workshop Schedule

Invited Speakers

Funding