publications
publications by categories in reversed chronological order. generated by jekyll-scholar.
2027
- NDSS
Reverse-Bleichenbacher: Bleichenbacher Attacks are Practical AgainIn Network and Distributed System Security Symposium (NDSS), 2027Accepted for publication. Full version: Cryptology ePrint Archive, Paper 2026/2414Bleichenbacher’s 1998 padding oracle attack against RSA PKCS#1 v1.5 has resurfaced repeatedly over the past decades, especially in TLS. Although modern browsers prefer TLS 1.3, many servers and clients still permit RSA key exchange for backward compatibility, enabling active network attackers to decrypt recorded sessions. Still, practical man-in-the-middle attacks remain challenging. The classical attack narrows the plaintext interval from the top down, spending many queries on secret-independent padding bytes before reaching the PreMasterSecret in the low-order 46 bytes of the RSA plaintext. As a result, prior attacks required multiple vulnerable servers in parallel to avoid connection timeouts. In this paper, we present Reverse-Bleichenbacher, a novel variant of the Bleichenbacher algorithm. In contrast to all previous Bleichenbacher-style algorithms, our algorithm recovers the least significant bytes first and terminates the search as soon as the target secret is recovered. When the secret occupies only a fraction of the plaintext, as with the TLS PreMasterSecret, this significantly reduces the number of required queries. Together with improved trimmers and a coverage-optimized search, this reduces the median number of oracle queries from 11.428 to 1801 against a standards-conforming PKCS#1 v1.5 oracle with 2048-bit keys, with an overall success rate of 84.8 %. Crucially, under realistic single-server conditions (a 2.6 ms median round-trip time we observe to vulnerable hosts and 2 round trips per query) 68.3% of all runs finish within a 30s timeout, compared with none of the prior algorithms. To remain feasible at higher latency, we parallelize independent queries: at 20 ms round-trip time, batching reduces the median end-to-end runtime from 59.3s to 8.3s, at the cost of additional queries. We identify 640 vulnerable domains in the Tranco Top 1 Million, many behind Alibaba Cloud load balancers. We demonstrate end-to-end impact on real software distribution channels: a man-in-the-middle attacker can inject malicious updates and achieve remote code execution on a victim device.
@inproceedings{RB2027, author = {Lü, Youheng and Hetterich, Lorenz and Zanotto, Riccardo and Cremers, Cas and Schwarz, Michael and Gerlach, Lukas}, title = {Reverse-Bleichenbacher: Bleichenbacher Attacks are Practical Again}, booktitle = {Network and Distributed System Security Symposium (NDSS)}, year = {2027}, note = {Accepted for publication. Full version: Cryptology {ePrint} Archive, Paper 2026/2414}, url = {https://eprint.iacr.org/2026/2414}, }
2026
- Non-Interactive Atomic Swaps from Standard Signatures: Lower Bounds and ConstructionsXiangyu Liu, Riccardo Zanotto, and Vassilis Zikas2026
Atomic swaps are the prototypical application of adaptor signatures. Practical constructions settle with two ordinary on-chain signatures and require no scripting, but they need two sequential online rounds: Alice samples a hard statement and sends its pre-signature, and Bob follows with his own pre-signature using the same statement. We ask whether the protocol can be compressed into a single online round (from Bob to Alice), which we call a non-interactive atomic swap, without relying on impractical universal adaptor signatures. In particular, we require that both parties continue to use standard signature schemes with unmodified verification algorithms. Our main result is a lower bound: for statistically unlinkable adaptors with negligible faithfulness failure, Bob’s valid-signature space per message must be superpolynomially larger than the relation’s witness space. This (1) reaffirms the impossibility result by Erwig et al. [PKC 2021] for unique signatures as a trivial corollary, and (2) excludes non-interactive swaps using the same signature scheme on both sides. However, the bound does leave room for asymmetric instantiations. We give one in which Alice signs with BLS and Bob uses a pairing-Schnorr adaptor whose witness is Alice’s BLS signature, and prove its security under the native unforgeability of BLS in the random oracle model. To support more signature schemes in our non-interactive swap framework, we introduce atomic signature swaps with preprocessing: Alice publishes message-independent public data before the messages are chosen. These data, together with her public key and the messages, later determine a statement whose witnesses assemble into her native signature. The protocol requires a single online round carrying a pre-signature by Bob and falls into our non-interactive framework. We prove a Schnorr/Schnorr instantiation under the OMDL assumption in the random oracle model, and give a conditional ECDSA/Schnorr instantiation.
@misc{cryptoeprint:2026/2277, author = {Liu, Xiangyu and Zanotto, Riccardo and Zikas, Vassilis}, title = {Non-Interactive Atomic Swaps from Standard Signatures: Lower Bounds and Constructions}, howpublished = {Cryptology {ePrint} Archive, Paper 2026/2277}, year = {2026}, url = {https://eprint.iacr.org/2026/2277}, } - A General Approach to Adaptor SignaturesNico Döttling, Sri AravindaKrishnan Thyagarajan, Pratik Soni, Jay Taylor, Hendrik Waldner, and Riccardo Zanotto2026
Adaptor signatures have emerged as a powerful contract-minimal mechanism for fair exchange on blockchains, enabling efficient and privacy-preserving atomic swaps and conditional payments. However, existing adaptor schemes are limited to narrow classes of NP relations (e.g., discrete logarithm secrets) and specific signature schemes, limiting their scope both in terms of constructions and applications. This work addresses this gap by presenting a new framework that supports arbitrary NP relations and a broad range of signature schemes, significantly extending the reach of adaptor signatures beyond prior works and broadening the design space for adaptor signature constructions. Our framework also yields adaptor signatures that are compatible with today’s blockchain systems. More specifically, we devise two general compilers for adaptor signatures. First, we show how to efficiently lift adaptor signatures from structured languages (such as discrete log relations) to general NP languages with the help of degree- homomorphic encryption, resulting in adaptors for standard signature schemes and general NP languages. Secondly, we develop a compiler that transforms any signature scheme with a subliminal channel into an adaptor signature scheme for general NP languages using circuit-private fully homomorphic encryption. Signatures with subliminal channels enable the encoding of witnesses in the signing randomness, and include randomness-recoverable schemes like Schnorr, ECDSA, CL, BBS, as well as salted versions of deterministic signatures schemes like BLS and RSA. Both constructions achieve a novel property called statement truth privacy, which guarantees that a buyer learns nothing about the underlying statement, not even its truth, unless the protocol successfully completes.
@misc{cryptoeprint:2026/1889, author = {Döttling, Nico and Thyagarajan, Sri AravindaKrishnan and Soni, Pratik and Taylor, Jay and Waldner, Hendrik and Zanotto, Riccardo}, title = {A General Approach to Adaptor Signatures}, howpublished = {Cryptology {ePrint} Archive, Paper 2026/1889}, year = {2026}, url = {https://eprint.iacr.org/2026/1889}, } - GATOR: Group Action AdapTOR Signatures via MPC-in-the-HeadNico Döttling, Manar Mohamed, and Riccardo Zanotto2026
Adaptor signatures are a foundational fairness primitive for blockchain applications. They enhance blockchain functionality by enabling applications such as atomic swaps, payment channels, and other fair-exchange protocols. At a high level, they allow a buyer to produce a pre-signature tied to a public statement, which a seller holding a corresponding witness can adapt into a valid signature. Once this signature is posted on-chain, the seller obtains payment, while the buyer can extract the witness from the finalized signature. Existing practical adaptor signature constructions are predominantly tied to discrete-logarithm-based signatures, such as ECDSA and Schnorr, reflecting their widespread use in current blockchain deployments. However, the threat of Shor’s algorithm and the broader transition toward post-quantum cryptography raise the question of whether adaptor functionality can also be realized efficiently for post-quantum signature schemes. In this work, we answer this question for a broad class of signatures based on cryptographic group actions. Building on efficient MPC-in-the-Head-style group-action signatures, we obtain adaptor functionality through small modifications, yielding a general framework for adaptor signatures from arbitrary group actions. In particular, our construction supports selling group-action discrete logarithms, which in certain parameter regimes correspond to the secret keys of the underlying signature scheme. We further discuss concrete instantiations from several group-action families, including those underlying schemes such as CSI-FiSh, LESS, MEDS, and ALTEQ, and present a modular proof-of-concept implementation. We obtain a 25kB pre-signature with 100ms pre-signing time for LESS, MEDS and ALTEQ, while a 4kB pre-signature with 3.6s pre-signing time for CSI-FiSh.
@misc{cryptoeprint:2026/1067, author = {Döttling, Nico and Mohamed, Manar and Zanotto, Riccardo}, title = {{GATOR}: Group Action {AdapTOR} Signatures via {MPC}-in-the-Head}, howpublished = {Cryptology {ePrint} Archive, Paper 2026/1067}, year = {2026}, url = {https://eprint.iacr.org/2026/1067}, } - How (not) to Switch FHE Schemes: Framework and Attacks in the IND-CPA-D ModelGiacomo Santato and Riccardo Zanotto2026
In this paper, we study the IND-CPA-D security of FHE schemes when combined through scheme switching. We introduce a formal framework that captures security in this setting and provide a rigorous analysis of different constructions. Within this framework, we identify sufficient conditions for the switching algorithm under which the combined schemes achieve IND-CPA-D security, assuming the individual schemes are IND-CPA-D-secure. We then focus on the specific case of scheme switching from CKKS to TFHE. We analyze how existing switching algorithms designed for vanilla CKKS can be modified to preserve IND-CPA-D security. We demonstrate an attack against the IND-CPA-D security of the PEGASUS construction [LHHMQ21] and we implement a proof-of-concept of this attack against the CKKS-to-FHEW switching mechanism in the OpenFHE library. Finally, we present a generic transformation that converts a vanilla CKKS-based switch into an IND-CPA-D-secure one.
@misc{cryptoeprint:2026/285, author = {Santato, Giacomo and Zanotto, Riccardo}, title = {How (not) to Switch {FHE} Schemes: Framework and Attacks in the {IND}-{CPA}-D Model}, howpublished = {Cryptology {ePrint} Archive, Paper 2026/285}, year = {2026}, url = {https://eprint.iacr.org/2026/285}, }
2025
- Non-interactive Blind Signatures from RSA Assumption and MoreLucjan Hanzlik, Eugenio Paracucchi, and Riccardo ZanottoIn Advances in Cryptology – EUROCRYPT 2025, 2025
Blind signatures have received increased attention from researchers and practitioners. They allow users to obtain a signature under a message without revealing it to the signer. One of the most popular applications of blind signatures is to use them as one-time tokens, where the issuing is not linkable to the redeeming phase, and the signature under a random identifier forms a valid token. This concept is the backbone of the Privacy Pass system, which uses it to identify honest but anonymous users and protect content delivery networks from botnets. Non-interactive blind signatures for random messages were introduced by Hanzlik (Eurocrypt’23). They allow a signer to create a pre-signature with respect to a particular public key, while the corresponding secret key can later be used to finalize the signature. This non-interaction allows for more applications than in the case of blind signatures. In particular, the author suggested using regular PKI keys as the recipient public key, allowing for a distribution of one-time tokens to users outside the system, e.g., to public keys of GitHub users, similar to airdropping of cryptocurrencies. Unfortunately, despite introducing this concept, the paper fails to provide schemes that work with keys used in the wild. We solve this open problem. We introduce a generic construction of non-interactive blind signatures that relies on Yao’s garbled circuit techniques and provide particular improvements to this generic setting. We replace oblivious transfer with their non-interactive variant and show how to construct them so that the recipient’s public key, encoding the OT choice, is a standard RSA public key (e, N). To improve the efficiency of the garbling, we show how to garble the signing algorithm of the pairing-based Pointcheval-Sanders (PS) signatures and the RSA-based signature scheme with efficient protocols by Camenisch and Lysyanskaya. Our technique also apply to the well-known BBS signatures. All our improvements are of independent interest and are central to our contribution.
@inproceedings{10.1007/978-3-031-91124-8_13, author = {Hanzlik, Lucjan and Paracucchi, Eugenio and Zanotto, Riccardo}, editor = {Fehr, Serge and Fouque, Pierre-Alain}, title = {Non-interactive Blind Signatures from RSA Assumption and More}, booktitle = {Advances in Cryptology -- EUROCRYPT 2025}, year = {2025}, publisher = {Springer Nature Switzerland}, address = {Cham}, pages = {365--394}, isbn = {978-3-031-91124-8}, doi = {10.1007/978-3-031-91124-8_13}, }
2024
- Rate-1 Fully Local Somewhere Extractable Hashing from DDHIn Public-Key Cryptography – PKC 2024, 2024
Somewhere statistically binding (SSB) hashing allows us to sample a special hashing key such that the digest statistically binds the input at m secret locations. This hash function is said to be somewhere extractable (SE) if there is an additional trapdoor that allows the extraction of the input bits at the m locations from the digest. Devadas, Goyal, Kalai, and Vaikuntanathan (FOCS 2022) introduced a variant of somewhere extractable hashing called rate-1 fully local SE hash functions. The rate-1 requirement states that the size of the digest is m + poly(λ) (where λ is the security parameter). The fully local property requires that for any index i, there is a “very short” opening showing that i-th bit of the hashed input is equal to b for some b ∈ {0, 1}. The size of this opening is required to be independent of m and in particular, this means that its size is independent of the size of the digest. Devadas et al. gave such a construction from Learning with Errors (LWE). In this work, we give a construction of a rate-1 fully local somewhere extractable hash function from Decisional Diffie-Hellman (DDH) and BARGs. Under the same assumptions, we give constructions of rate-1 BARG and RAM SNARG with partial input soundness whose proof sizes are only matched by prior constructions based on LWE.
@inproceedings{10.1007/978-3-031-57725-3_12, author = {Branco, Pedro and D{\"o}ttling, Nico and Srinivasan, Akshayaram and Zanotto, Riccardo}, editor = {Tang, Qiang and Teague, Vanessa}, title = {Rate-1 Fully Local Somewhere Extractable Hashing from DDH}, booktitle = {Public-Key Cryptography -- PKC 2024}, year = {2024}, publisher = {Springer Nature Switzerland}, address = {Cham}, pages = {356--386}, isbn = {978-3-031-57725-3}, doi = {10.1007/978-3-031-57725-3_12}, } - Simple Two-Message OT in the Explicit Isogeny ModelEmmanuela Orsini and Riccardo ZanottoIACR Communications in Cryptology, 2024
In this work we study algebraic and generic models for group actions, and extend them to the universal composability (UC) framework of Canetti (FOCS 2001). We revisit the constructions of Duman et al. (PKC 2023) integrating the type-safe model by Zhandry (Crypto 2022), adapted to the group action setting, and formally define an algebraic action model (AAM). This model restricts the power of the adversary in a similar fashion to the algebraic group model (AGM). By imposing algebraic behaviour to the adversary and environment of the UC framework, we construct the UC-AAM. Finally, we instantiate UC-AAM with isogeny-based assumptions, in particular the CSIDH action with twists, obtaining the explicit isogeny model, UC-EI; we observe that, under certain assumptions, this model is "closer" to standard UC than the UC-AGM, even though there still exists an important separation. We demonstrate the utility of our definitions by proving UC-EI security for the passive-secure oblivious transfer protocol described by Lai et al. (Eurocrypt 2021), hence providing the first concretely efficient two-message isogeny-based OT protocol in the random oracle model against malicious adversaries.
@article{10.62056/a39qgy4e-, author = {Orsini, Emmanuela and Zanotto, Riccardo}, title = {Simple Two-Message {OT} in the Explicit Isogeny Model}, volume = {1}, number = {1}, year = {2024}, date = {2024-04-09}, issn = {3006-5496}, doi = {10.62056/a39qgy4e-}, journal = {{IACR} Communications in Cryptology}, publisher = {International Association for Cryptologic Research}, }
