Publications

2026

1. SafeCast: End-to-End Security for Ultra-High-Bitrate Broadcast Media

   Arman Kolozyan, Christian Knabenhans, Zayd Maradni, and Carmela Troncoso

   In , 2026

   Abs

   To address the scalability and flexibility limitations of dedicated point-to-point cabling in broadcast production, the broadcasting community created a suite of standards for carrying media over IP multicast. This shift removes the inherent physical protection that dedicated cabling provides, exposing streams to tampering and eavesdropping. Such threats have been widely reported and pose major risks to broadcasters and their audiences. Despite almost a decade of deployment, the security of IP-based broadcast has received little academic attention.
   
   We collaborate with the European Broadcasting Union (EBU) to establish the security and deployment requirements of this environment. We introduce SafeCast, a system to secure the transmission of ultra-high-bitrate multicast media. SafeCast builds on established and standardized protocols (the MLS group key agreement protocol and the SRTP media-protection protocol), while extending and adapting them to the demanding setting of broadcast media. SafeCast provides strong confidentiality and integrity guarantees, and exploits the precise clock synchronization of broadcast networks to achieve cheap per-sender authentication. We evaluate SafeCast against the stringent deployment requirements of production facilities (throughput, latency, large dynamic groups) and find that it can sustain the most common media formats with ample headroom.

2. On the (Privacy) Harms of the European Digital Identity Framework

   Christian Knabenhans, Shannon Veitch, Mathilde Raynal, Theresa Stadler, Sylvain Chatel, Wouter Lueks, and Carmela Troncoso

   In , 2026

   Abs PDF

   As digital identity systems gain traction around the world, many see privacy-enhancing technologies (PETs) as the key to ensuring safe deployment. We critically examine whether this is the case using the European Digital Identity Framework (EUDIF) as an example. We leverage techniques from cryptographic modeling to formally capture the necessary leakage of the functionality of the EUDIF and its proposed applications. Then, we develop a harm analysis methodology that illustrates, using harm trees, how this leakage — and other constraints stemming from design decisions or the context of deployment — lead to harms. Moreover, our harm modeling enables us to distinguish between which pathways to harm are inherent to the core functionality, and which pathways can be prevented with PETs. Our analysis shows that, while PETs can reduce information flows, they fall short in mitigating the harms that deploying digital identity can bring to individuals and society.

3. HE-based On-the-Fly MPC, Revisited: Universal Composability, Approximate and Imperfect Computation, Circuit Privacy

   Ganyuan Cao, Sylvain Chatel, and Christian Knabenhans

   In Asiacrypt’26, 2026

   Abs PDF

   On-the-fly multi-party computation (MPC), introduced by López-Alt, Tromer, and Vaikuntanathan (STOC 2012), enables clients to dynamically join a computation without remaining continuously online. Yet, the original proposal suffers from substantial efficiency and expressivity limitations hindering practical deployments. Even though various techniques have been proposed to mitigate these shortcomings, seeing on-the-fly MPC as a combination of independent building blocks jeopardizes the security of the original model. Thus, we revisit on-the-fly MPC in light of recent advances and extend its formal framework to incorporate efficiency and expressivity improvements. Our approach is built around multi-group homomorphic encryption (MGHE), which generalizes threshold and multi-key HE and serves as the core primitive for on-the-fly MPC. Our contributions are fourfold: i) We propose new security notions for MGHE (e.g., IND-CPA with partial decryption, circuit privacy) and justify their suitability to the on-the-fly MPC. ii) We present the first ideal functionality for MGHE in the Universal Composability (UC) framework and characterize the conditions under which it can be realized, via reductions to our proposed security notions. iii) We present a generic protocol that securely realizes our on-the-fly MPC functionality against a semi-malicious adversary from our MGHE functionality. iv) Finally, we provide two generic compilers that lift these protocols to withstand a fully malicious adversary by leveraging zero-knowledge arguments. Our analysis in the UC framework enables modular protocol analysis, where more efficient schemes can be seamlessly substituted as long as they meet the required security defined by the functionalities, retaining the security guarantees offered by the original construction.

4. Succinct Arguments from Lattice-Based Non-Interactive Linear Commitments

   Jonathan Bootle, Ziyi Guan, and Christian Knabenhans

   In TCC’26, 2026

   Abs

   Succinct arguments are often built by combining a functional interactive oracle proof with a functional commitment scheme. We focus on non-interactive lattice-based linear commitments, whose algebraic structure enables better efficiency and fewer rounds compared to the hash-based approaches, while still offering plausible post-quantum security and recursion-friendly verification.
   It is unclear whether existing lattice-based non-interactive LCs suffice for constructing succinct arguments with current techniques: these applications typically require strong guarantees such as extractability, whereas known constructions satisfy only weaker notions such as evaluation binding.
   In this work, we show that lattice-based non-interactive LCs can indeed be used to construct succinct arguments under falsifiable assumptions. Our main contributions are as follows.
   • We show that any linear commitment scheme that is both evaluation binding and homomorphic satisfies a notion called coordinate-wise function binding. We instantiate this framework with two constructions, capturing two prominent families of lattice-based non-interactive LCs: one based on the k-MISIS uber-assumption (Albrecht, Cini, Lai, Malavolta, and Thyagarajan, CRYPTO’22; Fisch, Liu, and Vesely, CRYPTO’23), and one inspired by a recent SIS-based construction of Wee (CRYPTO’25).
   • We construct a holographic linear interactive oracle proof (LIOP) for NP that is compatible with these linear commitments. Our LIOP asymptotically improves the information-theoretic proof underlying the LaBRADOR argument of Beullens and Seiler (CRYPTO’23).
   • We give a new compiler, adapted from the Funky protocol (Chiesa, Guan, Knabenhans, and Yu, CRYPTO’26), that combines functional interactive oracle proofs with functional commitments. Our compiler supports query predicates, norm-bounded IOP provers, and holography, and relies on weaker security notions from the underlying commitments that are better aligned with known lattice-based constructions.

5. On the Fiat–Shamir Security of Succinct Arguments from Functional Commitments

   Alessandro Chiesa, Ziyi Guan, Christian Knabenhans, and Zihan Yu

   In Crypto’26, 2026

   Abs HTML PDF

   We study the security of a popular paradigm for constructing SNARGs, closing a key security gap left open by prior work. The paradigm consists of two steps: first, construct a public-coin succinct interactive argument by combining a functional interactive oracle proof (FIOP) and a functional commitment scheme (FC scheme); second, apply the Fiat–Shamir transformation in the random oracle model. Prior work did not consider this generalized setting nor prove the security of this second step (even in special cases). We prove that the succinct argument obtained in the first step satisfies state-restoration security, thereby ensuring that the second step does in fact yield a succinct non-interactive argument. This is provided the FIOP satisfies state-restoration security and the FC scheme satisfies a natural state-restoration variant of function binding (a generalization of position binding for vector commitment schemes). Moreover, we prove that notable FC schemes satisfy state-restoration function binding, allowing us to establish, via our main result, the security of several SNARGs of interest (in the random oracle model). This includes a modular security proof of Plonk, in the ROM based on falsifiable Diffie–Hellman assumptions.

6. End-to-End Encrypted Collaborative Documents

   Christian Knabenhans, Zayd Maradni, and Carmela Troncoso

   In USENIX Security’26, 2026

   2026 Internet Defense Prize; USENIX Security 2026 Distinguished Paper Award runner-up Abs HTML Code

   2026 Internet Defense Prize; USENIX Security 2026 Distinguished Paper Award runner-up

   Collaborative documents (e.g., Google Docs, Microsoft 365) often contain sensitive information such as personal or financial data. In this work, we extend the protection of E2EE encryption, currently (mostly) restricted to the use case of messaging, to collaborative documents. We elicit and formalize the security and functional requirements of End-to-End Encrypted Collaborative Documents (E2EE-CD). We then put forth a generic framework to realize E2EE-CD, by combining an end-to-end encrypted asynchronous broadcast channel with any edit reconciliation mechanism which ensures globally consistent views of a document. We give formal proofs that directly relate the security of our E2EE-CD solution to the security of the underlying end-to-end encrypted communication channel. We then elicit additional deployment requirements for E2EE-CD for investigative journalists and design SignalCD, an E2EE-CD system built on top of Signal’s group messaging protocol tailored for this setting. We analyze the security guarantees of SignalCD, implement a prototype, and empirically show that our solution is efficient enough to permit real-time collaboration.

7. Humanitarian Aid Distribution with Privacy-Preserving Assessment Capabilities

   Christian Knabenhans, Lucy Qin, Justinas Sukaitis, Vincent Graf Narbel, and Carmela Troncoso

   In PETS’26, 2026

   Abs HTML Code

   In times of crisis, humanitarian organizations bring aid to those affected (e.g., water, food, medical supplies, cash assistance). Prior works introduced privacy-preserving systems for digitizing the aid distribution process, increasing their efficiency and security. These solutions, by design, do not allow humanitarian organizations to collect metrics about the aid distribution process. Such assessments (e.g., the proportion of aid distributed to a minority) are crucial to enable the organizations to improve their operations, to perform their duty of care, and to enable transparency and accountability towards recipients, donors, and the public in general. In partnership with the International Committee of the Red Cross (ICRC), we identify assessments relevant to humanitarian aid deployments and these assessments’ security and privacy requirements. We introduce a generic framework that augments existing privacy-preserving humanitarian aid distributions with such assessments. This framework enables the collection of aggregate statistics about the aid distribution process without compromising the privacy of recipients, and without requiring any changes to the existing protocols. To realize our framework we introduce one-time functional encryption (1FE), for which we propose efficient realizations from standard cryptographic primitives. We design and implement two variants of our framework: a more efficient one, secure against semi-honest adversaries; and a more robust one, secure against malicious adversaries. We also introduce the novel notions of threat model agility and graceful degradation. These notions enable us to model the unstable environment of humanitarian aid distribution, where the capabilities of the adversary may change suddenly (e.g., when a militia takes over a region in conflict), invalidating the threat model under which the system was originally deployed. We believe these notions are of independent interest for other privacy-preserving applications deployed in unstable environments.

2024

1. Lova: Lattice-Based Folding Scheme from Unstructured Lattices

   Giacomo Fenzi, Duc Tu Pham, Christian Knabenhans, and Ngoc Khanh Nguyen

   In Asiacrypt’24, 2024

   Abs HTML PDF Blog Code

   Folding schemes [(Kothapalli et al., CRYPTO 2022)](https://eprint.iacr.org/2021/370) are a conceptually simple, yet powerful cryptographic primitive that can be used as a building block to realise incrementally verifiable computation (IVC) with low recursive overhead without general-purpose non-interactive succinct arguments of knowledge (SNARK). Most folding schemes known rely on the hardness of the discrete logarithm problem, and thus are both not quantum-resistant and operate over large prime fields. Existing post-quantum folding schemes [(Boneh, Chen, ePrint 2024/257)](https://eprint.iacr.org/2024/257) based on lattice assumptions instead are secure under structured lattice assumptions, such as the Module Short Integer Solution Assumption (MSIS), which also binds them to relatively complex arithmetic. In contrast, we construct Lova, the first folding scheme whose security relies on the (unstructured) SIS assumption. We provide a Rust implementation of Lova, which makes only use of arithmetic in hardware-friendly power-of-two moduli. Crucially, this avoids the need of implementing and performing any finite field arithmetic. At the core of our results lies a new *exact* Euclidean norm proof which might be of independent interest.

2. VERITAS: Plaintext Encoders for Practical Verifiable Homomorphic Encryption

   Sylvain Chatel, Christian Knabenhans, Apostolos Pyrgelis, Carmela Troncoso, and Jean-Pierre Hubaux

   In ACM CCS’24, 2024

   Abs HTML PDF Code

   Homomorphic encryption has become a practical solution for protecting the privacy of computations on sensitive data. However, existing homomorphic encryption pipelines do not guarantee the correctness of the computation result in the presence of a malicious adversary. We propose two plaintext encodings compatible with state-of-the-art fully homomorphic encryption schemes that enable practical client-verification of homomorphic computations while supporting all the operations required for modern privacy-preserving analytics. Based on these encodings, we introduce VERITAS, a ready-to-use library for the verification of computations executed over encrypted data. VERITAS is the first library that supports the verification of any homomorphic operation. We demonstrate its practicality for various applications and, in particular, we show that it enables verifiability of homomorphic analytics with less than 3× computation overhead compared to the homomorphic encryption baseline.

3. vFHE: Verifiable Fully Homomorphic Encryption

   Christian Knabenhans, Alexander Viand, Antonio Merino-Gallardo, and Anwar Hithnawi

   In 2024 Workshop on Encrypted Computing & Applied Homomorphic Cryptography (co-located with ACM CCS), 2024

   Abs HTML PDF Code

   Fully Homomorphic Encryption (FHE) is a powerful building block for secure and private applications. However, state-of-the-art FHE schemes do not offer any integrity guarantees, which can lead to devastating correctness and security issues when FHE is deployed in non-trivial settings. In this paper, we take a critical look at existing integrity solutions for FHE, and analyze their (often implicit) threat models, efficiency, and adequacy with real-world FHE deployments. We explore challenges of what we believe is the most flexible and promising integrity solution for FHE: namely, zero-knowledge Succinct Non-interactive ARguments of Knowledge (zkSNARKs); we showcase optimizations for both general-purpose zkSNARKs and zkSNARKs designed for FHE. We then present two software frameworks, circomlib-FHE and zkOpenFHE, which allow practitioners to automatically augment existing FHE pipelines with integrity guarantees. Finally, we leverage our tools to evaluate and compare different approaches to FHE integrity, and discuss open problems that stand in the way of a widespread deployment of FHE in real-world applications.

4. Holding Secrets Accountable: Auditing Privacy-Preserving Machine Learning

   Hidde Lycklama, Alexander Viand, Nicolas Küchler, Christian Knabenhans, and Anwar Hithnawi

   In USENIX Sec’24, 2024

   Abs HTML PDF Code

   Recent advancements in privacy-preserving machine learning are paving the way to extend the benefits of ML to highly sensitive data that, until now, have been hard to utilize due to privacy concerns and regulatory constraints. Simultaneously, there is a growing emphasis on enhancing the transparency and accountability of machine learning, including the ability to audit ML deployments. While ML auditing and PPML have both been the subjects of intensive research, they have predominately been examined in isolation. However, their combination is becoming increasingly important. In this work, we introduce Arc, an MPC framework for auditing privacy-preserving machine learning. At the core of our framework is a new protocol for efficiently verifying MPC inputs against succinct commitments at scale. We evaluate the performance of our framework when instantiated with our consistency protocol and compare it to hashing-based and homomorphic-commitment-based approaches, demonstrating that it is up to 10⁴× faster and up to 10⁶× more concise.