cryptographic protocol developers

Abstract: This monograph develops finite field theory through root sets, Frobenius orbits, trace duality, and cyclic modules, with applications to polynomial constructions and algebraic coding theory. Root-set descent and base extension are expressed through finite reduced algebras, while linearized polynomials connect normal bases, invariant subspaces, and linear recurrences. Coefficient pairings and derivative formulas recover information lost by trace pairings in quotient algebras with repeated factors. Cyclotomic cosets are studied through additive stabilizers, power substitution, and compatible factor lifting, including extensions to Galois rings. A central theme connects low-degree representations of subfields with conjugate root blocks, polynomial composition, and recovery from relative trace data. Return maps on root fibers determine factor degrees and organize constructions of irreducible polynomials, affine symmetries, and permutation polynomials. Applications include cyclic and constacyclic codes, BCH and Goppa distance bounds, rank-metric codes, trace codes, and Fourier support. Character orthogonality and Gauss and Jacobi sums yield counting formulas, a proof of the primitive normal basis theorem, and recurrences for extension-field character sums. Gaussian periods connect these methods with short linear relations in multiplicative subgroups. Proofs of Weil bounds for polynomial character sums combine auxiliary polynomials with generating polynomials and estimates for their reciprocal roots. The emphasis throughout is on explicit arguments connecting field structure, orbit structure, and linear dependence.

Abstract: Boolean functions are widely used in cryptography and coding theory. A key challenge lies in finding the weight spectrum for all $n$-variable Boolean functions of degree at most $r$, also known as the Reed--Muller code $\RM(r,n)$. In 2023, Carlet and Solé determined the weight spectra of $\RM(n-c,n)$ for $c=3,4$, and conjectured the weight spectrum of $\RM(n-c, n$) for $n\ge2c$. The weight spectra of $\RM(n-5, n)$ and $\RM(n-6,n)$ were determined by Carlet in 2024 and by Lou and Wang in 2025, respectively, confirming the Carlet-Solé conjecture for the cases $c=5,6$. Very recently, Leuenberger et al. and Wei et al. investigated the weight spectrum of $\RM(7,14)$ independently, and there are eight potential weights which have not been determined. Up until now, the weight spectra of the Reed--Muller codes $RM(r,n)$ are still unknown for $r=3,...,n-7$. In this paper, we determine the exact weight spectrum of $\RM(m-7, m)$ for every $m\ge 14$. By combining affine geometry and Fourier analysis, we exclude the conjectured eight weights for $\RM(7,14)$. We then extend the exclusions to all higher dimensions using a geometric transfer. Consequently, we provide a counterexample to the Carlet-Solé conjecture.

Abstract: At CRYPTO 2007, Damgård and Nielsen introduced a preprocessing approach to multi-party computation (MPC) to achieve linear communication complexity. Another approach to reduce communication complexity was proposed by Cramer, Damgård, and de Haan at EUROCRYPT 2007, which involved using ramp-secret sharing schemes to jointly share base-field components of secrets from the extension field. In this paper, we combine these two ideas to achieve a non-asymptotic reduction of communication cost in a multi-phase MPC setup. We introduce a new modification of the ramp secret sharing scheme, called compact sharing, and tailor the MPC protocol to accommodate this modification. Compact sharing masks the polynomial coefficients that would otherwise leak during degree reduction. The protocol provides perfect security against static semi-honest adversaries under an explicit tradeoff between the corruption threshold and the extension degree. When the extension degree scales linearly with the number of parties, the gate-evaluation core achieves constant communication overhead relative to an extension-field element, amortized over full preprocessing batches; input and output communication is counted separately.

Abstract: Hidden randomized rounding couples the privacy loss of successive integer releases. We study a rational-feedback mechanism under predictable signed-unit participation and full observation of every physical output. A preparation's lifetime connects three results. First, preserving complete carries until an observed echo synchronizes the worlds gives exact finite-law point compilation, with support-width exponent $3C-2$ at every fixed budget $C\ge2$. Second, releasing commitments earlier gives a monotone hierarchy whose exact endpoint, strict gaps and numerical brackets quantify calibration loss. At one fixed discrete Gaussian, a loss allowance of 0.09 requires all four commitments. Third, legal regeneration yields an unrestricted KL rate with a square-root testing remainder and a complete asymptotic frontier under joint physical-time and participation constraints. At fixed rational parameters, finite-window occupation programs approximate that frontier to error $2^{-b}$ in polynomial bit time in $b$. Verified countable-transcript semantics and independently checked finite certificates support these analyses. A matched static workload illustrates the resulting design tradeoff: a structured finite integer matrix improves error and fresh randomness, while the scalar feedback instance retains fewer noise-state and source-table bits.

Abstract: We study quantum-state oblivious transfer over the quantum erasure channel under information-theoretic security guarantees. Specifically, Alice holds two quantum systems, Bob wishes to recover one of them, and the parties have access to independent channel uses and authenticated public classical communication, with no initial shared entanglement. We consider both honest-but-curious and malicious behavior. We establish finite-blocklength converse and achievability bounds, which match in the honest-but-curious setting. The malicious setting construction combines interactive hashing with tests of whether Bob received selected channel outputs, and distributes each input across several qubits so that erasures conceal an entire input from a dishonest receiver, even when the inputs are entangled with an external reference. We also derive fixed-error asymptotic expansions and show that both malicious and honest-but-curious settings have the same capacity.

Abstract: The security of keyed modulation is often argued from the key-space size and the error rate of a key-less receiver. This evidence fails when the key is reused and the waveform is harmonically coupled. For a phase-keyed Fourier-curve constellation, whose $k$ tones share one data parameter, integer relations among the harmonic indices yield data-cancelling mixed moments of the received tones that expose key characters. A modular relation lattice characterizes the exposed characters; for consecutive harmonics, third-order moments recover the relative phases and a fourth-order moment completes the key up to cyclic relabeling whenever its coefficient is nonzero, as in all evaluated settings. A non-data-aided relation-moment estimator turns this leakage into an attack that never enumerates the key space. On a regular $(3,6)$ LDPC-coded link, one key per 168-symbol codeword leaves the eavesdropper a block error rate below $0.04$ at the middle noise level, and the attack meets a predeclared $0.1$ compromise criterion in eleven of twelve operating points. Tangent artificial noise and a harmonic set without relations below order four raise her measured error rate at intermediate reuse lengths but do not remove the one-codeword vulnerability. For a grid of $2^{128}$ protocol keys at the middle noise level, equal-length refresh schedules that keep a $95\%$ lower confidence bound of her block error rate above $0.9$ consume at least $1.52$ fresh key bits per information bit, $1.52$ times the entropy rate of a one-time pad on the data.

Abstract: We prove a lifting theorem from two-party public-coin one-way communication to multiparty public-coin one-way number-on-forehead (NOF) communication. For every fixed $k\ge2$ and prime $q>2k$, there is a generalized inner product gadget $\GIP_{q,r}^k:(\F_q^r)^k\to\F_q$ with $r=O_k(q/\log q)$ such that, for every partial Boolean function $f:D\to\bits$, where $D\subseteq\F_q\times\F_q$, \[ R_{1/3}^1(f)-O(1) \le R_{1/6}^{1,\NOF}\bigl(f\circ\GIP_{q,r}^k\bigr) \le R_{1/6}^1(f). \] Thus, composition with the gadget preserves one-way randomized communication complexity up to an additive constant and a change in the error parameter. The lower bound holds in the general one-way NOF model, where the last player sees the entire gadget input. This extends the deterministic one-way NOF lifting theorem of Yang and Zhang to randomized protocols, and extends the randomized lifting result of Wang and Wu from the conservative model to the general one-way NOF model. Our proof introduces a one-way cylinder partition bound that lower bounds public-coin one-way NOF communication complexity. We show that, for the lifted function, this bound is at least half the one-way partition bound of the outer function. The main technical step transfers a dual solution between the two bounds, using Möbius inversion and a discrepancy estimate for generalized inner product to control the loss. Combining this transfer with the characterization of two-party one-way randomized communication complexity by the one-way partition bound yields the lifting theorem.

Abstract: Let $X$ be uniform on $\{-1,1\}^n$, let $Y$ be obtained by passing its coordinates independently through a binary symmetric channel with crossover probability $p$, and let $g:\{-1,1\}^n\to\{0,1\}$ be a Boolean function. We give a computer-assisted proof of the Courtade--Kumar conjecture $I(g(X);Y)\le1-H_2(p)$, where $H_2$ is binary entropy, with equality attained by dictator functions. The present work builds on the differential-equation method, itself a limiting form of the auxiliary-receiver approach in network information theory using a continuum of degraded receivers. The proof proceeds from a local inequality to a dimension-independent bound on entropy production. Differentiation along the Boolean noise semigroup expresses entropy production as an average of edge costs. The key estimate is therefore an unrestricted Bellman inequality with two mean constraints and two entropy constraints, allowing arbitrary couplings of the edge variables. This paper and its supplement provide the proofs and computational verification records. The document is lengthy because it is designed to be entirely self-contained, deriving all proofs from first principles and reproducing the proofs of cited results. The supplementary material supporting the computer-assisted parts of the proof are available online.

Abstract: Linear complementary pairs (LCPs) and linear complementary dual (LCD) codes have important applications in orthogonal direct-sum masking (ODSM), which provides effective countermeasures against side-channel attacks and fault-injection attacks. While LCD codes have been extensively investigated, comparatively fewer results are available for general LCPs. In this paper, we further investigate LCPs of twisted Reed--Solomon (TRS) codes. We derive necessary conditions for two TRS codes to form an LCP and establish several sufficient conditions and explicit constructions. We also study LCD codes constructed from TRS codes and investigate the security parameters of the resulting LCPs. Furthermore, under suitable conditions, we obtain MDS LCPs of TRS codes.

Abstract: We certify an honest-decapsulation failure upper bound for ML-KEM-768 in an explicit random-function/centered-binomial (ROM/CBD) abstraction. Domain-separated public-matrix streams are modeled as independent uniform ring elements and secret/noise polynomials as independent CBD2 primitives; this is not an information-theoretic statement about the fixed SHAKE instantiation of FIPS 203. Recent formal assessments identify rigorous justification of ML-KEM's heuristic decapsulation-failure scale as an open problem; within the explicit ROM/CBD abstraction studied here, we obtain a dependency-preserving certified upper bound at that scale. The analysis preserves dependencies induced by the public matrix and by both ciphertext-compression terms. Its terminal chain has three components: an exact graph-coupled full-ideal reference for the joint c_u/c_v residual; a proper-ideal bivariate Fourier transport whose rare |T|>=3 branch is closed by an exhaustive three-factor anti-concentration replay; and exact bit-specific FIPS decoding events followed only by a 256-coordinate union bound. A formal partial-Fourier lemma makes the spectral-to-total-variation step explicit. The reduced rational certificate satisfies Pr[K' != K] <= P_* <= 2^-164.81, with -log2(P_*) = 164.810716201343121.... The 164.81 threshold is exact but numerically tight: the certified exponent exceeds it by only about 0.0007162 bit, and 164.82 is not certified. The result is an upper bound for an arbitrary message fixed independently of the public and secret randomness, under honest encryption and decapsulation. It is not an exact DFR, not a fixed-SHAKE equivalence theorem, not a new IND-CCA reduction, and not an adaptive delta-correctness result.