4 September 2026, ETH Zürich

The sixth Swiss Crypto Day will be held at ETH Zürich on Friday, September 4th, 2026.

To participate at the event, please register here. The registration closes on Friday, August 21. There is no participation fee.

Venue

Swiss Crypto Day 2026 will be held in the Computer Science Department at ETH Zürich, Building CAB, Room G 11 (Universitätstrasse 6, 8006 Zürich). Take the main entrance of the CS building CAB from Universitätstrasse and go up one flight of stairs to find the registration desk and the lecture hall.

Arriving by train, take tram 6 or 10 from Zurich HB to stop “ETH/Universitätsspital”. Alternatively, you can enjoy a ride with the Polybahn ropeway.

Program

10:00		Registration & Welcome Coffee
10:30		Opening Remarks
10:45		Stefano Tessaro (University of Washington)
		Pairing-Free Blind Signatures with Best-Possible Round Complexity
		Blind signatures have attracted substantial interest because of their role in practical privacy-preserving protocols. A particularly appealing goal is to construct them over elliptic-curve groups while retaining compatibility with widely deployed libraries and standards. This motivates avoiding groups equipped with pairings and using the underlying group in a black-box manner, without resorting to non-black-box zero-knowledge or secure multiparty computation techniques. Designing such pairing-free blind signatures, however, has proved very challenging. The most efficient three-move constructions rely on the algebraic group model, while pairing-free constructions whose security does not depend on an idealized group model require at least four moves. In this talk, I will present two complementary results that together clarify the round complexity of pairing-free blind signatures. The first is an impossibility result. Subject to certain structural restrictions, we show that no round-optimal (namely, two-move) blind signature scheme can be obtained by making black-box use of an underlying pairing-free group, even when the construction may additionally use a random oracle. The result applies to a broad class of natural construction paradigms and confirms that two-move schemes are likely out of reach without resorting to generic non-black-box techniques. The second result is constructive. We give the first three-move blind signature scheme that makes black-box use of a pairing-free group and whose security can be proved in the random-oracle model without relying on an idealized group model. Its security is based on the standard decisional Diffie–Hellman assumption. These are joint works with Marian Dietz and Julia Kastner, and with Rutchathon (Champ) Chairattana-apirom and Michael Reichle, both appearing at CRYPTO 2026.
11:30		Matilda Backendal (Università della Svizzera italiana)
		Directions in Applied Cryptography
		Cryptography is not just a fascinating research topic, but a technology that plays a crucial role in securing infrastructure and protecting people’s privacy. ‘Applied cryptography’ is the study of these real-world uses of cryptography. In this talk, I will tell you about two directions in applied cryptography that currently excite me. Along the way, we will explore where the gap between theory and practice arises, how not to do applied crypto research, what we can learn from the social sciences, and why you should write fewer papers.
12:00		Short Talks Session I (10 minutes per talk)
		Marc Ilunga (Trail of Bits): Informalizing Cryptographic Proofs
		Provable security is vital to modern cryptography. Most proofs are handwritten, which is an error-prone process. Recent advances in large language model (LLM)-assisted autoformalization suggest a diminishing cost of producing machine-checked proofs. However, these proofs are often unreadable, fail to convey intuition, and require specialized tool expertise. As automated tools play a greater role in proof discovery and verification, a question arises: does the cryptographer’s role become limited to validating theorem statements, at the expense of the deeper, more intuitive understanding afforded by manual proofs? We argue that this need not be the case. This talk introduces an initial experiment aimed at making formal cryptographic proofs more accessible. We adapt Massot and Miller’s informalization project, originally designed for mainstream mathematics, to the field of cryptography. As a case study, we use LLMs to formalize and subsequently informalize Maurer’s proof that CBC is a good randomness expander, partially formalizing the underlying random systems methodology in the Lean proof assistant. The approach does not yet scale to more complex cryptographic proofs. We present it to stimulate discussion of proof methodologies that offer strong correctness guarantees while preserving understanding.
		Patrick Towa ([[alloc] init]): Implementable Witness Encryption from Arithmetic Affine Determinant Programs
		Existing witness-encryption schemes for all NP unfortunately suffer from ciphertext sizes that are too large to be stored in practice. As ciphertext sizes generally grow with witness sizes, combining witness encryption with SNARKs should in principle yield succinct witnesses. However, embedding general-purpose SNARK verification into existing witness-encryption schemes leads to a prohibitive overhead in terms of ciphertext sizes or of encryption and decryption times, or both. We introduce affine determinant programs (AADPs), a variant of affine determinant programs designed to natively support arithmetic constraint systems. SNARK verification can now be directly expressed in constraint systems. To address security challenges that arise from standard constraint systems like R1CS, we define projective safety, a property that we require the constraint systems to satisfy. We then design constraint systems which satisfy this property, express the verification of a tailored SNARK for all NP, and construct a WE scheme for it. We discuss attacks on an initial construction in the case of sparse circuits that are based on matrix commutators, and propose a mitigations that stems from quadratic-arithmetic programs and argue for its security. The resulting ciphertexts are on the order of 8TB at 100-bit security, which is to the best of our knowledge the instantiation of WE for general NP with the smallest ciphertext sizes by several orders of magnitude.
		Andrea Caforio (lowRISC C.I.C.): Assembling Lattices: Secure and Efficient PQC in OpenTitan
		We describe the design of the OpenTitan post-quantum cryptography accelerator which powers our open-source implementation of ML-DSA, which is fast enough for performance-critical protocols (e.g., secure boot) and resource-optimized to the point where it can run in extremely memory-constrained environments. At the same time, it offers complete first-order security against side-channel attacks and comprehensive fault injection hardening that makes the implementation ready for an industrial security certification. In particular, we detail how a novel vectorized instruction-set extension (SIMD) offers superior throughput for lattice arithmetic and how giving our accelerator direct access to an existing hardware implementation of SHA accelerates the various sampling routines in ML-DSA. We introduce the Masking Accelerator Interface (MAI), the first formally and empirically verified open-source hardware accelerator for operations that typically arise in masked lattices and show how the MAI aids us in achieving first-order security before diving into the concepts behind securing PQC algorithms against fault injections. Lastly, our talk offers a rare glimpse into the often shrouded realm of commercial cryptography and its preparations for protecting security-relevant hardware in a post-quantum world.
12:35		Lunch Break
14:00		Andrea Basso (IBM Research Zurich)
		SQIsign in Round 3: Design, Security, and Open Problems
		SQIsign is the only isogeny-based candidate in NIST’s Additional Digital Signatures standardisation process. It offers the smallest combined public-key and signature size among the remaining candidates and is more than an order of magnitude more compact than standardised lattice-based signature schemes. SQIsign recently advanced to the third round of the NIST process. In this talk, we will give an accessible overview of how SQIsign works and trace its evolution throughout the standardisation effort. We will begin with the substantial redesign introduced in the Round 2 submission, which resulted in major performance improvements and a cleaner security analysis. We will then focus on the Round 3 updates, which incorporate lessons from the previous rounds as well as recent advances in the algorithmic design and security analysis of the scheme. Finally, we will discuss the main open problems surrounding SQIsign, including the development of efficient constant-time implementations.
14:30		Chiara Spadafora, Audhild Hoegaasen (Swiss Post)
		When Cryptography Meets Reality: Insights from the Swiss Post E‑Voting Protocol
		How do cryptography and real-world constraints meet in an e-voting system? The first focus of the talk is the e-voting protocol currently deployed by some Swiss cantons, enabling citizens to securely cast their votes online in legally binding elections since 2023. We then move from the present to the near future, detailing the new protocol under development. The new protocol further strengthens the security and verifiability of Swiss e-voting by generating voter material in a distributed manner, thereby reducing the necessary trust assumptions on protocol participants. Throughout the talk, we keep a close eye on practical constraints: how the Federal Ordinance on electronic voting shapes trust assumptions and transparency requirements, and how operational procedures influence the generation of election parameters and the verification of protocol steps. We also show how these requirements affect system design choices, deployment procedures, and the practical interpretation of security guarantees. We also address usability and accessibility, discussing how the voting process can become understandable and verifiable for all voters.
14:55		Short Talks Session II (10 minutes per talk)
		Silvia Sconza (University of Zurich): ORCAS - An Efficient Adaptor Signature based on CSI-FiSh
		An adaptor signature is a variant of a digital signature that embeds a secret into the signing process, generating a pre-signature. The resulting pre-signature can be turned into a valid signature only by someone who knows that secret, and in doing so, the secret becomes publicly extractable. A typical use case is the atomic swap, which allows two parties who do not trust each other to safely exchange digital assets without relying on a trusted third party. We present One-Round “Cheating” Adaptor Signatures (ORCAS), a novel and efficient construction based on CSI-FiSh. Our protocol offers significant improvements over previous proposals: unlike IAS (Tairi et al., FC 2021), it avoids costly non-interactive zero-knowledge proofs, and unlike adaptor MCSI-FiSh (Jana et al., CANS 2024), it does not require modifying the underlying digital signature scheme. This is a joint project with Ryann Cartor, Nathan Daly, Giulia Gaggero, Jason T. LeGrow and Andrea Sanguineti
		Sina Schaeffler (IBM Research Zurich, ETH Zurich): MIKE: a fast and compact post-quantum NIKE
		While many primitives have today good post-quantum instantiations, the search of a quantum-safe replacement for ECDH as a non-interative key exchange (NIKE) gave no fully satisfactory result so far. This talk presents MIKE: a compact, efficient and actively secure isogeny-based NIKE built on the action of a monoid. We show how we transformed a mathematical idea (as introduced in ia.cr/2024/1556) into a secure and practical scheme with a security proof and an efficient constant-time implementation. Authors: Andrea Basso, Pierrick Dartois, Max Duparc, Jonathan Komada Eriksen, Sabrina Kunzweiler, Michael Meyer, Giacomo Pope, Krijn Reijnders, Damien Robert, Ryan Rueger, Sina Schaeffler
		Florias Papadopoulos (University of St. Gallen): Privacy-preserving Proximity Testing from Geometric Fuzzy Matching
		Proximity testing is crucial to location-privacy applications, from discovering nearby friends to enabling UAV collision avoidance. In such settings, users must determine proximity without revealing their exact locations. This motivates privacy-preserving proximity testing (PPPT) protocols revealing only if the proximity condition holds, while hiding both parties’ inputs. However, most existing PPPT protocols rely on strong assumptions (e.g., non-colluding servers) or require simultaneous interaction, limiting their practicality. Moreover, they typically define proximity using metric distances (e.g., Euclidean distance), failing to support richer membership queries for complex regions like buildings or parks. To address these, we introduce a new primitive called Geometric Fuzzy Matching (GFM), which generalizes fuzzy matching to arbitrary n-dimensional regions. In GFM, the receiver specifies a region and learns only whether the sender’s location lies within it, without revealing either party’s input. This approach captures both classical distance-based proximity checks (for any Minkowski ℓp norm, 1 ≤ p ≤ ∞), as well as membership tests for complex regions, providing a unified framework for diverse proximity queries. Based on joint work with Ioannis Katis and Katerina Mitrokotsa, published at ACM AsiaCCS2026.
15:30		Coffee Break
16:00		Emanuele Giunta (ETH Zurich)
		The Magic of Trapdoor Hash Functions
		Trapdoor Hash Functions, introduced by Döttling et al. in 2019, have in recent years become a central tool in several branches of cryptography. Applications range from the realization of compact rate-1 primitives to correlation-intractable hash functions and homomorphic secret sharing. Furthermore, they are efficiently realizable under most standard public-key assumptions, thus serving as a general interface. In this talk, I will give a friendly introduction to trapdoor hash functions and navigate through simple yet insightful constructions made possible by this abstraction.

Sponsors

Mailing list

To subscribe to the mailing list, please visit list.inf.unibe.ch or send an empty email to: swisscryptoday-join@list.inf.unibe.ch.