Bibliography

Every source cited on the box pages (360 in total), with the pages that cite it. Metadata comes from Crossref, the IACR ePrint archive, arXiv, the RFC Editor and the EIPs repository.

0xPARC. zk-bug-tracker: a community-maintained collection of bugs and exploits in ZK systems. 2022. github.com/0xPARC/zk-bug-tracker

Cited on: ZK circuits are sound and bug-free

1inch. A vulnerability disclosed in Profanity, an Ethereum vanity address tool. 1inch blog, 2022. blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool

Cited on: Good randomness

David Adrian, Karthikeyan Bhargavan, Zakir Durumeric et al. Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, 2015. doi:10.1145/2810103.2813707

Cited on: Discrete log in F_q*

Carlos Aguilar-Melchor, Olivier Blazy, Jean-Christophe Deneuville et al. Efficient Encryption From Random Quasi-Cyclic Codes. IEEE Transactions on Information Theory, 2018. doi:10.1109/tit.2018.2804444

Cited on: HQC, Quasi-cyclic structure gives no shortcut

M. Ajtai. Generating hard instances of lattice problems (extended abstract). Proceedings of the twenty-eighth annual ACM symposium on Theory of computing - STOC '96, 1996. doi:10.1145/237814.237838

Cited on: Lattice problems: approx-SVP, BDD, Module-SIS

Mustafa Al-Bassam, Alberto Sonnino and Vitalik Buterin. Fraud and Data Availability Proofs: Maximising Light Client Security and Scaling Blockchains with Dishonest Majorities. arXiv:1809.09044, 2018. arxiv.org/abs/1809.09044

Cited on: Reed-Solomon blob extension

Gorjan Alagic, Daniel Apon, David Cooper et al. Status report on the third round of the NIST Post-Quantum Cryptography Standardization process. National Institute of Standards and Technology (U.S.), 2022. doi:10.6028/NIST.IR.8413-upd1

Cited on: Rainbow, SIKE

Gorjan Alagic, Maxime Bros, Pierre Ciadoux et al. Status report on the fourth round of the NIST post-quantum cryptography standardization process. National Institute of Standards and Technology (U.S.), 2025. doi:10.6028/NIST.IR.8545

Cited on: HQC, Quasi-cyclic structure gives no shortcut

Martin R. Albrecht, Daniel J. Bernstein, Tung Chou and Carlos Cid. Classic McEliece: conservative code-based cryptography. Classic McEliece team, 2022. classic.mceliece.org

Cited on: Classic McEliece, Niederreiter with Reed-Solomon codes

M. Alekhnovich. More on average case vs approximation complexity. 44th Annual IEEE Symposium on Foundations of Computer Science, 2003. Proceedings.. doi:10.1109/sfcs.2003.1238204

Cited on: LPN

Apple. Combining Machine Learning and Homomorphic Encryption in the Apple Ecosystem. Apple Machine Learning Research, 2024. machinelearning.apple.com/research/homomorphic-encryption

Cited on: Fully homomorphic encryption

Benny Applebaum, Boaz Barak and Avi Wigderson. Public-key cryptography from different assumptions. Proceedings of the forty-second ACM symposium on Theory of computing, 2010. doi:10.1145/1806689.1806715

Cited on: Sparse noisy linear equations

Apple Security Engineering and Architecture. iMessage with PQ3: The new state of the art in quantum-secure messaging at scale. Apple Security Research, 2024. security.apple.com/blog/imessage-pq3

Cited on: ML-KEM (Kyber)

R. Arends, R. Austein, M. Larson et al. DNS Security Introduction and Requirements. RFC 4033, 2005. rfc-editor.org/rfc/rfc4033

Cited on: You have the right public key, DNSSEC

R. Arends, R. Austein, M. Larson et al. Resource Records for the DNS Security Extensions. RFC 4034, 2005. rfc-editor.org/rfc/rfc4034

Cited on: DNSSEC

Gal Arnon, Alessandro Chiesa, Giacomo Fenzi and Eylon Yogev. STIR: Reed-Solomon Proximity Testing with Fewer Queries. Advances in Cryptology – CRYPTO 2024. doi:10.1007/978-3-031-68403-6_12

Cited on: FRI proximity-gap conjectures, FRI proximity-gap conjectures

Gal Arnon, Alessandro Chiesa, Giacomo Fenzi and Eylon Yogev. WHIR: Reed–Solomon Proximity Testing with Super-Fast Verification. IACR Cryptology ePrint Archive, Paper 2024/1586. eprint.iacr.org/2024/1586

Cited on: FRI proximity-gap conjectures, FRI proximity-gap conjectures

devp2p authors. The RLPx Transport Protocol. ethereum/devp2p, 2019. github.com/ethereum/devp2p/blob/master/rlpx.md

Cited on: Computational DH, Node identity and handshakes, P2P network, P2P transport encryption

libp2p authors. noise-libp2p: Secure Channel Handshake. libp2p/specs, 2020. github.com/libp2p/specs/blob/master/noise/README.md

Cited on: Node identity and handshakes, P2P network, P2P transport encryption

Ethereum consensus-specs authors. SimpleSerialize (SSZ) (consensus-specs v1.5.0). ethereum/consensus-specs, 2020. github.com/ethereum/consensus-specs/blob/v1.5.0/ssz/simple-serialize.md

Cited on: SHA-256 is secure, SSZ Merkleization

Ethereum consensus-specs authors. Phase 0: The Beacon Chain (consensus-specs). ethereum/consensus-specs, 2020. github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md

Cited on: BLS signatures, co-CDH on BLS12-381, Honest stake, RANDAO, SHA-256 is secure, SSZ Merkleization

Ethereum consensus-specs authors. Phase 0: Weak Subjectivity Guide. ethereum/consensus-specs, 2020. github.com/ethereum/consensus-specs/blob/master/specs/phase0/weak-subjectivity.md

Cited on: Consensus and finality, Recent trusted checkpoint

devp2p authors. Node Discovery Protocol v5. ethereum/devp2p, 2021. github.com/ethereum/devp2p/blob/master/discv5/discv5.md

Cited on: Node identity and handshakes, P2P network, P2P transport encryption

Ethereum consensus-specs authors. Altair Light Client: Sync Protocol. ethereum/consensus-specs, 2021. github.com/ethereum/consensus-specs/blob/master/specs/altair/light-client/sync-protocol.md

Cited on: Light clients and bridges, Recent trusted checkpoint

Ethereum consensus-specs authors. Deneb: Networking (consensus-specs). ethereum/consensus-specs, 2024. github.com/ethereum/consensus-specs/blob/master/specs/deneb/p2p-interface.md

Cited on: Blobs and data availability

Ethereum consensus-specs authors. Deneb: Polynomial Commitments (consensus-specs v1.5.0). ethereum/consensus-specs, 2024. github.com/ethereum/consensus-specs/blob/v1.5.0/specs/deneb/polynomial-commitments.md

Cited on: Fiat-Shamir holds with real hashes

Razvan Barbulescu and Sylvain Duquesne. Updating Key Size Estimations for Pairings. Journal of Cryptology, 2019. doi:10.1007/s00145-018-9280-5

Cited on: q-type / knowledge assumptions, Discrete log on pairing curves, Discrete log on pairing curves

Elaine Barker. Recommendation for key management: part 1 - general. National Institute of Standards and Technology, 2020. doi:10.6028/NIST.SP.800-57pt1r5

Cited on: Discrete log in F_q*

R. Barnes, K. Bhargavan, B. Lipp and C. Wood. Hybrid Public Key Encryption. RFC 9180, 2022. rfc-editor.org/rfc/rfc9180

Cited on: ECIES / HPKE

R. Barnes, B. Beurdouche, R. Robert et al. The Messaging Layer Security (MLS) Protocol. RFC 9420, 2023. rfc-editor.org/rfc/rfc9420

Cited on: ECIES / HPKE

Donald Beaver. Efficient Multiparty Protocols Using Circuit Randomization. Advances in Cryptology — CRYPTO ’91, 1991. doi:10.1007/3-540-46766-1_34

Cited on: Dealer-assisted MPC, Trusted dealer

Carl Beekhuizen. ERC-2335: BLS12-381 Keystore. Ethereum Request for Comments (Review), 2019. eips.ethereum.org/EIPS/eip-2335

Cited on: Key storage, Validator keystores (EIP-2335)

Carl Beekhuizen. ERC-2333: BLS12-381 Key Generation. Ethereum Request for Comments (Review), 2019. eips.ethereum.org/EIPS/eip-2333

Cited on: Wallet seeds: BIP-39 / BIP-32

Carl Beekhuizen, Ulaş Erdoğan and Doğan Alpaslan. EIP-7951: Precompile for secp256r1 Curve Support. Ethereum Improvement Proposals (Final), 2025. eips.ethereum.org/EIPS/eip-7951

Cited on: P-256 ECDSA (passkeys)

Mihir Bellare and Silvio Micali. Non-Interactive Oblivious Transfer and Applications. Advances in Cryptology — CRYPTO’ 89 Proceedings, 1989. doi:10.1007/0-387-34805-0_48

Cited on: Decisional DH, Oblivious transfer

Mihir Bellare and Phillip Rogaway. Optimal asymmetric encryption. Advances in Cryptology — EUROCRYPT'94, 1994. doi:10.1007/bfb0053428

Cited on: RSA-OAEP encryption

Mihir Bellare and Phillip Rogaway. The Exact Security of Digital Signatures-How to Sign with RSA and Rabin. Advances in Cryptology — EUROCRYPT ’96, 1996. doi:10.1007/3-540-68339-9_34

Cited on: RSA signatures

Mihir Bellare, Ran Canetti and Hugo Krawczyk. Keying Hash Functions for Message Authentication. Advances in Cryptology — CRYPTO ’96, 1996. doi:10.1007/3-540-68697-5_1

Cited on: AES, ChaCha20, HMAC are PRFs, HMAC, HKDF

Mihir Bellare. New Proofs for NMAC and HMAC: Security without Collision Resistance. Journal of Cryptology, 2015. doi:10.1007/s00145-014-9185-x

Cited on: HMAC, HKDF

S.M. Bellovin and M. Merritt. Encrypted key exchange: password-based protocols secure against dictionary attacks. Proceedings 1992 IEEE Computer Society Symposium on Research in Security and Privacy. doi:10.1109/risp.1992.213269

Cited on: PAKEs

Michael Ben-Or and Avi Wigderson. Completeness theorems for non-cryptographic fault-tolerant distributed computation. Proceedings of the twentieth annual ACM symposium on Theory of computing - STOC '88, 1988. doi:10.1145/62212.62213

Cited on: Honest majority, MPC, honest majority, Private channels

Eli Ben-Sasson, Alessandro Chiesa, Matthew Green et al. Secure Sampling of Public Parameters for Succinct Zero Knowledge Proofs. 2015 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2015.25

Cited on: Trusted setup

Eli Ben-Sasson, Alessandro Chiesa and Nicholas Spooner. Interactive Oracle Proofs. Theory of Cryptography, 2016. doi:10.1007/978-3-662-53644-5_2

Cited on: STARK verifiers, Fiat-Shamir holds with real hashes, STARKs / hash-based SNARKs

Eli Ben-Sasson, Iddo Bentov, Yinon Horesh and Michael Riabzev. Fast Reed-Solomon Interactive Oracle Proofs of Proximity. ICALP 2018, LIPIcs 107. drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ICALP.2018.14

Cited on: FRI proximity-gap conjectures, FRI proximity-gap conjectures

Eli Ben-Sasson, Dan Carmon, Yuval Ishai et al. Proximity Gaps for Reed–Solomon Codes. 2020 IEEE 61st Annual Symposium on Foundations of Computer Science (FOCS). doi:10.1109/focs46700.2020.00088

Cited on: FRI proximity-gap conjectures, FRI proximity-gap conjectures

Eli Ben-Sasson, Dan Carmon, Ulrich Haböck et al. On Proximity Gaps for Reed–Solomon Codes. IACR Cryptology ePrint Archive, Paper 2025/2055. eprint.iacr.org/2025/2055

Cited on: FRI proximity-gap conjectures, FRI proximity-gap conjectures

C.H. Bennett, G. Brassard, C. Crepeau and U.M. Maurer. Generalized privacy amplification. Proceedings of 1994 IEEE International Symposium on Information Theory. doi:10.1109/isit.1994.394668

Cited on: Randomness extractors

Charles H. Bennett and Gilles Brassard. Quantum cryptography: Public key distribution and coin tossing. Theoretical Computer Science, 2014. doi:10.1016/j.tcs.2014.05.025

Cited on: Public-key encryption / two-message key exchange exist, Quantum key distribution

E. Berlekamp, R. McEliece and H. van Tilborg. On the inherent intractability of certain coding problems (Corresp.). IEEE Transactions on Information Theory, 1978. doi:10.1109/tit.1978.1055873

Cited on: Syndrome decoding

David Bernhard, Olivier Pereira and Bogdan Warinschi. How Not to Prove Yourself: Pitfalls of the Fiat-Shamir Heuristic and Applications to Helios. Advances in Cryptology – ASIACRYPT 2012. doi:10.1007/978-3-642-34961-4_38

Cited on: Fiat-Shamir holds with real hashes

Daniel J. Bernstein. The Poly1305-AES Message-Authentication Code. Fast Software Encryption, 2005. doi:10.1007/11502760_3

Cited on: One-time MACs

Daniel J. Bernstein. Curve25519: New Diffie-Hellman Speed Records. Public Key Cryptography - PKC 2006. doi:10.1007/11745853_14

Cited on: ECDH / X25519, ECDLP

Daniel J. Bernstein. ChaCha, a variant of Salsa20. SASC 2008. cr.yp.to/chacha/chacha-20080128.pdf

Cited on: AES, ChaCha20, HMAC are PRFs, Block cipher / PRF security

Daniel J. Bernstein, Niels Duif, Tanja Lange et al. High-speed high-security signatures. Journal of Cryptographic Engineering, 2012. doi:10.1007/s13389-012-0027-1

Cited on: Schnorr / EdDSA

Daniel J. Bernstein, Andreas Hülsing, Stefan Kölbl et al. The SPHINCS + Signature Framework. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3319535.3363229

Cited on: SLH-DSA (SPHINCS+), XMSS, LMS, Second-preimage resistance

Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche. The Keccak reference, version 3.0. Keccak team, 2011. keccak.team/files/Keccak-reference-3.0.pdf

Cited on: Keccak-256 is secure

John Bethencourt, Amit Sahai and Brent Waters. Ciphertext-Policy Attribute-Based Encryption. 2007 IEEE Symposium on Security and Privacy (SP '07). doi:10.1109/sp.2007.11

Cited on: Identity- and attribute-based encryption

Ward Beullens. MAYO: Practical Post-quantum Signatures from Oil-and-Vinegar Maps. Selected Areas in Cryptography, 2022. doi:10.1007/978-3-030-99277-4_17

Cited on: Multivariate quadratic (MQ), Oil-and-vinegar trapdoor stays hidden, UOV, MAYO

Ward Beullens. Breaking Rainbow Takes a Weekend on a Laptop. Advances in Cryptology – CRYPTO 2022. doi:10.1007/978-3-031-15979-4_16

Cited on: Oil-and-vinegar trapdoor stays hidden, Rainbow trapdoor stays hidden, Rainbow

Alex Biryukov, Daniel Dinu and Dmitry Khovratovich. Argon2: New Generation of Memory-Hard Functions for Password Hashing and Other Applications. 2016 IEEE European Symposium on Security and Privacy (EuroS&P). doi:10.1109/eurosp.2016.31

Cited on: Argon2, scrypt, bcrypt

A. Biryukov, D. Dinu, D. Khovratovich and S. Josefsson. Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications. RFC 9106, 2021. rfc-editor.org/rfc/rfc9106

Cited on: Argon2, scrypt, bcrypt

bitcoin.org. Android Security Vulnerability. 2013. bitcoin.org/en/alert/2013-08-11-android

Cited on: ECDSA, Good randomness

Bitfly. beaconcha.in: Ethereum beacon chain explorer. accessed October 2026. beaconcha.in

Cited on: BLS signatures

Trail of Bits. Coordinated disclosure of vulnerabilities affecting Girault, Bulletproofs, and PlonK. Trail of Bits blog, 2022. blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk

Cited on: Fiat-Shamir holds with real hashes, Fiat-Shamir holds with real hashes

John Black, Phillip Rogaway and Thomas Shrimpton. Encryption-Scheme Security in the Presence of Key-Dependent Messages. Selected Areas in Cryptography, 2003. doi:10.1007/3-540-36492-7_6

Cited on: Circular security

Daniel Bleichenbacher. Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS #1. Advances in Cryptology — CRYPTO '98, 1998. doi:10.1007/bfb0055716

Cited on: RSA-OAEP encryption

Remco Bloemen, Leonid Logvinov and Jacob Evans. EIP-712: Typed structured data hashing and signing. Ethereum Improvement Proposals (Final), 2017. eips.ethereum.org/EIPS/eip-712

Cited on: ECDSA on secp256k1

Google Security Blog. SHA-1 Certificates in Chrome. 2016. security.googleblog.com/2016/11/sha-1-certificates-in-chrome.html

Cited on: MD5, SHA-1 are collision resistant

Google Security Blog. A new path for Kyber on the web. 2024. security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html

Cited on: ML-KEM (Kyber), TLS 1.3

Avrim Blum, Adam Kalai and Hal Wasserman. Noise-tolerant learning, the parity problem, and the statistical query model. Journal of the ACM, 2003. doi:10.1145/792538.792543

Cited on: LPN

Andrey Bogdanov, Dmitry Khovratovich and Christian Rechberger. Biclique Cryptanalysis of the Full AES. Advances in Cryptology – ASIACRYPT 2011. doi:10.1007/978-3-642-25385-0_19

Cited on: Block cipher / PRF security

Peter Bogetoft, Dan Lund Christensen, Ivan Damgård et al. Secure Multiparty Computation Goes Live. Financial Cryptography and Data Security, 2009. doi:10.1007/978-3-642-03549-4_20

Cited on: MPC, dishonest majority

Alexandra Boldyreva. Threshold Signatures, Multisignatures and Blind Signatures Based on the Gap-Diffie-Hellman-Group Signature Scheme. Public Key Cryptography — PKC 2003. doi:10.1007/3-540-36288-6_3

Cited on: Distributed validators

Dan Boneh and Ramarathnam Venkatesan. Breaking RSA may not be equivalent to factoring: Extended abstract. Advances in Cryptology — EUROCRYPT'98, 1998. doi:10.1007/bfb0054117

Cited on: RSA problem

Dan Boneh. The Decision Diffie-Hellman problem. Algorithmic Number Theory, 1998. doi:10.1007/bfb0054851

Cited on: Decisional DH

Dan Boneh and Matt Franklin. Identity-Based Encryption from the Weil Pairing. Advances in Cryptology — CRYPTO 2001. doi:10.1007/3-540-44647-8_13

Cited on: Bilinear DH family, Identity- and attribute-based encryption

Dan Boneh, Craig Gentry, Ben Lynn and Hovav Shacham. Aggregate and Verifiably Encrypted Signatures from Bilinear Maps. Advances in Cryptology — EUROCRYPT 2003. doi:10.1007/3-540-39200-9_26

Cited on: BLS signatures, BLS signatures

Dan Boneh, Ben Lynn and Hovav Shacham. Short Signatures from the Weil Pairing. Journal of Cryptology, 2004. doi:10.1007/s00145-004-0314-9

Cited on: co-CDH on BLS12-381, Bilinear DH family, BLS signatures

Dan Boneh and Xavier Boyen. Short Signatures Without Random Oracles. Advances in Cryptology - EUROCRYPT 2004. doi:10.1007/978-3-540-24676-3_4

Cited on: q-SDH on BLS12-381, q-type assumptions

Dan Boneh, Joseph Bonneau, Benedikt Bünz and Ben Fisch. Verifiable Delay Functions. Advances in Cryptology – CRYPTO 2018. doi:10.1007/978-3-319-96884-1_25

Cited on: RANDAO

Dan Boneh, Sergey Gorbunov, Riad S. Wahby et al. BLS Signatures (Internet-Draft draft-irtf-cfrg-bls-signature). IRTF CFRG, 2022. datatracker.ietf.org/doc/draft-irtf-cfrg-bls-signature

Cited on: BLS signatures, co-CDH on BLS12-381, BLS signatures

Joppe Bos, Craig Costello, Leo Ducas et al. Frodo: Take Off the Ring! Practical, Quantum-Secure Key Exchange from LWE. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/2976749.2978425

Cited on: FrodoKEM, LWE, Ring/module structure gives no shortcut

Joppe Bos, Leo Ducas, Eike Kiltz et al. CRYSTALS - Kyber: A CCA-Secure Module-Lattice-Based KEM. 2018 IEEE European Symposium on Security and Privacy (EuroS&P). doi:10.1109/eurosp.2018.00032

Cited on: Module-LWE / Ring-LWE

Sean Bowe. BLS12-381: New zk-SNARK Elliptic Curve Construction. Electric Coin Company blog, 2017. electriccoin.co/blog/new-snark-curve

Cited on: Discrete log on pairing curves, Discrete log on pairing curves

Elette Boyle, Geoffroy Couteau, Niv Gilboa et al. Efficient Pseudorandom Correlation Generators: Silent OT Extension and More. Advances in Cryptology – CRYPTO 2019. doi:10.1007/978-3-030-26954-8_16

Cited on: LPN, Silent OT / PCGs

Zvika Brakerski, Craig Gentry and Vinod Vaikuntanathan. (Leveled) fully homomorphic encryption without bootstrapping. Proceedings of the 3rd Innovations in Theoretical Computer Science Conference, 2012. doi:10.1145/2090236.2090262

Cited on: Fully homomorphic encryption, Module-LWE / Ring-LWE

Joachim Breitner and Nadia Heninger. Biased Nonce Sense: Lattice Attacks Against Weak ECDSA Signatures in Cryptocurrencies. Financial Cryptography and Data Security, 2019. doi:10.1007/978-3-030-32101-7_1

Cited on: Good randomness

Ernest F. Brickell. Breaking Iterated Knapsacks. Advances in Cryptology, 1985. doi:10.1007/3-540-39568-7_27

Cited on: A disguised easy knapsack looks hard

Daniel R. L. Brown. Generic Groups, Collision Resistance, and ECDSA. Designs, Codes and Cryptography, 2005. doi:10.1007/s10623-003-6154-z

Cited on: ECDSA on secp256k1, ECDSA

BSI. Notes on recent developments concerning Classic McEliece (dated 29 September 2026, announced 1 October 2026). Bundesamt für Sicherheit in der Informationstechnik, 2026. bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/Notes_Classic_McEliece.pdf?__blob=publicationFile&v=2

Cited on: Classic McEliece, Goppa codes look random, HQC

BSI. Technical Guideline TR-02102-1: Cryptographic Mechanisms: Recommendations and Key Lengths. Bundesamt für Sicherheit in der Informationstechnik, 2026. bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.html

Cited on: FrodoKEM

Benedikt Bunz, Jonathan Bootle, Dan Boneh et al. Bulletproofs: Short Proofs for Confidential Transactions and More. 2018 IEEE Symposium on Security and Privacy (SP). doi:10.1109/sp.2018.00020

Cited on: Pedersen commitments

Vitalik Buterin and Christian Reitwiessner. EIP-197: Precompiled contracts for optimal ate pairing check on the elliptic curve alt_bn128. Ethereum Improvement Proposals (Final), 2017. eips.ethereum.org/EIPS/eip-197

Cited on: q-type / knowledge assumptions, Groth16 / PLONK verifiers

Vitalik Buterin and Virgil Griffith. Casper the Friendly Finality Gadget. arXiv:1710.09437, 2017. arxiv.org/abs/1710.09437

Cited on: Consensus and finality, Honest stake

Vitalik Buterin. EIP-1014: Skinny CREATE2. Ethereum Improvement Proposals (Final), 2018. eips.ethereum.org/EIPS/eip-1014

Cited on: Account addresses

Vitalik Buterin, Diego Hernandez, Thor Kamphefner et al. Combining GHOST and Casper. arXiv:2003.03052, 2020. arxiv.org/abs/2003.03052

Cited on: Consensus and finality, Honest stake

Vitalik Buterin, Yoav Weiss, Dror Tirosh et al. ERC-4337: Account Abstraction Using Alt Mempool. Ethereum Request for Comments (Final), 2021. eips.ethereum.org/EIPS/eip-4337

Cited on: Smart accounts

Vitalik Buterin, Dankrad Feist, Diederik Loerakker et al. EIP-4844: Shard Blob Transactions. Ethereum Improvement Proposals (Final), 2022. eips.ethereum.org/EIPS/eip-4844

Cited on: Blobs and data availability, KZG commitments, Reed-Solomon blob extension, KZG polynomial commitments

Vitalik Buterin, Jacob Illum, Matthias Nadler et al. Blockchain Privacy and Regulatory Compliance: Towards a Practical Equilibrium. Elsevier BV, 2023. doi:10.2139/ssrn.4563364

Cited on: Privacy apps

Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient. EIP-7702: Set Code for EOAs. Ethereum Improvement Proposals (Final), 2024. eips.ethereum.org/EIPS/eip-7702

Cited on: ECDSA on secp256k1, Smart accounts

Vitalik Buterin. How to hard-fork to save most users' funds in a quantum emergency. ethresear.ch, 2024. ethresear.ch/t/how-to-hard-fork-to-save-most-users-funds-in-a-quantum-emergency/18901

Cited on: Quantum emergency fork, Seed preimage resistance, Wallet seeds: BIP-39 / BIP-32

Vitalik Buterin, Guillaume Ballet, Dankrad Feist et al. EIP-7864: Ethereum state using a unified binary tree. Ethereum Improvement Proposals (Draft), 2025. eips.ethereum.org/EIPS/eip-7864

Cited on: Binary state tree (EIP-7864), State, transaction and receipt tries, Hash security for PQ schemes

Vitalik Buterin, lightclient, Felix Lange et al. EIP-8141: Frame Transaction. Ethereum Improvement Proposals (Draft), 2026. eips.ethereum.org/EIPS/eip-8141

Cited on: Frame transactions (EIP-8141)

Hanno Böck, Aaron Zauner, Sean Devlin et al. Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS. USENIX WOOT 2016. usenix.org/conference/woot16/workshop-program/presentation/bock

Cited on: AES-GCM, ChaCha20-Poly1305

Hanno Böck, Juraj Somorovsky and Craig Young. Return Of Bleichenbacher's Oracle Threat (ROBOT). USENIX Security 2018. usenix.org/conference/usenixsecurity18/presentation/bock

Cited on: RSA-OAEP encryption

Ran Canetti, Oded Goldreich and Shai Halevi. The random oracle methodology, revisited (preliminary version). Proceedings of the thirtieth annual ACM symposium on Theory of computing - STOC '98, 1998. doi:10.1145/276698.276741

Cited on: Fiat-Shamir holds with real hashes

Ran Canetti, Oded Goldreich and Shai Halevi. The random oracle methodology, revisited. Journal of the ACM, 2004. doi:10.1145/1008731.1008734

Cited on: Fiat-Shamir holds with real hashes

Ran Canetti, Yilei Chen, Justin Holmgren et al. Fiat-Shamir: from practice to theory. Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing, 2019. doi:10.1145/3313276.3316380

Cited on: Fiat-Shamir holds with real hashes

Wouter Castryck and Thomas Decru. An Efficient Key Recovery Attack on SIDH. Advances in Cryptology – EUROCRYPT 2023. doi:10.1007/978-3-031-30589-4_15

Cited on: Supersingular isogeny path, SIDH problem (+ torsion points), SIKE

Stefanos Chaliasos, Jens Ernstberger, David Theodore et al. SoK: What don't we know? Understanding Security Vulnerabilities in SNARKs. arXiv:2402.15293, 2024. arxiv.org/abs/2402.15293

Cited on: ZK circuits are sound and bug-free, ZK rollups

Denis X. Charles, Kristin E. Lauter and Eyal Z. Goren. Cryptographic Hash Functions from Expander Graphs. Journal of Cryptology, 2009. doi:10.1007/s00145-007-9002-x

Cited on: Supersingular isogeny path

David L. Chaum. Untraceable electronic mail, return addresses, and digital pseudonyms. Communications of the ACM, 1981. doi:10.1145/358549.358563

Cited on: ElGamal encryption

David Chaum, Claude Crépeau and Ivan Damgard. Multiparty unconditionally secure protocols. Proceedings of the twentieth annual ACM symposium on Theory of computing - STOC '88, 1988. doi:10.1145/62212.62214

Cited on: Honest majority, MPC, honest majority

Stephen Checkoway, Jacob Maskiewicz, Christina Garman et al. A Systematic Analysis of the Juniper Dual EC Incident. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/2976749.2978395

Cited on: Good randomness

Yuanmi Chen and Phong Q. Nguyen. BKZ 2.0: Better Lattice Security Estimates. Advances in Cryptology – ASIACRYPT 2011. doi:10.1007/978-3-642-25385-0_1

Cited on: Lattice problems: approx-SVP, BDD

Jung Hee Cheon. Security Analysis of the Strong Diffie-Hellman Problem. Advances in Cryptology - EUROCRYPT 2006. doi:10.1007/11761679_1

Cited on: q-SDH on BLS12-381, q-type assumptions

Jung Hee Cheon, Andrey Kim, Miran Kim and Yongsoo Song. Homomorphic Encryption for Arithmetic of Approximate Numbers. Advances in Cryptology – ASIACRYPT 2017. doi:10.1007/978-3-319-70694-8_15

Cited on: Fully homomorphic encryption, Module-LWE / Ring-LWE

B. Chor, O. Goldreich, E. Kushilevitz and M. Sudan. Private information retrieval. Proceedings of IEEE 36th Annual Foundations of Computer Science, 1995. doi:10.1109/sfcs.1995.492461

Cited on: Multi-server PIR

Cloudflare. The state of the post-quantum Internet. Cloudflare blog, 2024. blog.cloudflare.com/pq-2024

Cited on: ML-KEM (Kyber)

Katriel Cohn-Gordon, Cas Cremers, Benjamin Dowling et al. A Formal Security Analysis of the Signal Messaging Protocol. 2017 IEEE European Symposium on Security and Privacy (EuroS&P). doi:10.1109/eurosp.2017.27

Cited on: Signal

D. Connolly, C. Komlo, I. Goldberg and C. A. Wood. The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. RFC 9591, 2024. rfc-editor.org/rfc/rfc9591

Cited on: Schnorr / EdDSA

NESSIE consortium. Portfolio of recommended cryptographic primitives. NESSIE project, 2003. cosic.esat.kuleuven.be/nessie/deliverables/decision-final.pdf

Cited on: SFLASH

lean Ethereum contributors. leanVM: Minimal zkVM for Ethereum. GitHub, 2025. github.com/leanEthereum/leanVM

Cited on: FRI proximity-gap conjectures, leanVM proofs, Hash security for PQ schemes

David A. Cooper, Daniel C. Apon, Quynh H. Dang et al. Recommendation for Stateful Hash-Based Signature Schemes. National Institute of Standards and Technology, 2020. doi:10.6028/NIST.SP.800-208

Cited on: SLH-DSA (SPHINCS+), XMSS, LMS

Henry Corrigan-Gibbs and Dan Boneh. Prio: Private, Robust, and Scalable Computation of Aggregate Statistics. NSDI 2017. usenix.org/conference/nsdi17/technical-sessions/presentation/corrigan-gibbs

Cited on: Non-colluding servers

Ronald Cramer, Léo Ducas, Chris Peikert and Oded Regev. Recovering Short Generators of Principal Ideals in Cyclotomic Rings. Advances in Cryptology – EUROCRYPT 2016. doi:10.1007/978-3-662-49896-5_20

Cited on: Ring/module structure gives no shortcut

Giovanni Di Crescenzo, Tal Malkin and Rafail Ostrovsky. Single Database Private Information Retrieval Implies Oblivious Transfer. Advances in Cryptology — EUROCRYPT 2000. doi:10.1007/3-540-45539-6_10

Cited on: Multi-server PIR

Elizabeth Crites and Alistair Stewart. On Reed–Solomon Proximity Gaps Conjectures. IACR Cryptology ePrint Archive, Paper 2025/2046. eprint.iacr.org/2025/2046

Cited on: FRI proximity-gap conjectures, FRI proximity-gap conjectures

Francesco D'Amato, Nico Flaig, Barnabé Monnot et al. EIP-7732: Enshrined Proposer-Builder Separation. Ethereum Improvement Proposals (Last Call), 2024. eips.ethereum.org/EIPS/eip-7732

Cited on: ePBS (EIP-7732), Honest payload-timeliness committee

Ivan Damgård, Valerio Pastro, Nigel Smart and Sarah Zakarias. Multiparty Computation from Somewhat Homomorphic Encryption. Advances in Cryptology – CRYPTO 2012. doi:10.1007/978-3-642-32009-5_38

Cited on: Dealer-assisted MPC

DNS Flag Day. DNS Flag Day 2020. 2020. dnsflagday.net/2020

Cited on: DNSSEC

F. Denis, F. Jacobs and C. A. Wood. RSA Blind Signatures. RFC 9474, 2023. rfc-editor.org/rfc/rfc9474

Cited on: Trapdoor functions exist

Benjamin E. Diamond and Angus Gruen. On the Distribution of the Distances of Random Words. IACR Cryptology ePrint Archive, Paper 2025/2010. eprint.iacr.org/2025/2010

Cited on: FRI proximity-gap conjectures, STARK verifiers, FRI proximity-gap conjectures

Whitfield Diffie and Martin E. Hellman. New Directions in Cryptography. Democratizing Cryptography, 1976. doi:10.1145/3549993.3550007

Cited on: Computational DH, Computational DH, Computational DH, Finite-field DH key exchange

Jintai Ding and Dieter Schmidt. Rainbow, a New Multivariable Polynomial Signature Scheme. Applied Cryptography and Network Security, 2005. doi:10.1007/11496137_12

Cited on: Rainbow trapdoor stays hidden

Jason A. Donenfeld. WireGuard: Next Generation Kernel Network Tunnel. Proceedings 2017 Network and Distributed System Security Symposium. doi:10.14722/ndss.2017.23160

Cited on: WireGuard

Justin Drake, Dmitry Khovratovich, Mikhail Kudinov and Benedikt Wagner. Hash-Based Multi-Signatures for Post-Quantum Ethereum. IACR Cryptology ePrint Archive, Paper 2025/055. eprint.iacr.org/2025/055

Cited on: leanXMSS attestations, One signature per slot, Poseidon is secure, Hash security for PQ schemes

Justin Drake. lean Ethereum. Ethereum Foundation blog, 2025. blog.ethereum.org/en/2025/07/31/lean-ethereum

Cited on: leanVM proofs

Justin Drake, Julian Ma, Toni Wahrstätter and Vitalik Buterin. L1 Strawmap: Ethereum Draft Roadmap. Ethereum Foundation Protocol, 2026. strawmap.org

Cited on: Binary state tree (EIP-7864), Frame transactions (EIP-8141), KZG commitments, leanDA: PQ data sampling, leanSPHINCS account signatures, leanVM proofs, leanXMSS attestations, Mandatory zkEVM proofs, No large-scale quantum computer, Optional execution proofs (EIP-8025), PQ validator keys

Vivien Dubois, Pierre-Alain Fouque, Adi Shamir and Jacques Stern. Practical Cryptanalysis of SFLASH. Advances in Cryptology - CRYPTO 2007. doi:10.1007/978-3-540-74143-5_1

Cited on: Matsumoto-Imai trapdoor stays hidden, SFLASH

Léo Ducas and Phong Q. Nguyen. Learning a Zonotope and More: Cryptanalysis of NTRUSign Countermeasures. Advances in Cryptology – ASIACRYPT 2012. doi:10.1007/978-3-642-34961-4_27

Cited on: Signatures hide the secret basis

Léo Ducas, Eike Kiltz, Tancrède Lepoint et al. CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2018. doi:10.46586/tches.v2018.i1.238-268

Cited on: Module-LWE / Ring-LWE, Module-SIS

M J Dworkin. Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. National Institute of Standards and Technology, 2007. doi:10.6028/NIST.SP.800-38D

Cited on: AES-GCM, ChaCha20-Poly1305, One-time MACs

Taher ElGamal. A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms. Advances in Cryptology, 1985. doi:10.1007/3-540-39568-7_2

Cited on: ElGamal encryption, Decisional DH, Public-key encryption / two-message key exchange exist, Trapdoor functions exist

Somewhat Practical Fully Homomorphic Encryption. IACR Cryptology ePrint Archive, Paper 2012/144. eprint.iacr.org/2012/144

Cited on: Fully homomorphic encryption, Module-LWE / Ring-LWE

ethereum.org. Weak subjectivity. 2024. ethereum.org/developers/docs/consensus-mechanisms/pos/weak-subjectivity

Cited on: Recent trusted checkpoint

S. Even, O. Goldreich and A. Lempel. A Randomized Protocol for Signing Contracts. Advances in Cryptology, 1983. doi:10.1007/978-1-4757-0602-4_19

Cited on: Oblivious transfer, Trapdoor functions exist

Dragonfly Key Exchange. RFC 7664, 2015. rfc-editor.org/rfc/rfc7664

Cited on: PAKEs

Privacy & Scaling Explorations. Perpetual Powers of Tau. 2019. github.com/privacy-scaling-explorations/perpetualpowersoftau

Cited on: BN254 SNARK setups

Privacy & Scaling Explorations. Semaphore. Semaphore documentation, 2023. docs.semaphore.pse.dev

Cited on: Privacy apps

fail0verflow. Console Hacking 2010: PS3 Epic Fail. 27th Chaos Communication Congress, 2010. media.ccc.de/v/27c3-4087-en-console_hacking_2010

Cited on: ECDSA, Good randomness

Jean-Charles Faugere, Valerie Gauthier-Umana, Ayoub Otmani et al. A distinguisher for high rate McEliece cryptosystems. 2011 IEEE Information Theory Workshop. doi:10.1109/itw.2011.6089437

Cited on: Goppa codes look random

Jean-Charles Faugère and Antoine Joux. Algebraic Cryptanalysis of Hidden Field Equation (HFE) Cryptosystems Using Gröbner Bases. Advances in Cryptology - CRYPTO 2003. doi:10.1007/978-3-540-45146-4_3

Cited on: Matsumoto-Imai trapdoor stays hidden

A. Faz-Hernandez, S. Scott, N. Sullivan et al. Hashing to Elliptic Curves. RFC 9380, 2023. rfc-editor.org/rfc/rfc9380

Cited on: BLS signatures, BLS signatures

U. Feige, D. Lapidot and A. Shamir. Multiple non-interactive zero knowledge proofs based on a single random string. Proceedings [1990] 31st Annual Symposium on Foundations of Computer Science. doi:10.1109/fscs.1990.89549

Cited on: Trapdoor functions exist

Dankrad Feist, Dmitry Khovratovich and Marius van der Wijden. EIP-3607: Reject transactions from senders with deployed code. Ethereum Improvement Proposals (Final), 2021. eips.ethereum.org/EIPS/eip-3607

Cited on: Account addresses

Luca De Feo, David Kohel, Antonin Leroux et al. SQISign: Compact Post-quantum Signatures from Quaternions and Isogenies. Advances in Cryptology – ASIACRYPT 2020. doi:10.1007/978-3-030-64837-4_3

Cited on: SQIsign

Amos Fiat and Adi Shamir. How To Prove Yourself: Practical Solutions to Identification and Signature Problems. Advances in Cryptology — CRYPTO’ 86, 1986. doi:10.1007/3-540-47721-7_12

Cited on: Fiat-Shamir holds with real hashes, Fiat-Shamir holds with real hashes, Pairing-based zkSNARKs

Ethereum Foundation. Wrapping up the KZG Ceremony. Ethereum Foundation blog, 2024. blog.ethereum.org/en/2024/01/23/kzg-wrap

Cited on: KZG ceremony (2023), Trusted setup

Ethereum Foundation. Poseidon Cryptanalysis Initiative. 2024. poseidon-initiative.info

Cited on: Poseidon is secure

Ethereum Foundation. Dencun Mainnet Announcement. Ethereum Foundation blog, 2024. blog.ethereum.org/en/2024/02/27/dencun-mainnet-announcement

Cited on: Blobs and data availability, KZG commitments

Ethereum Foundation. Proximity Prize. 2025. proximityprize.org

Cited on: FRI proximity-gap conjectures, FRI proximity-gap conjectures

Ethereum Foundation. Fusaka Mainnet Announcement. Ethereum Foundation blog, 2025. blog.ethereum.org/en/2025/11/06/fusaka-mainnet-announcement

Cited on: Reed-Solomon blob extension

Ethereum Foundation. Pectra Mainnet Announcement. Ethereum Foundation blog, 2025. blog.ethereum.org/en/2025/04/23/pectra-mainnet

Cited on: BLS signatures, Smart accounts

Ethereum Foundation. Shipping an L1 zkEVM #2: The Security Foundations. Ethereum Foundation blog, 2025. blog.ethereum.org/en/2025/12/18/zkevm-security-foundations

Cited on: leanVM proofs, Proof systems are sound and bug-free

Ethereum Foundation. Shipping an L1 zkEVM #1: Realtime Proving. Ethereum Foundation blog, 2025. blog.ethereum.org/en/2025/07/10/realtime-proving

Cited on: Mandatory zkEVM proofs

Ethereum Foundation. Glamsterdam Testnet Announcement. Ethereum Foundation blog, 2026. blog.ethereum.org/en/2026/09/17/glamsterdam-testnet-announcement

Cited on: ePBS (EIP-7732)

Ethereum Foundation. sig.golf: an open competition for compact post-quantum signatures. 2026. sig.golf

Cited on: leanSPHINCS account signatures

Ethereum Foundation. Post-Quantum Ethereum. pq.ethereum.org, 2026. pq.ethereum.org

Cited on: leanSPHINCS account signatures

Pierre-Alain Fouque, Jeffrey Hoffstein, Paul Kirchner and Vadim Lyubashevsky. Falcon: Fast-Fourier Lattice-based Compact Signatures over NTRU. Falcon team, 2020. falcon-sign.info

Cited on: FN-DSA (Falcon), NTRU problem

Fox-IT. Black Tulip: Report of the investigation into the DigiNotar Certificate Authority breach. Report for the Dutch Ministry of the Interior, 2012. zoek.officielebekendmakingen.nl/blg-191225.pdf

Cited on: You have the right public key

Eiichiro Fujisaki, Tatsuaki Okamoto, David Pointcheval and Jacques Stern. RSA-OAEP Is Secure under the RSA Assumption. Journal of Cryptology, 2004. doi:10.1007/s00145-002-0204-y

Cited on: RSA-OAEP encryption

Ariel Gabizon, Zachary J. Williamson and Oana Ciobotaru. PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge. IACR Cryptology ePrint Archive, Paper 2019/953. eprint.iacr.org/2019/953

Cited on: q-type / knowledge assumptions, BN254 SNARK setups, Groth16 / PLONK verifiers, KZG polynomial commitments, Pairing-based zkSNARKs

Sanjam Garg and Mohammad Hajiabadi. Trapdoor Functions from the Computational Diffie-Hellman Assumption. Advances in Cryptology – CRYPTO 2018. doi:10.1007/978-3-319-96881-0_13

Cited on: Trapdoor functions exist

Rosario Gennaro and Steven Goldfeder. Fast Multiparty Threshold ECDSA with Fast Trustless Setup. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3243734.3243859

Cited on: Paillier encryption

Craig Gentry, Chris Peikert and Vinod Vaikuntanathan. Trapdoors for hard lattices and new cryptographic constructions. Proceedings of the fortieth annual ACM symposium on Theory of computing, 2008. doi:10.1145/1374376.1374407

Cited on: FN-DSA (Falcon), Signatures hide the secret basis, Trapdoor functions exist

Craig Gentry. Fully homomorphic encryption using ideal lattices. Proceedings of the forty-first annual ACM symposium on Theory of computing, 2009. doi:10.1145/1536414.1536440

Cited on: Circular security, Fully homomorphic encryption

Craig Gentry and Daniel Wichs. Separating succinct non-interactive arguments from all falsifiable assumptions. Proceedings of the forty-third annual ACM symposium on Theory of computing, 2011. doi:10.1145/1993636.1993651

Cited on: Groth16 / PLONK verifiers, Pairing-based zkSNARKs, STARKs / hash-based SNARKs

Y. Gertner, T. Malkin and O. Reingold. On the impossibility of basing trapdoor functions on trapdoor predicates. Proceedings 42nd IEEE Symposium on Foundations of Computer Science, 2001. doi:10.1109/sfcs.2001.959887

Cited on: Trapdoor functions exist

Ashrujit Ghoshal, Yuval Ishai, Aayush Jain and Nuozhou Sun. Quasipolynomial Cryptanalysis of the McEliece Cryptosystem (or: PIR Meets McEliece). IACR Cryptology ePrint Archive, Paper 2026/1630. eprint.iacr.org/2026/1630

Cited on: Classic McEliece, Goppa codes look random

Federico Giacon, Felix Heuer and Bertram Poettering. KEM Combiners. Public-Key Cryptography – PKC 2018. doi:10.1007/978-3-319-76578-5_7

Cited on: Hybrid KEM: X25519 + ML-KEM

Craig Gidney. How to factor 2048 bit RSA integers with less than a million noisy qubits. arXiv:2505.15917, 2025. arxiv.org/abs/2505.15917

Cited on: No large-scale quantum computer, No large-scale quantum computer

D. Gillmor. Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS). RFC 7919, 2016. rfc-editor.org/rfc/rfc7919

Cited on: Finite-field DH key exchange

O. Goldreich, S. Goldwasser and S. Micali. How To Construct Random Functions. 25th Annual Symposium onFoundations of Computer Science, 1984.. doi:10.1109/sfcs.1984.715949

Cited on: One-way functions exist

O. Goldreich, S. Micali and A. Wigderson. How to play ANY mental game. Proceedings of the nineteenth annual ACM conference on Theory of computing - STOC '87, 1987. doi:10.1145/28395.28420

Cited on: MPC, dishonest majority

O. Goldreich and L. A. Levin. A hard-core predicate for all one-way functions. Proceedings of the twenty-first annual ACM symposium on Theory of computing - STOC '89, 1989. doi:10.1145/73007.73010

Cited on: Trapdoor functions exist

Oded Goldreich, Shafi Goldwasser and Shai Halevi. Public-key cryptosystems from lattice reduction problems. Advances in Cryptology — CRYPTO '97, 1997. doi:10.1007/bfb0052231

Cited on: GGH, NTRUSign

S. Goldwasser and Y.T. Kalai. On the (In)security of the Fiat-Shamir paradigm. 44th Annual IEEE Symposium on Foundations of Computer Science, 2003. Proceedings.. doi:10.1109/sfcs.2003.1238185

Cited on: Fiat-Shamir holds with real hashes

Lorenzo Grassi, Dmitry Khovratovich, Christian Rechberger et al. Poseidon: A New Hash Function for Zero-Knowledge Proof Systems. USENIX Security 2021. usenix.org/conference/usenixsecurity21/presentation/grassi

Cited on: Poseidon is secure, Privacy apps

Jens Groth. On the Size of Pairing-Based Non-interactive Arguments. Advances in Cryptology – EUROCRYPT 2016. doi:10.1007/978-3-662-49896-5_11

Cited on: q-type / knowledge assumptions, BN254 SNARK setups, Groth16 / PLONK verifiers, Pairing-based zkSNARKs, q-type assumptions

Standards for Efficient Cryptography Group. SEC 2: Recommended Elliptic Curve Domain Parameters. Version 2.0, 2010. secg.org/sec2-v2.pdf

Cited on: ECDLP, ECDSA on secp256k1, ECDLP

Internet Security Research Group. ISRG Prio Services for Preserving Privacy in COVID-19 Exposure Notification Apps. 2020. abetterinternet.org/post/prio-services-for-covid-en

Cited on: Non-colluding servers

Lov K. Grover. A fast quantum mechanical algorithm for database search. Proceedings of the twenty-eighth annual ACM symposium on Theory of computing - STOC '96, 1996. doi:10.1145/237814.237866

Cited on: No large-scale quantum computer, AES, ChaCha20, HMAC are PRFs, No large-scale quantum computer, Preimage resistance

Chun Guo, Jonathan Katz, Xiao Wang and Yu Yu. Efficient and Secure Multiparty Computation from Fixed-Key Block Ciphers. 2020 IEEE Symposium on Security and Privacy (SP). doi:10.1109/sp40000.2020.00016

Cited on: Garbled circuits

Tobias Hemmert. Key recovery for the McEliece cryptosystem using higher-order vanishing. IACR Cryptology ePrint Archive, Paper 2026/1339. eprint.iacr.org/2026/1339

Cited on: Goppa codes look random

Alexandra Henzinger, Matthew M. Hong, Henry Corrigan-Gibbs et al. One Server for the Price of Two: Simple and Fast Single-Server Private Information Retrieval. USENIX Security 2023. usenix.org/conference/usenixsecurity23/presentation/henzinger

Cited on: Multi-server PIR

Jeffrey Hoffstein, Jill Pipher and Joseph H. Silverman. NTRU: A ring-based public key cryptosystem. Algorithmic Number Theory, 1998. doi:10.1007/bfb0054868

Cited on: NTRU problem, Trapdoor functions exist

Jeffrey Hoffstein, Nick Howgrave-Graham, Jill Pipher et al. NTRUSign: Digital Signatures Using the NTRU Lattice. Topics in Cryptology — CT-RSA 2003. doi:10.1007/3-540-36563-x_9

Cited on: GGH, NTRUSign

Nicholas J. Hopper and Manuel Blum. Secure Human Identification Protocols. Advances in Cryptology — ASIACRYPT 2001. doi:10.1007/3-540-45682-1_4

Cited on: LPN

Daira-Emma Hopwood, Sean Bowe, Taylor Hornby and Nathan Wilcox. Zcash Protocol Specification. Electric Coin Company, 2016. zips.z.cash/protocol/protocol.pdf

Cited on: Pairing-based zkSNARKs

A. Huelsing, D. Butin, S. Gazdag et al. XMSS: eXtended Merkle Signature Scheme. RFC 8391, 2018. rfc-editor.org/rfc/rfc8391

Cited on: One signature per slot, SLH-DSA (SPHINCS+), XMSS, LMS

Johan HÅstad, Russell Impagliazzo, Leonid A. Levin and Michael Luby. A Pseudorandom Generator from any One-way Function. SIAM Journal on Computing, 1999. doi:10.1137/s0097539793244708

Cited on: One-way functions exist, One-way functions exist

IANA. DNSSEC Root KSK Ceremonies. 2010. iana.org/dnssec/ceremonies

Cited on: You have the right public key

R. Impagliazzo and S. Rudich. Limits on the provable consequences of one-way permutations. Proceedings of the twenty-first annual ACM symposium on Theory of computing - STOC '89, 1989. doi:10.1145/73007.73012

Cited on: Key exchange / public-key encryption exist, One-way functions exist, Public-key encryption / two-message key exchange exist, One-way functions exist

R. Impagliazzo, L. A. Levin and M. Luby. Pseudo-random generation from one-way functions. Proceedings of the twenty-first annual ACM symposium on Theory of computing - STOC '89, 1989. doi:10.1145/73007.73009

Cited on: Randomness extractors

R. Impagliazzo. A personal view of average-case complexity. Proceedings of Structure in Complexity Theory. Tenth Annual IEEE Conference, 1995. doi:10.1109/sct.1995.514853

Cited on: Key exchange / public-key encryption exist, P ≠ NP, Public-key encryption / two-message key exchange exist, One-way functions exist, P ≠ NP

Clay Mathematics Institute. P vs NP. Millennium Prize Problems, 2000. claymath.org/millennium/p-vs-np

Cited on: P ≠ NP, P ≠ NP

Scalable, transparent, and post-quantum secure computational integrity. IACR Cryptology ePrint Archive, Paper 2018/046. eprint.iacr.org/2018/046

Cited on: STARK verifiers, STARKs / hash-based SNARKs

Yuval Ishai, Joe Kilian, Kobbi Nissim and Erez Petrank. Extending Oblivious Transfers Efficiently. Advances in Cryptology - CRYPTO 2003. doi:10.1007/978-3-540-45146-4_9

Cited on: Oblivious transfer

Stanislaw Jarecki, Hugo Krawczyk and Jiayu Xu. OPAQUE: An Asymmetric PAKE Protocol Secure Against Pre-computation Attacks. Advances in Cryptology – EUROCRYPT 2018. doi:10.1007/978-3-319-78372-7_15

Cited on: PAKEs

S. Josefsson and I. Liusvaara. Edwards-Curve Digital Signature Algorithm (EdDSA). RFC 8032, 2017. rfc-editor.org/rfc/rfc8032

Cited on: Schnorr / EdDSA

Antoine Joux. A One Round Protocol for Tripartite Diffie–Hellman. Algorithmic Number Theory, 2000. doi:10.1007/10722028_23

Cited on: Bilinear DH family

B. Kaliski, J. Jonsson and A. Rusch. PKCS #1: RSA Cryptography Specifications Version 2.2. RFC 8017, 2016. rfc-editor.org/rfc/rfc8017

Cited on: RSA signatures

Harry Kalodner, Steven Goldfeder, Xiaoqi Chen et al. Arbitrum: Scalable, private smart contracts. USENIX Security 2018. usenix.org/conference/usenixsecurity18/presentation/kalodner

Cited on: ≥ 1 honest challenger, Optimistic rollups

Panos Kampanakis, Douglas Stebila and Torben Hansen. PQ/T Hybrid Key Exchange with ML-KEM in SSH (Internet-Draft draft-ietf-sshm-mlkem-hybrid-kex). IETF SSHM working group, 2025. datatracker.ietf.org/doc/draft-ietf-sshm-mlkem-hybrid-kex

Cited on: SSH

Aniket Kate, Gregory M. Zaverucha and Ian Goldberg. Constant-Size Commitments to Polynomials and Their Applications. Advances in Cryptology - ASIACRYPT 2010. doi:10.1007/978-3-642-17373-8_11

Cited on: KZG commitments, q-SDH on BLS12-381, KZG polynomial commitments, q-type assumptions

Dmitry Khovratovich, Ron D. Rothblum and Lev Soukhanov. How to Prove False Statements: Practical Attacks on Fiat-Shamir. IACR Cryptology ePrint Archive, Paper 2025/118. eprint.iacr.org/2025/118

Cited on: Fiat-Shamir holds with real hashes, Fiat-Shamir holds with real hashes

Joe Kilian. Founding cryptography on oblivious transfer. Proceedings of the twentieth annual ACM symposium on Theory of computing - STOC '88, 1988. doi:10.1145/62212.62215

Cited on: Oblivious transfer

Taechan Kim and Razvan Barbulescu. Extended Tower Number Field Sieve: A New Complexity for the Medium Prime Case. Advances in Cryptology – CRYPTO 2016. doi:10.1007/978-3-662-53018-4_20

Cited on: q-type / knowledge assumptions, Discrete log on pairing curves, Discrete log on pairing curves

Aviad Kipnis and Adi Shamir. Cryptanalysis of the oil and vinegar signature scheme. Advances in Cryptology — CRYPTO '98, 1998. doi:10.1007/bfb0055733

Cited on: Oil-and-vinegar trapdoor stays hidden, UOV, MAYO

Aviad Kipnis, Jacques Patarin and Louis Goubin. Unbalanced Oil and Vinegar Signature Schemes. Advances in Cryptology — EUROCRYPT ’99, 1999. doi:10.1007/3-540-48910-x_15

Cited on: Multivariate quadratic (MQ), Oil-and-vinegar trapdoor stays hidden, UOV, MAYO

Etan Kissling. EIP-7657: Sync committee slashings. Ethereum Improvement Proposals (Stagnant), 2024. eips.ethereum.org/EIPS/eip-7657

Cited on: Light clients and bridges

H. Krawczyk, M. Bellare and R. Canetti. HMAC: Keyed-Hashing for Message Authentication. RFC 2104, 1997. rfc-editor.org/rfc/rfc2104

Cited on: HMAC, HKDF

Hugo Krawczyk. Cryptographic Extraction and Key Derivation: The HKDF Scheme. Advances in Cryptology – CRYPTO 2010. doi:10.1007/978-3-642-14623-7_34

Cited on: HMAC, HKDF

H. Krawczyk and P. Eronen. HMAC-based Extract-and-Expand Key Derivation Function (HKDF). RFC 5869, 2010. rfc-editor.org/rfc/rfc5869

Cited on: HMAC, HKDF, TLS 1.3

Ehren Kret and Rolfe Schmidt. The PQXDH Key Agreement Protocol. Signal specifications, 2023. signal.org/docs/specifications/pqxdh

Cited on: Hybrid KEM: X25519 + ML-KEM, ML-KEM (Kyber), Signal

Ehren Kret. Quantum Resistance and the Signal Protocol. Signal blog, 2023. signal.org/blog/pqxdh

Cited on: Signal

William Kretschmer, Luowen Qian, Makrand Sinha and Avishay Tal. Quantum Cryptography in Algorithmica. Proceedings of the 55th Annual ACM Symposium on Theory of Computing, 2023. doi:10.1145/3564246.3585225

Cited on: P ≠ NP

Kris Kwiatkowski, Panos Kampanakis, Bas Westerbaan and Douglas Stebila. Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLSv1.3 (Internet-Draft draft-ietf-tls-ecdhe-mlkem). IETF TLS working group, 2024. datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem

Cited on: ECDH / X25519, Hybrid KEM: X25519 + ML-KEM, TLS 1.3

L2BEAT. Rollup stages. 2023. l2beat.com/stages

Cited on: Optimistic rollups, ZK rollups

J. C. Lagarias and A. M. Odlyzko. Solving low-density subset sum problems. Journal of the ACM, 1985. doi:10.1145/2455.2461

Cited on: A disguised easy knapsack looks hard

Felix Lange. EIP-778: Ethereum Node Records (ENR). Ethereum Improvement Proposals (Final), 2017. eips.ethereum.org/EIPS/eip-778

Cited on: Node identity and handshakes

A. Langley, M. Hamburg and S. Turner. Elliptic Curves for Security. RFC 7748, 2016. rfc-editor.org/rfc/rfc7748

Cited on: ECDH / X25519, Finite-field DH key exchange

Adeline Langlois and Damien Stehlé. Worst-case to average-case reductions for module lattices. Designs, Codes and Cryptography, 2015. doi:10.1007/s10623-014-9938-4

Cited on: Module-LWE / Ring-LWE, Ring/module structure gives no shortcut

B. Laurie, A. Langley and E. Kasper. Certificate Transparency. RFC 6962, 2013. rfc-editor.org/rfc/rfc6962

Cited on: You have the right public key, Merkle trees, hash commitments

B. Laurie, E. Messeri and R. Stradling. Certificate Transparency Version 2.0. RFC 9162, 2021. rfc-editor.org/rfc/rfc9162

Cited on: You have the right public key

A. K. Lenstra, H. W. Lenstra, M. S. Manasse and J. M. Pollard. The number field sieve. Lecture Notes in Mathematics, 1993. doi:10.1007/bfb0091537

Cited on: Integer factorization

Gaëtan Leurent and Thomas Peyrin. SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust. USENIX Security 2020. usenix.org/conference/usenixsecurity20/presentation/leurent

Cited on: MD5, SHA-1 are collision resistant

Yuan Xing Li, R.H. Deng and Xin Mei Wang. On the equivalence of McEliece's and Niederreiter's public-key cryptosystems. IEEE Transactions on Information Theory, 1994. doi:10.1109/18.272496

Cited on: Niederreiter with Reed-Solomon codes, Reed-Solomon codes look random

Longcheng Li, Qian Li, Xingjian Li and Qipeng Liu. Cryptomania v.s. Minicrypt in a Quantum World. Advances in Cryptology – CRYPTO 2026. doi:10.1007/978-3-032-35409-9_1

Cited on: Public-key encryption / two-message key exchange exist

Yehuda Lindell. Fast Secure Two-Party ECDSA Signing. Journal of Cryptology, 2021. doi:10.1007/s00145-021-09409-9

Cited on: Paillier encryption

Yanyi Liu and Rafael Pass. On One-way Functions and Kolmogorov Complexity. 2020 IEEE 61st Annual Symposium on Foundations of Computer Science (FOCS). doi:10.1109/focs46700.2020.00118

Cited on: One-way functions exist

Lars Lydersen, Carlos Wiechers, Christoffer Wittmann et al. Hacking commercial quantum cryptography systems by tailored bright illumination. Nature Photonics, 2010. doi:10.1038/nphoton.2010.214

Cited on: Quantum key distribution

Vadim Lyubashevsky. Fiat-Shamir with Aborts: Applications to Lattice and Factoring-Based Signatures. Advances in Cryptology – ASIACRYPT 2009. doi:10.1007/978-3-642-10366-7_35

Cited on: ML-DSA (Dilithium), Signatures hide the secret basis

Vadim Lyubashevsky, Chris Peikert and Oded Regev. On Ideal Lattices and Learning with Errors over Rings. Journal of the ACM, 2013. doi:10.1145/2535925

Cited on: Ring/module structure gives no shortcut

Mark Mackey and Raúl Kripalani. EIP-7892: Blob Parameter Only Hardforks. Ethereum Improvement Proposals (Final), 2025. eips.ethereum.org/EIPS/eip-7892

Cited on: Blobs and data availability

Moxie Marlinspike and Trevor Perrin. The X3DH Key Agreement Protocol. Signal specifications, 2016. signal.org/docs/specifications/x3dh

Cited on: Signal

Tsutomu Matsumoto and Hideki Imai. Public Quadratic Polynomial-Tuples for Efficient Signature-Verification and Message-Encryption. Advances in Cryptology — EUROCRYPT ’88, 1988. doi:10.1007/3-540-45961-8_39

Cited on: Matsumoto-Imai trapdoor stays hidden

Ueli M. Maurer and Stefan Wolf. The Relationship Between Breaking the Diffie--Hellman Protocol and Computing Discrete Logarithms. SIAM Journal on Computing, 1999. doi:10.1137/s0097539796302749

Cited on: Computational DH, Computational DH

Alexander May. Computing the RSA Secret Key Is Deterministic Polynomial Time Equivalent to Factoring. Advances in Cryptology – CRYPTO 2004. doi:10.1007/978-3-540-28628-8_13

Cited on: Integer factorization

Robert J. McEliece. A Public-Key Cryptosystem Based On Algebraic Coding Theory. DSN Progress Report 42-44, Jet Propulsion Laboratory, 1978. ipnpr.jpl.nasa.gov/progress_report2/42-44/44N.PDF

Cited on: Classic McEliece, Syndrome decoding

David A. McGrew and John Viega. The Security and Performance of the Galois/Counter Mode (GCM) of Operation. Progress in Cryptology - INDOCRYPT 2004. doi:10.1007/978-3-540-30556-9_27

Cited on: One-time MACs

D. McGrew, M. Curcio and S. Fluhrer. Leighton-Micali Hash-Based Signatures. RFC 8554, 2019. rfc-editor.org/rfc/rfc8554

Cited on: SLH-DSA (SPHINCS+), XMSS, LMS

Carlos Aguilar Melchor, Nicolas Aragon, Slim Bettaieb and Loïc Bidoux. HQC: Hamming Quasi-Cyclic, specification. HQC team, 2025. pqc-hqc.org/doc/hqc_specifications_2025_08_22.pdf

Cited on: HQC, Quasi-cyclic structure gives no shortcut

R. Merkle and M. Hellman. Hiding information and signatures in trapdoor knapsacks. IEEE Transactions on Information Theory, 1978. doi:10.1109/tit.1978.1055927

Cited on: A disguised easy knapsack looks hard, Merkle-Hellman knapsack, P ≠ NP, Trapdoor functions exist

Ralph C. Merkle. A Digital Signature Based on a Conventional Encryption Function. Advances in Cryptology — CRYPTO ’87, 1987. doi:10.1007/3-540-48184-2_32

Cited on: Merkle trees, hash commitments

Daniele Micciancio and Chris Peikert. Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller. Advances in Cryptology – EUROCRYPT 2012. doi:10.1007/978-3-642-29011-4_41

Cited on: Trapdoor functions exist

Microsoft. Microsoft Security Advisory 2718704: Unauthorized Digital Certificates Could Allow Spoofing. 2012. learn.microsoft.com/en-us/security-updates/securityadvisories/2012/2718704

Cited on: MD5 / SHA-1 signed certificates

mike, Francesco, dapplion et al. EIP-7251: Increase the MAX_EFFECTIVE_BALANCE. Ethereum Improvement Proposals (Final), 2023. eips.ethereum.org/EIPS/eip-7251

Cited on: BLS signatures

Scalable Multi-party Computation for zk-SNARK Parameters in the Random Beacon Model. IACR Cryptology ePrint Archive, Paper 2017/1050. eprint.iacr.org/2017/1050

Cited on: BN254 SNARK setups, Trusted setup

Ring Signature Confidential Transactions for Monero. IACR Cryptology ePrint Archive, Paper 2015/1098. eprint.iacr.org/2015/1098

Cited on: Pedersen commitments

Moni Naor. Bit commitment using pseudorandomness. Journal of Cryptology, 1991. doi:10.1007/bf00196774

Cited on: One-way functions exist

NCSC. Quantum security technologies. NCSC white paper, 2020. ncsc.gov.uk/whitepaper/quantum-security-technologies

Cited on: Quantum key distribution

Low-Resource Eclipse Attacks on Ethereum's Peer-to-Peer Network. IACR Cryptology ePrint Archive, Paper 2018/236. eprint.iacr.org/2018/236

Cited on: Node identity and handshakes, P2P network

Phong Nguyen. Cryptanalysis of the Goldreich-Goldwasser-Halevi Cryptosystem from Crypto ’97. Advances in Cryptology — CRYPTO’ 99, 1999. doi:10.1007/3-540-48405-1_18

Cited on: GGH, NTRUSign

Phong Q. Nguyen and Oded Regev. Learning a Parallelepiped: Cryptanalysis of GGH and NTRU Signatures. Advances in Cryptology - EUROCRYPT 2006. doi:10.1007/11761679_17

Cited on: Signatures hide the secret basis

Phong Q. Nguyen and Oded Regev. Learning a Parallelepiped: Cryptanalysis of GGH and NTRU Signatures. Journal of Cryptology, 2009. doi:10.1007/s00145-008-9031-0

Cited on: FN-DSA (Falcon), Signatures hide the secret basis

Jonas Nick, Tim Ruffing and Yannick Seurin. MuSig2: Simple Two-Round Schnorr Multi-signatures. Advances in Cryptology – CRYPTO 2021. doi:10.1007/978-3-030-84242-0_8

Cited on: Schnorr / EdDSA

Y. Nir and A. Langley. ChaCha20 and Poly1305 for IETF Protocols. RFC 8439, 2018. rfc-editor.org/rfc/rfc8439

Cited on: AES-GCM, ChaCha20-Poly1305, One-time MACs

NIST. Advanced Encryption Standard (AES). NIST FIPS 197, 2001. doi:10.6028/NIST.FIPS.197

Cited on: AES, ChaCha20, HMAC are PRFs, Block cipher / PRF security

NIST. SHA-3 standard: permutation-based hash and extendable-output functions. NIST FIPS 202, 2015. doi:10.6028/NIST.FIPS.202

Cited on: Keccak-256 is secure

NIST. Secure hash standard. NIST FIPS 180-4, 2015. doi:10.6028/NIST.FIPS.180-4

Cited on: SHA-256 is secure

NIST. Digital Signature Standard (DSS). NIST FIPS 186-5, 2023. doi:10.6028/NIST.FIPS.186-5

Cited on: P-256 ECDSA (passkeys), ECDSA

NIST. Module-lattice-based digital signature standard. NIST FIPS 204, 2024. doi:10.6028/NIST.FIPS.204

Cited on: ML-DSA (Dilithium), Module-SIS

NIST. Module-lattice-based key-encapsulation mechanism standard. NIST FIPS 203, 2024. doi:10.6028/NIST.FIPS.203

Cited on: ML-KEM (Kyber)

NIST. Stateless hash-based digital signature standard. NIST FIPS 205, 2024. doi:10.6028/NIST.FIPS.205

Cited on: leanSPHINCS account signatures, SLH-DSA (SPHINCS+), XMSS, LMS

NIST. NIST Advances 9 Candidates to the 3rd Round of PQC. NIST CSRC news, 2026. csrc.nist.gov/News/2026/nist-advances-9-candidates-to-the-3rd-round-of-pqc

Cited on: SQIsign, UOV, MAYO

NSA. Quantum Key Distribution (QKD) and Quantum Cryptography (QC). 2020. nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC

Cited on: Quantum key distribution

OpenSSH. OpenSSH 9.0 release notes. 2022. openssh.com/txt/release-9.0

Cited on: SSH

OpenSSH. OpenSSH 10.0 release notes. 2025. openssh.com/txt/release-10.0

Cited on: Hybrid KEM: X25519 + ML-KEM, ML-KEM (Kyber), SSH

Pascal Paillier. Public-Key Cryptosystems Based on Composite Degree Residuosity Classes. Advances in Cryptology — EUROCRYPT ’99, 1999. doi:10.1007/3-540-48910-x_16

Cited on: Decisional composite residuosity, Paillier encryption, Trapdoor functions exist

Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe. BIP 39: Mnemonic code for generating deterministic keys. Bitcoin Improvement Proposals, 2013. github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

Cited on: Key storage, Wallet seeds: BIP-39 / BIP-32

PHC panel. Password Hashing Competition. 2015. password-hashing.net

Cited on: Argon2, scrypt, bcrypt

Jacques Patarin. Cryptanalysis of the Matsumoto and Imai Public Key Scheme of Eurocrypt’88. Advances in Cryptology — CRYPT0’ 95, 1995. doi:10.1007/3-540-44750-4_20

Cited on: Matsumoto-Imai trapdoor stays hidden

Torben Pryds Pedersen. Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing. Advances in Cryptology — CRYPTO ’91, 1991. doi:10.1007/3-540-46766-1_9

Cited on: Pedersen commitments

Chris Peikert and Brent Waters. Lossy trapdoor functions and their applications. Proceedings of the fortieth annual ACM symposium on Theory of computing, 2008. doi:10.1145/1374376.1374406

Cited on: ElGamal encryption, Trapdoor functions exist

Chris Peikert and Sina Shiehian. Noninteractive Zero Knowledge for NP from (Plain) Learning with Errors. Advances in Cryptology – CRYPTO 2019. doi:10.1007/978-3-030-26948-7_4

Cited on: Fiat-Shamir holds with real hashes

C. Percival and S. Josefsson. The scrypt Password-Based Key Derivation Function. RFC 7914, 2016. rfc-editor.org/rfc/rfc7914

Cited on: Argon2, scrypt, bcrypt

Trevor Perrin. The XEdDSA and VXEdDSA Signature Schemes. Signal specifications, 2016. signal.org/docs/specifications/xeddsa

Cited on: Schnorr / EdDSA, Signal

Trevor Perrin and Moxie Marlinspike. The Double Ratchet Algorithm. Signal specifications, 2016. signal.org/docs/specifications/doubleratchet

Cited on: Signal

Trevor Perrin. The Noise Protocol Framework. 2018. noiseprotocol.org/noise.html

Cited on: WireGuard

David Pointcheval and Jacques Stern. Security Arguments for Digital Signatures and Blind Signatures. Journal of Cryptology, 2000. doi:10.1007/s001450010003

Cited on: Fiat-Shamir holds with real hashes, Schnorr / EdDSA

J. M. Pollard. Monte Carlo Methods for Index Computation (mod p). Mathematics of Computation, 1978. doi:10.2307/2006496

Cited on: ECDLP, ECDLP

T. Pornin. Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA). RFC 6979, 2013. rfc-editor.org/rfc/rfc6979

Cited on: ECDSA on secp256k1, ECDSA

E. Prange. The use of information sets in decoding cyclic codes. IEEE Transactions on Information Theory, 1962. doi:10.1109/tit.1962.1057777

Cited on: Syndrome decoding

drand project. drand: distributed randomness beacon. 2019. drand.love

Cited on: BLS signatures

Rosenpass project. Rosenpass: post-quantum secure key exchange for WireGuard. 2023. rosenpass.eu

Cited on: WireGuard

Niels Provos and David Mazières. A Future-Adaptable Password Scheme. USENIX Annual Technical Conference 1999. usenix.org/legacy/events/usenix99/provos/provos.pdf

Cited on: Argon2, scrypt, bcrypt

Michael O. Rabin. Digitalized Signatures and Public-Key Functions as Intractable as Factorization. MIT/LCS/TR-212, 1979. apps.dtic.mil/sti/citations/ADA078415

Cited on: Integer factorization, Trapdoor functions exist

I. S. Reed and G. Solomon. Polynomial Codes Over Certain Finite Fields. Journal of the Society for Industrial and Applied Mathematics, 1960. doi:10.1137/0108018

Cited on: Reed-Solomon blob extension

Oded Regev. On lattices, learning with errors, random linear codes, and cryptography. Proceedings of the thirty-seventh annual ACM symposium on Theory of computing, 2005. doi:10.1145/1060590.1060603

Cited on: Lattice problems: approx-SVP, BDD, LWE

Oded Regev. On lattices, learning with errors, random linear codes, and cryptography. Journal of the ACM, 2009. doi:10.1145/1568318.1568324

Cited on: Lattice problems: approx-SVP, BDD, LWE

Christian Reitwiessner. EIP-196: Precompiled contracts for addition and scalar multiplication on the elliptic curve alt_bn128. Ethereum Improvement Proposals (Final), 2017. eips.ethereum.org/EIPS/eip-196

Cited on: q-type / knowledge assumptions, Groth16 / PLONK verifiers, Discrete log on pairing curves

E. Rescorla. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446, 2018. rfc-editor.org/rfc/rfc8446

Cited on: ECDH / X25519, RSA-OAEP encryption, TLS 1.3

Eric Rescorla, Kazuho Oku, Nick Sullivan and Christopher A. Wood. TLS Encrypted Client Hello (Internet-Draft draft-ietf-tls-esni). IETF TLS working group, 2018. datatracker.ietf.org/doc/draft-ietf-tls-esni

Cited on: ECIES / HPKE

R. L. Rivest, A. Shamir and L. Adleman. A Method for Obtaining Digital Signatures and Public-Key Cryptosystems. Defense Technical Information Center, 1978. doi:10.21236/ada606588

Cited on: Merkle-Hellman knapsack, RSA problem, Trapdoor functions exist

Damien Robert. Breaking SIDH in Polynomial Time. Advances in Cryptology – EUROCRYPT 2023. doi:10.1007/978-3-031-30589-4_17

Cited on: SIDH problem (+ torsion points)

Martin Roetteler, Michael Naehrig, Krysta M. Svore and Kristin Lauter. Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms. Advances in Cryptology – ASIACRYPT 2017. doi:10.1007/978-3-319-70697-9_9

Cited on: No large-scale quantum computer, ECDLP

Phillip Rogaway. Authenticated-encryption with associated-data. Proceedings of the 9th ACM conference on Computer and communications security, 2002. doi:10.1145/586110.586125

Cited on: AES-GCM, ChaCha20-Poly1305

Phillip Rogaway and Thomas Shrimpton. Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance. Fast Software Encryption, 2004. doi:10.1007/978-3-540-25937-4_24

Cited on: Preimage resistance, Second-preimage resistance

J. Rompel. One-way functions are necessary and sufficient for secure signatures. Proceedings of the twenty-second annual ACM symposium on Theory of computing - STOC '90, 1990. doi:10.1145/100216.100269

Cited on: One-way functions exist, One-way functions exist

Steven Rudich. The Use of Interaction in Public Cryptosystems. Advances in Cryptology — CRYPTO ’91, 1991. doi:10.1007/3-540-46766-1_19

Cited on: Public-key encryption / two-message key exchange exist, Trapdoor functions exist

Pavol Rusnak, Andrew Kozlik, Ondrej Vejpustek et al. SLIP-0039: Shamir's Secret-Sharing for Mnemonic Codes. SatoshiLabs Improvement Proposals, 2017. github.com/satoshilabs/slips/blob/master/slip-0039.md

Cited on: Shamir secret sharing

Danny Ryan, Dankrad Feist, Francesco D'Amato et al. EIP-7594: PeerDAS - Peer Data Availability Sampling. Ethereum Improvement Proposals (Final), 2024. eips.ethereum.org/EIPS/eip-7594

Cited on: Blobs and data availability, KZG commitments, Reed-Solomon blob extension

Yumi Sakemi, Tetsutaro Kobayashi, Tsunekazu Saito and Riad S. Wahby. Pairing-Friendly Curves (Internet-Draft draft-irtf-cfrg-pairing-friendly-curves). IRTF CFRG, 2022. datatracker.ietf.org/doc/draft-irtf-cfrg-pairing-friendly-curves

Cited on: Discrete log on pairing curves, Discrete log on pairing curves

C. P. Schnorr. Efficient Identification and Signatures for Smart Cards. Advances in Cryptology — EUROCRYPT ’89, 1989. doi:10.1007/3-540-46885-4_68

Cited on: Schnorr / EdDSA

C. P. Schnorr. Efficient signature generation by smart cards. Journal of Cryptology, 1991. doi:10.1007/bf00196725

Cited on: Schnorr / EdDSA

C. P. Schnorr and M. Euchner. Lattice basis reduction: Improved practical algorithms and solving subset sum problems. Mathematical Programming, 1994. doi:10.1007/bf01581144

Cited on: Lattice problems: approx-SVP, BDD

Adi Shamir. How to share a secret. Communications of the ACM, 1979. doi:10.1145/359168.359176

Cited on: Distributed validators, Shamir secret sharing, Shamir secret sharing

Adi Shamir. A Polynomial Time Algorithm for Breaking the Basic Merkle-Hellman Cryptosystem. Advances in Cryptology, 1983. doi:10.1007/978-1-4757-0602-4_27

Cited on: A disguised easy knapsack looks hard, Merkle-Hellman knapsack, P ≠ NP

Adi Shamir. Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology, 1984. doi:10.1007/3-540-39568-7_5

Cited on: Identity- and attribute-based encryption

C. E. Shannon. Communication Theory of Secrecy Systems*. Bell System Technical Journal, 1949. doi:10.1002/j.1538-7305.1949.tb00928.x

Cited on: One-time pad

Peter W. Shor. Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer. SIAM Journal on Computing, 1997. doi:10.1137/S0097539795293172

Cited on: ECDLP, No large-scale quantum computer, Integer factorization, No large-scale quantum computer

P.W. Shor. Algorithms for quantum computation: discrete logarithms and factoring. Proceedings 35th Annual Symposium on Foundations of Computer Science, 2002. doi:10.1109/sfcs.1994.365700

Cited on: No large-scale quantum computer

Dan Shumow and Niels Ferguson. On the Possibility of a Back Door in the NIST SP800-90 Dual Ec Prng. CRYPTO 2007 rump session. rump2007.cr.yp.to/15-shumow.pdf

Cited on: Good randomness

V. M. SIDELNIKOV and S. O. SHESTAKOV. On insecurity of cryptosystems based on generalized Reed-Solomon codes. Discrete Mathematics and Applications, 1992. doi:10.1515/dma.1992.2.4.439

Cited on: Goppa codes look random, Reed-Solomon codes look random

Signal. Safety number updates. Signal blog, 2016. signal.org/blog/safety-number-updates

Cited on: You have the right public key

Signal. Signal Protocol and Post-Quantum Ratchets. Signal blog, 2025. signal.org/blog/spqr

Cited on: Signal

Daniel R. Simon. Finding collisions on a one-way street: Can secure hash functions be based on general assumptions?. Advances in Cryptology — EUROCRYPT'98, 1998. doi:10.1007/bfb0054137

Cited on: Collision resistance

Marc Stevens, Arjen Lenstra and Benne de Weger. Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities. Advances in Cryptology - EUROCRYPT 2007. doi:10.1007/978-3-540-72540-4_1

Cited on: MD5, SHA-1 are collision resistant

Marc Stevens, Alexander Sotirov, Jacob Appelbaum et al. Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate. Advances in Cryptology - CRYPTO 2009. doi:10.1007/978-3-642-03356-8_4

Cited on: MD5 / SHA-1 signed certificates, RSA signatures

Marc Stevens. Counter-Cryptanalysis. Advances in Cryptology – CRYPTO 2013. doi:10.1007/978-3-642-40041-4_8

Cited on: MD5 / SHA-1 signed certificates

Marc Stevens, Elie Bursztein, Pierre Karpman et al. The First Collision for Full SHA-1. Advances in Cryptology – CRYPTO 2017. doi:10.1007/978-3-319-63688-7_19

Cited on: Collision resistance, MD5, SHA-1 are collision resistant

T. Taubert and C. A. Wood. SPAKE2+, an Augmented Password-Authenticated Key Exchange (PAKE) Protocol. RFC 9383, 2023. rfc-editor.org/rfc/rfc9383

Cited on: PAKEs

SIKE team. SIKE: Supersingular Isogeny Key Encapsulation. 2017. sike.org

Cited on: SIKE

SQIsign team. SQIsign: Short Quaternion and Isogeny Signature. 2025. sqisign.org

Cited on: SQIsign

Thomas Thiery, Francesco D'Amato, Julian Ma et al. EIP-7805: Fork-choice enforced Inclusion Lists (FOCIL). Ethereum Improvement Proposals (Draft), 2024. eips.ethereum.org/EIPS/eip-7805

Cited on: FOCIL inclusion lists (EIP-7805), ≥ 1 honest inclusion-list member

M. Thomson and C. A. Wood. Oblivious HTTP. RFC 9458, 2024. rfc-editor.org/rfc/rfc9458

Cited on: ECIES / HPKE

How To Exchange Secrets with Oblivious Transfer. IACR Cryptology ePrint Archive, Paper 2005/187. eprint.iacr.org/2005/187

Cited on: Oblivious transfer

Serge Vaudenay. Cryptanalysis of the Chor-Rivest cryptosystem. Advances in Cryptology — CRYPTO '98, 1998. doi:10.1007/bfb0055732

Cited on: Merkle-Hellman knapsack

Kirill Vedenev. Extending Distinguishing to Key Recovery for Subfield Subcodes of GRS codes. IACR Cryptology ePrint Archive, Paper 2026/1747. eprint.iacr.org/2026/1747

Cited on: Goppa codes look random

Alex Vlasov, Kelly Olson, Alex Stokes and Antonio Sanso. EIP-2537: Precompile for BLS12-381 curve operations. Ethereum Improvement Proposals (Final), 2020. eips.ethereum.org/EIPS/eip-2537

Cited on: BLS signatures

Mullvad VPN. Stable quantum-resistant tunnels in the app. Mullvad blog, 2023. mullvad.net/en/blog/stable-quantum-resistant-tunnels-in-the-app

Cited on: Classic McEliece, WireGuard

W3C. Web Authentication: An API for accessing Public Key Credentials, Level 2. W3C Recommendation, 2021. w3.org/TR/webauthn-2

Cited on: P-256 ECDSA (passkeys)

Xiaoyun Wang and Hongbo Yu. How to Break MD5 and Other Hash Functions. Advances in Cryptology – EUROCRYPT 2005. doi:10.1007/11426639_2

Cited on: Collision resistance, MD5, SHA-1 are collision resistant

Kevaundray Wedderburn, Justin Drake, Ignacio Hagopian et al. EIP-8025: Optional Execution Proofs. Ethereum Improvement Proposals (Draft), 2025. eips.ethereum.org/EIPS/eip-8025

Cited on: Optional execution proofs (EIP-8025), Proof systems are sound and bug-free

Mark N. Wegman and J.Lawrence Carter. New hash functions and their use in authentication and set equality. Journal of Computer and System Sciences, 1981. doi:10.1016/0022-0000(81)90033-7

Cited on: One-time MACs

Stephen Weis. RSA-896. saweis.net, 2026. saweis.net/posts/rsa-896.html

Cited on: Integer factorization

Stephen A. Weis. Improving GIJS Key Recovery for Classic McEliece. IACR Cryptology ePrint Archive, Paper 2026/1984. eprint.iacr.org/2026/1984

Cited on: Classic McEliece, Goppa codes look random

Benjamin Wesolowski. The supersingular isogeny path and endomorphism ring problems are equivalent. 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS). doi:10.1109/focs52979.2021.00109

Cited on: Supersingular isogeny path

WhatsApp. Security of End-to-End Encrypted Backups. WhatsApp white paper, 2021. whatsapp.com/security/WhatsApp_Security_Encrypted_Backups_Whitepaper.pdf

Cited on: PAKEs

Gavin Wood. Ethereum: A Secure Decentralised Generalised Transaction Ledger. Ethereum Yellow Paper, 2014. ethereum.github.io/yellowpaper/paper.pdf

Cited on: Account addresses, Accounts (EOAs), ECDSA on secp256k1, Keccak-256 is secure, State, transaction and receipt tries

Thomas Wu. The Secure Remote Password Protocol. NDSS 1998. ndss-symposium.org/ndss1998/secure-remote-password-protocol

Cited on: PAKEs

Pieter Wuille. BIP 32: Hierarchical Deterministic Wallets. Bitcoin Improvement Proposals, 2012. github.com/bitcoin/bips/blob/master/bip-0032.mediawiki

Cited on: Key storage, Seed preimage resistance, Wallet seeds: BIP-39 / BIP-32

Pieter Wuille, Jonas Nick and Tim Ruffing. BIP 340: Schnorr Signatures for secp256k1. Bitcoin Improvement Proposals, 2020. github.com/bitcoin/bips/blob/master/bip-0340.mediawiki

Cited on: Schnorr / EdDSA

Andrew C. Yao. Theory and application of trapdoor functions. 23rd Annual Symposium on Foundations of Computer Science (sfcs 1982). doi:10.1109/sfcs.1982.45

Cited on: Trapdoor functions exist

Andrew Chi-Chih Yao. How to generate and exchange secrets. 27th Annual Symposium on Foundations of Computer Science (sfcs 1986). doi:10.1109/sfcs.1986.25

Cited on: Garbled circuits, MPC, dishonest majority

Scott Yilek, Eric Rescorla, Hovav Shacham et al. When private keys are public: results from the 2008 Debian OpenSSL vulnerability. Proceedings of the 9th ACM SIGCOMM conference on Internet measurement, 2009. doi:10.1145/1644893.1644896

Cited on: Good randomness

T. Ylonen. The Secure Shell (SSH) Protocol Architecture. RFC 4251, 2006. rfc-editor.org/rfc/rfc4251

Cited on: You have the right public key

T. Ylonen. The Secure Shell (SSH) Transport Layer Protocol. RFC 4253, 2006. rfc-editor.org/rfc/rfc4253

Cited on: SSH