@inproceedings {10.1007/978-3-031-29689-5_2,
	title = {Verifying Classic McEliece: Examining the~Role of~Formal Methods in~Post-Quantum Cryptography Standardisation},
	journal = {Code-Based Cryptography. CBCrypto 2022. Lecture Notes in Computer Science},
	volume = {13839},
	year = {2023},
	month = {03/2023},
	pages = {21{\textendash}36},
	publisher = {Springer Nature Switzerland},
	address = {Cham},
	abstract = {Developers of computer-aided cryptographic tools are optimistic that formal methods will become a vital part of developing new cryptographic systems. We study the use of such tools to specify and verify the implementation of Classic McEliece, one of the code-based cryptography candidates in the fourth round of the NIST Post-Quantum standardisation Process. From our case study we draw conclusions about the practical applicability of these methods to the development of novel cryptography.},
	isbn = {978-3-031-29689-5},
	doi = {https://doi.org/10.1007/978-3-031-29689-5_2},
	url = {https://link.springer.com/chapter/10.1007/978-3-031-29689-5_2},
	author = {Brain, Martin and Cid, Carlos and Player, Rachel and Robson, Wrenna},
	editor = {Deneuville, Jean-Christophe}
}
@inproceedings {28253,
	title = {FASTA {\textendash} a stream cipher for fast FHE evaluation},
	journal = {Topics in Cryptology - CT-RSA 2022 - Cryptographers{\textquoteright} Track at the RSA Conference 2022},
	volume = {13161},
	year = {2022},
	pages = {451-483},
	publisher = { Springer},
	address = {Lecture Notes in Computer Science},
	abstract = {In this paper we propose Fasta, a stream cipher design optimised for implementation over popular fully homomorphic encryption schemes. A number of symmetric encryption ciphers have been recently proposed for FHE applications, e.g. the block cipher LowMC, and the stream ciphers Rasta (and variants), FLIP and Kreyvium. The main design criterion employed in these ciphers has typically been to minimise the multiplicative complexity of the algorithm. However, other aspects affecting their efficient evaluation over common FHE libraries are often overlooked, compromising their real-world performance. Whilst Fasta may also be considered as a variant of Rasta, it has its parameters and linear layer especially chosen to allow efficient implementation over the BGV scheme, particularly as implemented in the HElib library. This results in a speedup by a factor of 25 compared to the most efficient publicly available implementation of Rasta.\&nbsp; Fasta{\textquoteright}s target is BGV, as implemented in HElib. However the design ideas introduced in the cipher could also be potentially employed to achieve improvements in the homomorphic evaluation in other popular FHE schemes/libraries. We do consider such alternatives in this paper (e.g. BFV and BGVrns, as implemented in SEAL and PALISADE), but argue that, unlike BGVin HElib, it is more challenging to make use of their parallelism in a Rasta-like stream cipher design.},
	keywords = {Homomorphic Encryption, Hybrid Encryption, secret-key cryptography, Stream Ciphers},
	doi = {10.1007/978-3-030-95312-6_19},
	url = {https://link.springer.com/chapter/10.1007/978-3-030-95312-6_19},
	author = {Cid, Carlos and John Petter {Indr{\o}y} and Raddum, H{\r a}vard},
	editor = {Galbraith, Steven}
}
@article {42489,
	title = {Influence of the Linear Layer on the Algebraic Degree in SP-Networks},
	journal = {IACR Transactions on Symmetric Cryptology},
	volume = {2022},
	year = {2022},
	month = {03/2022},
	pages = {110-137},
	publisher = {Ruhr University Bochum},
	doi = {10.46586/tosc.v2022.i1.110-137},
	url = {https://tosc.iacr.org/index.php/ToSC/article/view/9530},
	author = {Cid, Carlos and Grassi, Lorenzo and Gunsing, Aldo and L{\"u}ftenegger, Reinhard and Rechberger, Christian and Schofnegger, Markus}
}
@inproceedings {DBLP:conf/secrypt/OkadaKC21,
	title = {A Comparison of GKE Protocols based on SIDH},
	journal = {Proceedings of the 18th International Conference on Security and Cryptography, SECRYPT 2021, July 6-8, 2021},
	year = {2021},
	pages = {507{\textendash}514},
	publisher = {SCITEPRESS},
	doi = {10.5220/0010547305070514},
	url = {https://doi.org/10.5220/0010547305070514},
	author = {Okada, Hiroki and Kiyomoto, Shinsaku and Cid, Carlos},
	editor = {Sabrina De Capitan {di Vimercati} and Samarati, Pierangela}
}
@inproceedings {DBLP:conf/cans/ArmourC21,
	title = {Partition Oracles from Weak Key Forgeries},
	journal = {Cryptology and Network Security - 20th International Conference, CANS 2021, Vienna, Austria, December 13-15, 2021, Proceedings},
	volume = {13099},
	year = {2021},
	pages = {42{\textendash}62},
	publisher = {Springer},
	doi = {10.1007/978-3-030-92548-2\_3},
	url = {https://doi.org/10.1007/978-3-030-92548-2\_3},
	author = {Armour, Marcel and Cid, Carlos},
	editor = {Conti, Mauro and Stevens, Marc and Krenn, Stephan}
}
@inproceedings {27134,
	title = {Cryptanalysis of the Multivariate Encryption Scheme EFLASH},
	journal = {RSA Conference Cryptographers{\textquoteright} Track 2020},
	volume = {12006},
	year = {2020},
	month = {02/2020},
	pages = {85-105},
	publisher = { Springer},
	address = {Lecture Notes in Computer Science},
	abstract = {EFLASH is a multivariate public-key encryption scheme proposed by Cartor and Smith-Tone at SAC 2018. In this paper we investigate the hardness of solving the particular equation systems arising from EFLASH, and show that the solving degree for these types of systems is much lower than estimated by the authors. We show that a Gr{\"o}bner basis algorithm will produce degree fall polynomials at a low degree for EFLASH systems. In particular we are able to accurately predict the number of these polynomials occurring at step degrees 3 and 4 in our attacks. We performed several experiments using the computer algebra system MAGMA, which indicate that the solving degree is at most one higher than the one where degree fall polynomials occur; moreover, our experiments show that whenever the predicted number of degree fall polynomials is positive, it is exact. Our conclusion is that EFLASH does not offer the level of security claimed by the designers. In particular, we estimate that the EFLASH version with 80-bit security parameters offers at most 69 bits of security.},
	isbn = {978-3-030-40186-3},
	author = {{\O}ygarden, Morten and Felke, Patrick and Raddum, H{\r a}vard and Cid, Carlos}
}
@inproceedings {DBLP:conf/isw/OkadaKC20,
	title = {Integerwise Functional Bootstrapping on TFHE},
	journal = {Information Security - 23rd International Conference, {ISC} 2020, Bali, Indonesia, December 16-18, 2020, Proceedings},
	volume = {12472},
	year = {2020},
	pages = {107{\textendash}125},
	publisher = {Springer},
	doi = {10.1007/978-3-030-62974-8\_7},
	url = {https://doi.org/10.1007/978-3-030-62974-8\_7},
	author = {Okada, Hiroki and Kiyomoto, Shinsaku and Cid, Carlos},
	editor = {Susilo, Willy and Robert H. {Deng} and Guo, Fuchun and Li, Yannan and Intan, Rolly}
}
@inproceedings {DBLP:conf/indocrypt/CidHLS20,
	title = {Quantum Cryptanalysis on Contracting Feistel Structures and Observation on Related-Key Settings},
	journal = {Progress in Cryptology - INDOCRYPT 2020 - 21st International Conference on Cryptology in India, Bangalore, India, December 13-16, 2020, Proceedings},
	volume = {12578},
	year = {2020},
	pages = {373{\textendash}394},
	publisher = {Springer},
	doi = {10.1007/978-3-030-65277-7\_17},
	url = {https://doi.org/10.1007/978-3-030-65277-7\_17},
	author = {Cid, Carlos and Hosoyamada, Akinori and Liu, Yunwen and Siang Meng {Sim}},
	editor = {Bhargavan, Karthikeyan and Oswald, Elisabeth and Prabhakaran, Manoj}
}
@inproceedings {DBLP:conf/asiacrypt/AlbrechtC0KLRS19,
	title = {Algebraic Cryptanalysis of STARK-Friendly Designs: Application to MARVELlous and MiMC},
	journal = {Advances in Cryptology - {ASIACRYPT} 2019 - 25th International Conference on the Theory and Application of Cryptology and Information Security, Kobe, Japan, December 8-12, 2019, Proceedings, Part {III},
	volume = {11923},
	year = {2019},
	pages = {371{\textendash}397},
	publisher = {Springer},
	doi = {10.1007/978-3-030-34618-8\_13},
	url = {https://doi.org/10.1007/978-3-030-34618-8\_13},
	author = {Martin R. {Albrecht} and Cid, Carlos and Grassi, Lorenzo and Khovratovich, Dmitry and L{\"u}ftenegger, Reinhard and Rechberger, Christian and Schofnegger, Markus},
	editor = {Steven D. {Galbraith} and Moriai, Shiho}
}
@inproceedings {24080,
	title = {An Analysis of the Hermes8 Stream Ciphers},
	journal = {12th Australasian Conference on Information Security and Privacy, ACISP 2007 },
	volume = {4586},
	year = {2007},
	month = {08/2007},
	pages = {1-10},
	publisher = {Lecture Notes in Computer Science, Springer Verlag},
	abstract = {Hermes8 [6,7] is one of the stream ciphers submitted to the ECRYPT Stream Cipher Project (eSTREAM [3]). In this paper we present an analysis of the Hermes8 stream ciphers. In particular, we show an attack on the latest version of the cipher (Hermes8F), which requires very few known keystream bytes and recovers the cipher secret key in less than a second on a normal PC. Furthermore, we make some remarks on the cipher{\textquoteright}s key schedule and discuss some properties of ciphers with similar algebraic structure to Hermes8.},
	keywords = {Cryptanalysis, Hermes8, Stream Cipher},
	isbn = {978-3-540-73457-4},
	issn = {0302-9743},
	doi = {10.1007/978-3-540-73458-1_1},
	url = {http://link.springer.com/chapter/10.1007/978-3-540-73458-1_1},
	author = {Babbage, Steve and Cid, Carlos and Pramstaller, Norbert and Raddum, H{\r a}vard}
}
