Rump session part I (Eurocrypt 2026)

Welcome all of you to the RAM session of Euroquip 2026 in Rome. We are very happy to be here and uh there's an amazing program and uh let's start. So we are Gregor and Maria and uh these are the rules of uh of the RAM session. The program is already online in the Euroquip page of the RAM session. So you can find it there if you want to know which are the sessions you are more interested in seeing. And we allowed different times depending on the talks. We had to cut out uh time of everyone because there was not enough time. So we are even more late than what we would have been. And any we are going to be very strict with the time and any presenters that will exceed their time will be eaten by lions. We'll throw them to the lions. [applause] So we have two amazing, very hungry lions there. And uh please stay on time. So there will be several awards during the RAM session for the different talks that we will be seeing. There will be the most entertaining talk, the best serious, the paroti award, the most Italian talk and the best gladiator. And uh these are the different awards that will be given. So this amazing dog that most of you heard a bit annoying but uh yeah very nice will be awarded to the best serious dog. Uh, the priority award will receive a karaoke microphone. There's a t-shirt and some pasta for the most Italian talk, whatever that means. And uh, for the best gladiator, so the most brave uh, or the most gladiator talk or the most brave against our alliance, there will be this amazing new costume for staying a good gladiator. And uh, for the most entertaining talk, we have this very nice hat. and uh some sweets. Nice. So yeah, wait >> what you have to say >> the quiz. Sorry. >> Ah yeah. Uh there will be a quiz. So please uh take time to scan this QR code and because most of the no half of the people are still downstairs drinking maybe you can take a picture also and share later. Um you will be able to enter the solutions and um and nothing. No. And there will also be a prize for the best uh um person for the person who best answers the quiz. And this will be this thing. >> A bag. >> It's a It's a bag. You can put things inside. Uh okay. And here um comes the first um quiz question already. So who are these two cryptographers? And the hint is they are both attending uh this conference in a very specific role. And also important to say um for all the speakers we are really short on time and we if you don't want to get eaten by the lions before going on stage get ready as soon as you get see your name here name here and uh check the time. Uh yeah and so the first talk is going given by Yuan and Emmanuel for the program chess report. >> [cheering] [applause] >> Yeah. Is this on? Yes. Okay. Um a Yes. So this is the report of the program chairs. Usual the first talk in the rum session. It's not a funny talk. Um so we had this year 700 submissions. So we don't only have a record in number of participants but also in number of submissions and it goes up every year. So you can see it's really exponential growth. Um we had 12% increase related to last year and 83% by 5 years ago. So it's a trend everywhere. So yeah, where does this go? Go up goes up. Um this is some statistics about the number of authors per submission. Nothing really special. We see that we have um let's say 12% of um single author papers. Then typically here most papers are and then you see at the high end there are papers with 10 11 authors that's really teamwork. Uh this is another graph that's not the number of authors per submission but number of submissions per author. So of the um 1700 authors 535 have more than two papers two or more papers and even 22 authors have more than six or more papers. So this is a logarithmic scale. So don't let this fool you. But you have here a lot of uh papers. Um yeah, it's maybe um submitting many papers a bit strange. Also, apparently people that submit many papers, some of them are aware that they're doing that because they give different email addresses for the different submissions. That's actually not funny. Um this is uh the graph of the number of pages. So you got a minimum of eight pages, the shortest paper and the longest had 186. Um so the mean is 46.7. So if you make the math is 32,000 paper pages submitted. Um about half of the paper so the the the median is here. So more than half of the papers have 10 to 150 pages of supplementary material. Um and this is the line can that we would like to see only 20% of the papers are below 30 pages. So they typically have 27 pages or less material. Okay. Then the program committee we had 104 program committee members. Uh we sent to get them more than 200 invites. So we had slightly over 50% turn down. Um we started inviting in May so about a year ago. On June 11, we only had 61 people in and 74 had already declined or did not answer and it took until mid July when we got our PC complete. So we don't have formal statistics but most people gave us a reason that they were overcommitted and we were asking for 20 uh reviews per committee member. So that was maybe one of the reasons and also the restrictions on the number of submissions by uh PC members. These are them. I'm not going to read them because we don't have the time. So now we continue with Emanuel. Okay. Thank you. So I'm the one who is going to be sworn to the lions if I go over time. Um so the reviewing was split into different areas. Uh so you can see the list of program chairs of area chairs. Uh so we basically copied over the areas from uh your crypt 25. Uh but some of the areas are very connected to each others and the boundaries are very pious. Um so uh in the beginning the authors um I mean you authors have given uh your primary area of preference but we did not necessarily assign your paper to the area chair you you thought uh you would end up with because uh there could be conflicts because we had to load balance uh and so on and so forth. So uh there was some kind of uh handpicking of uh how to best balance uh the load. Uh we assigned every submission to three PC members. Uh the submission by uh PC members actually had uh three four PC members uh uh assigned and in total uh the work was that we had over 2,000 reviews made and basically half of them were done by external reviewers. Uh so thank you to uh the sub reviewers who participated in uh making this happen. So there's a usual set of headaches of uh PC chairs. Uh so we have layout rules that uh everybody must abide by uh not only those who choose to uh and I know it's not pleasant for everyone but we have to be fair to all also. So we have to pay attention to whether people are actually respecting the rules. So we flagged uh some papers uh who went overboard with cheating on the margin or sort of things. Uh so I mean Kevin usually puts it like you suck at tech. I mean I double down on this. You really suck at tech. Uh, and my personal favorite is this one, which if you read it correctly, misses a pair of braces and means that your whole paper is going to be typet in back slash small. Game over. I mean, I'm sorry, but I mean people have to learn. Uh, okay. And then some usual things like, uh, we had a few reviews that were turned in late. Some of them very late, some of them very very late, and some of them not at all. Well, to be fair, sometimes it's for good reasons. Um, okay, total numbers. Uh, we had 700 original submissions, which which was, uh, actually spot on on my prediction. Uh, I'm pretty happy with it. And then we had, uh, the usual trend of, uh, early rejecting some papers, keeping them for rebuttal, and so on and so forth. And at the end of the day we had 143 papers accepted. Actually one of them withdrew uh after acceptance because there was a bug. So which is why you have 142 papers in the end. Uh farming out uh people uh shy away from the fact of farming out reviews. Uh some people don't. So you don't have to be shy as a PC member if you farm out reviews. uh basically everybody is doing that to a certain extent. I would certainly not recommend farming out all of your reviews of course but the truth is that uh basically um many people are farming out uh half of the reviews. Uh the mean is that uh yeah people have uh farmed out half of the reviews. So this is the hot crap procrastination graph. So this is the curve all PC chairs want to see and this is what we sometimes see. Uh and I mean no news here basically I think every conference has this kind of trend. Um yeah it doesn't look that bad in the end. Uh okay. Uh we asked the PC members uh the area sorry to nominate uh their preferred PC members. So we had a list of PC members who were uh nominated for their outstanding work and uh we also as PC chairs appreciate uh the work of uh PC members who were super early in turning in their reviews. So, thanks a lot to all of them for their outstanding work. It's super important. [applause] Uh we also did some counting and found out that uh some sub reviewers were solicited a lot and by a lot I mean some of them did uh more reviews than some PC members did. So um it could be for a variety of reasons but uh again thanks to you as a subreers for putting in that much work into UC. [applause] We also did some funny math on um the total cost of the review process. So it could be off by a factor of two. But total uh the order of magnitude is certainly correct that uh the human effort that is put into reviewing for UCIP is of the order of magnitude of€2 million euros which is basically the budget of a of an ERC grant. So it's a big thank you to all of you in the community who have part participated in doing that because I mean it's we know that it has some uh significant cost uh right and uh final thanks go to uh many people so our preceding chairs of EC25 search fair and pieruk the board of directors and the ethics committee who were responsive uh to our requests Uh we did artifacts and some of you actually earned an artifact for your crypt and uh thanks to the artifact committee. Uh thanks to general chair, thanks to Kevin and Kay for running all that software and thanks to Maria and Gregor for not throwing me to the lions yet. [laughter] Now you can I'm done. Uh yeah, [applause] >> thank you. So the second question of the quiz is uh this cryptographer is known for proposing amongst other and the next speaker Nadim uh you're expected here. Please for the next speakers try check the program online and try to be closer to the to the scenario and come back quicker not to let too much time to the others for the questions. slides. Okay. Hi, Cedar Crypt. It's happening. You can be there. Yes. Cedar Crypt, Lebanon's first applied cryptography conference in Cyprus because that makes sense. So, it's mostly so that you don't die, which you wouldn't believe it, but that makes it really hard to organize a conference if that's a risk. Uh we're doing it in Cyprus. Um it's a great city. Look, beautiful old Roman columns and things like that. And so we're having an excursion the day before and you can come and be part of the excursion and go to the beach and to Colossi Castle in the Lima Soul Marina. But what's more, the program is amazing. We were very lucky to have uh many of people here in the audience submit amazing proposals for fantastic talks, a great uh show of confidence in this inaugural event including a keynote by Bart Pineal. uh great talks by many people here in the audience including for example uh Yash um Miscondi Hussein Hafazi Jako Mofenzi uh many other distinguished uh researchers giving all sorts of talks this is a fantastic program for which to inaugurate a conference uh like a new conference in a new region and why are we doing this we're doing this to infranchise people from Lebanon from the surrounding Levventine region from the Middle East and North Africa region uh we got unbelievably generous sponsorships from uh Zama, PQ Shield, Electure 53, Passbolt, and many uh anonymous private individuals. And I'm flying in all of my Lebanese cryptography, well, many of my Lebanese crypto because there's 55 of them last semester. Many of my Lebanese cryptography students on a plane. They're all coming on a big plane. We booked pretty much the entire plane to attend this conference. For many of them, it's their first time on a plane, uh first time out of the country. And this is why you should consider attending because we need to make this a truly international experience for them. This is a really cool thing. You can be part of this. You have nothing to lose. It's in a fantastic venue. You have my personal guarantee that it will be a wonderful conference. You have my utmost guarantee on that. It's uh a great program. We have a great excursion as I stated and it's really just waiting for you to come and be part of it. have a great time on the beach in Cypress and meet my students. And what's more, the ticket doesn't cost €1,300. Isn't that incredible? It's actually about 10 times less than that. [applause] So, that's pretty great. I have many flyers. You know what's really great about these flyers? There's a free beer coupon inside. If you actually take one of these flyers and give it to the person at the bar, I guarantee you that they will give you an alcoholic drink of their choice and that it would be precisely because of this flyer. Believe me on that. Thank you very much. Cedarcrypt. Register today. cedarcrypt.org. Do it. I'll see you there. [applause] >> So next, so what is the name of the ISI president? And next uh proof is next talk. Next next talk is proof of syncing. Hello. >> This is really cool. >> Okay. Please choose A, B, and D. >> Your time is running. No. >> Is it? >> Yes. >> Okay. Sure. Uh, hello everyone. My name is Dian. Uh, today I'm going to talk about proof of thinking. How to convince your advisor advisor you did theory work. So I'm a PhD student from the University of Toronto. Oh, this work is not associated with University of Toronto. Uh there's al also Italian translation because I noticed there's the most Italian award. I'm not trying to wing it, but I just want to tell other people it's not easy to wing it. You have a competition. Okay. Uh let's describe the scenario. Uh so um my advisor Ashray he told me that after your crypt he's going to India to take photos of wild lives uh which is one of his hobbies. So uh these two pictures are actually from his uh website. Uh you can check it out. So yeah so I'll say awesome. I'll just try some new ideas on our research project. Uh but as all of you know uh as a PhD student what do we do? we just relax and take a vacation. So two weeks after we have a meeting uh what's the progress? So I told I told him I tried some new ideas but none of them worked. So this looks suspicious. So actually might be thinking I think you didn't do anything but I don't have a proof. So we cryptographers love proofs. So and uh a problem is that uh a lot of our work is theoretical. We're just doing like a thought experiments and it's hard to quantify. So here today I'm proposing proof of IDEID work uh as l landscape uh of research is changing with uh like LM tools like chat GPD and uh cloud uh so I just use from chat GPT. So what we do is like when you're trying to verify some ideas uh nowadays we just talk to child GPD I throw some ideas and let's see if that works out or not right uh sometimes it doesn't work out but uh you know there's like a sharing link so you can actually uh obtain a link and uh what you do is you send this to your advisor and uh yeah I think that's that's uh like uh that's that's indeed some work actually not but okay so so here we propose it's a non-interactive proof of thinking or proof of work so the prover we just uh record our failed attempts and thought experiments uh by conversations with try GPD and share the link with your supervisor or collaborator so the verifier just do some random check uh so and see if the uh if the questions I asked or the conversation I had with CH GPD is good. If it's reasonable, then that actually means I did some work. Uh so to make my submission to the ROM session not be rejected, I have to do some analysis. Uh so for completeness uh so yes, if I did some meaningful work, I try to verify my ideas and yeah this can be easily identified. Uh of course this is a proof sketch. Uh so for soundness uh so I could cheat by asking random questions or just uh asking some stupid questions but that can be caught fairly easily. Just remember that. Okay. So sickness we used tragically summarized conversation zero knowledge. Okay. Let me quote from [laughter] Okay. Thank you everyone. [applause] Thank you very much. [applause] Who are these two people? I give you a few seconds to read. >> Okay, you can just start. clip. Okay. Hi everybody, me again. Um, so I just wanted to announce um a workshop that's organized by the international um center for mathematics in Ukraine. And this workshop um is called mathematics in the real world. Um and it's one of the days of the workshop is uh dedicated to cryptography. There's also a day on quantum computation, a day on um on AI and machine learning and a day on like combinatorial optimization. So all the things that the the mathematicians think are the real world. Um so this workshop is going to happen simultaneously in KF Ukraine and also in Odenz Denmark. Um and the crypto day will feature a keynote uh by Stefan Zimbovski and I will be there as well. Um so if you um so so we're we're trying to kind of uh encourage a community of Ukrainian mathematicians and um mathematician adjacent researchers such as cryptographers. Um so if you have if you are interested in uh you know collaborating with Ukrainian um researchers or if you are yourself uh from Ukraine or if if you have students from Ukraine or if you if your friends have students from Ukraine or if your students have friends from Ukraine who would like to participate in this, let me know. [applause] >> [applause] >> So the question is who is this ICRI fellow? And the hint is he has the person still has colorful shirts. All right. Can you hear me? Good. So um you know this is my first time in a cryptography conference so I was very excited to learn about all this stuff you guys are doing encryption p oram anonymous communication private search and the goal seems to be that the adversar's posterior distribution should be negligibly close to the prior after observing the protocol transcript so this makes sense to me but what I observe is that many of the protocols that people are proposing are very expensive and I just don't think they need to be. So, welcome to the year 2050 where we're going to have widespread collection of data. We're going to know what your transactions are, traveling, web search, how much money ISCR has in his bank account. You know, this is going to allow us to train massive predictive models with nearperfect priors. So, in 2050, I claim that the plain text will be asically as good as the cipher text and in particular in the the ideal world and the real world will be indistinguishable. So here's an example with P. So assume that we have a super predictor LLM. This is going to be my auxiliary input. Then the conditional entropy is going to be sort of close to zero. So we can just build a simulator that ask the LLM, hey, what is you about to ask? And the simulator is going to say the user is going to ask for query 42. And the simulator is just going to output index 42. And the distributions of the real and the ideal world are going to be sort of close. Now you might not believe me. So here's another example. Uh, today in 2026, lots of protocols to hide access patterns for search. In 2050, the LLM is going to know that I'm depressed. It's 2 am. I don't have ice cream. It doesn't really need to learn leak my search history to know that I want ice cream. In fact, it already suggested it to my smart fridge. Okay. So, I know you have many cons concerns like I'm just saying that the adversary already knows the secret. Uh, yeah, but that's the point. Crypto only protects surprise. If ML kills the surprise, it also kills the utility of the encryption. Now you might say u the transcript leaks the message. Well, not really. The transcript leaks the negligible remaining entropy in that there is. Now what about semantic security? Well, what about it? The definition holds just fine. Now I know you have some objections like what if the user does something unpredictable, right? Well, I claim this is not a failure of the protocol or the model. It's a failure of the user. So what we do is we recalibrate the user via targeted advertising until their entropy returns to acceptable levels and then at that point my protocol holds. So 20th century cryptography assumed that secrets existed. 21st century machine learning is dedicated to ensuring that they don't. So if human intent has zero entropy, just use the plain text. is faster, cheaper, and satisfies all existing security definitions. [applause] So the next question is to identify this cryptographer who built the fastest DS chip with 32 megabits per second. And the next speaker is here. I have this. Thank you. >> You don't need a >> No, I need a clicker and I need volunteers. >> Seriously. So, please, who wants to come and sing this song with me? And I'm serious. Elena is coming now. Ian Dangar will come. Okay. Why? Why are these people coming? These people are coming because we did this. We did this eight years ago. Oh, come on. Look at this picture. Bernardo's coming. Okay. Well, it is what it is. >> Okay. Come on. Really? No one else. All right. That makes it easier. We get the power awaren. [laughter] Okay. So, this is for the for the crowd. Okay. And so, we did this eight years ago. Oh, it says um it says uh seven, but it's eight. Does it sound over there? [music] Is that okay? Or up? >> Okay. Yeah. Yeah. This is a travel guitar. I get some tunes. Yeah. Thank you. Got it. Okay. So, let's let's sing this song together. The lyrics are going to be here. Aranchi is helping us with the slides. And I want you to clap, please. >> [bell] [music] [bell] [music] >> And here's a [singing] little I might have to check it forward. [music and singing] So don't worry, be happy. >> [music] >> In every [singing] product there be some trouble but when you hit submit [music] you make it double. So don't worry, be happyoo. [music] [singing] [music] [singing] Once again. Oo, I forgot [music] to submit today. [singing] Somebody else took the credit away. So don't worry, [music] be happy. says [music] I submit it too late my paper [singing] in terrible state so don't worry [music] be happyoo [music] [singing] don't worry be Happy night. [music] I got no cash. I got no front. That's why I have to sing in this terrible band. Don't worry. Be happy. Cuz when you [singing] worry, your [music] paper will round and I will make your advice to frown. Don't worry, [music] she's happy. Woo! Don't worry, don't worry. Oh, [music] don't worry. [singing] [music] Okay, let's slow down a bit. When you wake up [singing and music] and feel too stressed, just be yourself and don't feel pressed. Don't worry, be happy. And to conclude this little song, write [music] your papers all night long. Don't [singing] worry, do krypto. Woo! Oh, [singing] [music] maybe ooh. Woo! [music] [applause] [music] [applause] [cheering] Woo! Congrats. [applause] Good. >> Thank you very much. Fantastic. Also a good idea to make the lion dance instead of eating it. >> Uh, next question. Which gift was given at an ICR conference? >> Is it on? Yeah. Okay. But I want to be eaten by the line. So that's fine. [laughter] Okay. Yeah, that was a fantastic performance. So uh hard job for me now. Uh so I want to uh present to you a project that we started in BH like three years ago and we have a lot of fun with it and there's a lot of students involved. So, you know, we crypto guys, we invent these cool protocols. We make this world more secure and that's all good, but being all good all day is also a little bit boring, right? We remember when you were a kid, you also constructed things, but then you freaked out and you destroyed everything and you had a lot of fun with it. So, we also have fun with destroying crypto and that's why we came up with this book challenge page. So you can read off what it is. The purpose of of our challenge is to encourage crypto analysis of medium-sized instances of postquantum schemes and we started with Kyper like three years ago and then uh well basically every year we add some more challenges mis and mayo and maybe I jump to the Kyper challenges to give you an impression of what's going on. So you here you see a list of these challenges. So uh there's Kyper dimension 192 and 208 and this list is green means solved and blue means unsolved and our strategy was well people will solve it and uh once uh they solve too much we come up with new challenges and you see this strategy was actually destroyed here and this will be one paper at the zero conference on on Thursday and I will uh tell you who destroyed So I did actually so so last November um Su Sao and Gintaing they wrote me an email and said well we solved your Kyper two 208 and I said oh well that's impressive congratulations and so on and then they told me we'll come up with new uh solutions of your your challenges and then basically nothing happened and I thought well you cannot do it okay but now uh they solved actually the last one which is very impressive So the 256 and they will talk about it uh on Thursday in the latest two session and uh maybe here's solutions in the hall of fame. So here's actually what they did. So you see the 256 and you see we also embedded some real solutions. So that's your award. If you solve our uh our challenges then you get a real plain text and uh people told me that they are very happy to see this real plain text and I would be happy if many of you actually try to break these things let space we come up with new ones right uh it's not a problem to generate more and there's more to do for me and Mario so uh please uh discover your evil side and break some of your challenges that makes us happy thank you very >> [applause] >> And the next question is this cryptographer has most co author among all of IACR. Next talk which is the last talk of this session and then we will go to the break. >> Okay. Uh ladies and gentlemen, I want to present the in one sentence global quantum states can carry information that every local projection provably erase this. It means the secrecy can arise purely from the geometry of quantum states. It means no hardness, no disturbance test, no bounded adversary. The primitive is the facto family of states whose global separation is appears under all states. It means if we we have some text which is in this hbert space it means the security condition is like here is written and local views are identical but global states are distinguishable. It means information exists only globally but vanishes under every anthropist operations. It means in our geometrical cipher projection invariant instability here protects against information leakage here geometry of Hbert spaces itself. It means that security is invariance under local projections. Hilbert space geometry is not mere notation for quantum mechanics. It is the facto a cryptography resource. This is based on this paper but inspired by old mathemat machine gator. Thank you very much for your attention. [applause] >> Thank you very much. Thank you.