The consequence for CRYPTO is that soundness bugs found at this conference are no longer academic findings about theoretical constructions. They are vulnerabilities in deployed financial infrastructure. A 2024 systematic review found that approximately 96% of documented circuit-layer bugs in SNARK-based proof systems trace to under-constrained circuits. At CRYPTO 2026, "Sumcheck-Based zkSNARKs are Non-malleable" (Faonio, Russo) provides an important formal security guarantee for a large class of practical SNARKs deployed in production; "Incrementally Verifiable Computation Without Extraction" (Jain, Mathialagan, Waters) advances the theory of recursive proof composition, which is the mechanism behind zk-rollup aggregation.
On the engineering side, papers by researchers from Google (Gurkan, Novakovic, Rothblum), Microsoft Research (Kothapalli, Setty), and multiple academic institutions are presenting improvements to the proof system performance that will flow directly into deployed systems.
Fully Homomorphic Encryption: Computation on Encrypted Data Edges Closer to Practical
Fully homomorphic encryption (FHE) — the ability to perform arbitrary computation on encrypted data without ever decrypting it — has been the "someday technology" of cryptography since Craig Gentry's 2009 breakthrough construction. The technical barrier has always been bootstrapping: the operation that refreshes accumulated computational noise in a ciphertext, which is necessary to enable unlimited depth computation but historically added tens of milliseconds of overhead per operation on CPU hardware.
That latency picture has changed. GPU acceleration — particularly on NVIDIA H100-class hardware — has reduced TFHE bootstrapping from tens of milliseconds to under a millisecond per operation. Apple ships FHE at consumer scale. Zama, an FHE company, became the field's first unicorn with a valuation above $1 billion following a Series B in June 2025. The practical deployment question has shifted from "can we make FHE fast enough?" to "which workloads can FHE now serve, and what engineering tradeoffs does each require?"
Volume II of this year's proceedings contains eight papers on homomorphic encryption, including two from Craig Gentry and his collaborators on FHE specifically designed for matrix arithmetic — the dominant operation in transformer neural networks. "Fully Homomorphic Encryption for Matrix Arithmetic" and its companion paper on efficient bootstrapping for that setting together target the workload that would make privacy-preserving AI inference genuinely practical: being able to run an encrypted query through an AI model without the model operator ever seeing the query's contents. For medical records, legal documents, and financial data, that capability has direct real-world value.
The threshold FHE paper by Kim, Lee, Lee, Passelègue, and Stehlé, "Asynchronous Lagrange-Based Threshold FHE with Smaller Modulus Overhead," attacks the overhead problem in distributed settings where multiple parties need to jointly compute on encrypted data — a requirement for privacy-preserving multi-party machine learning.
A Real Hack Gets Its First Rigorous Cryptographic Analysis
Among all 189 papers at CRYPTO 2026, one stands apart for combining formal mathematical analysis with an operation that produced more than 6,000 arrests across Europe: the 2020 Encrochat law enforcement hack.
Encrochat was an end-to-end encrypted communications platform sold on modified Android phones with the GPS, camera, microphone, and USB ports physically removed. The company sold the phones for roughly €1,000 to €1,500 (approximately $1,157 to $1,736 USD at the EUR/USD mid-market rate of approximately $1.157 as of August 15, 2026; conversions are approximate) for a six-month subscription. The platform was widely used by organized crime networks across Europe.
In early 2020, French and Dutch law enforcement deployed malware to Encrochat devices that exfiltrated historical messages and captured real-time communications over months, before the company became aware of the compromise. The data produced prosecutions in the UK, Netherlands, France, Belgium, and elsewhere, with courts wrestling over evidence admissibility under competing national laws.
"A Real-World Law-Enforcement Hack: The Case of Encrochat," authored by Martin R. Albrecht (King's College London), Sunoo Park, Michael A. Specter (Georgia Institute of Technology), and Douglas Stebila, is scheduled for presentation in Volume X and represents the most detailed public cryptographic account of what happened — how Encrochat's infrastructure was built, what the law enforcement "technical tool" actually did, and what formal adversarial model the operation corresponds to. The authors identify the hack with the model of a "covert adversary" — a concept between semi-honest and fully malicious, introduced at TCC 2007 — which has implications for how encrypted communications systems should be designed to resist state-level interference.
For encrypted messaging applications, device security firms, and legal practitioners working on digital evidence, this paper is not academic background material. It is a technical autopsy of the operation that set the terms for encrypted communications law in Europe.
Side-Channel Attacks and the Gap Between Proofs and Hardware
Volume VII contains what may be the most practically alarming single paper in the proceedings. "Robust Single-Trace Full-Key Extraction from Million-Point Traces With Cross-Implementation Transfer" (Gohr, Laus, Leander) demonstrates a deep-learning-based side-channel technique capable of recovering a full cryptographic key from a single power trace measurement — and then transferring that attack capability across different hardware implementations of the same algorithm.
Side-channel attacks exploit information leaked by a physical cryptographic implementation — timing, power consumption, electromagnetic emissions — rather than mathematical weaknesses in the algorithm. They are the primary practical attack vector against hardware security modules, smart cards, and embedded PQC implementations. The NIST post-quantum standardization process explicitly required side-channel resistance, but proving and achieving that resistance in real silicon involves engineering challenges that formal proofs cannot resolve alone.
"A Formal Security Proof of Masking" (Ueno et al.), in the same volume, provides what the authors claim is the first complete formal proof for a widely used hardware countermeasure — a result that matters precisely because masking's informal justifications have left the gap between proof and practice open for years. "Bypassing the Random-Probing Model in Masking Security Proofs" (Béguinot, Brian, Masure) identifies a structural gap between the standard formal model used for masking proofs and physical reality — meaning prior proofs may not protect real hardware as thoroughly as claimed.
What Else Is Coming Monday Through Thursday
The program spans ten volumes and covers ground well beyond the four areas above.
Multi-Party Computation (Volume VIII): Twelve papers address the full spectrum of MPC protocols, from information-theoretic two-party computation to asynchronous distributed settings. "Round-Optimal Black-Box MPC in the Plain Model from Minimal Assumptions" (Hajiabadi, Medepalli, Srinivasan) makes progress on a long-open question about the minimum interaction required for secure computation. "Just-in-Time-OPRFs and a Modular Framework for Fast Private Set Intersection" (Bellare, Ranjan, Riepel) targets private set intersection, a primitive with direct applications in contact tracing, fraud detection, and privacy-preserving data analysis.
Quantum Cryptography (Volume V): Fourteen papers address cryptography for and against quantum adversaries. "Anonymous Public-Key Quantum Money and Universally Verifiable Quantum Voting" (Çakan, Goyal, Yamakawa) constructs quantum monetary systems with strong anonymity guarantees. Two papers on certified deletion — the quantum ability to prove that data has been cryptographically erased — address a privacy property with growing regulatory relevance as data retention laws tighten.
Symmetric Cryptography (Volume VI): "A Robust Variant of ChaCha20-Poly1305" (Beyne, Chen, Verbauwhede) proposes a strengthened authenticated encryption standard used in nearly every HTTPS connection. If its security arguments hold, the paper may influence the next revision of RFC 8439.
Encrypted Messaging (Volume X): "Lattice-Based Updatable KEM for Group Messaging" (Alwen, Fuchsbauer, Mularczyk, Riepel) post-quantizes the TreeKEM ratcheting mechanism used in the MLS (Messaging Layer Security) protocol — the standard that WhatsApp, Microsoft Teams, and other applications are adopting for group end-to-end encryption.
Threshold Signatures (Volume II): With decentralized finance infrastructure increasingly relying on threshold signature schemes for custody, papers including "On the Adaptive Security of Key-Unique Threshold Signatures" (Ciampi, Crites, Komlo, Maller) close security gaps in FROST-style threshold signatures — the scheme used by multiple blockchain networks and hardware wallet implementations.
Who Is Running This Year's Conference
Program co-chairs Nadia Heninger (University of California, San Diego) and Mike Rosulek (Oregon State University) managed the review of 781 submissions, accepting 189. General Chair Mayank Varia (Boston University) is overseeing logistics.
Heninger is herself one of the most consequential applied cryptanalysts working today. Her 2012 paper "Mining Your Ps and Qs," co-authored with several colleagues, found weak RSA keys across deployed servers — a measurable fraction of keys — not because of flaws in RSA itself, but because of insufficient randomness during key generation in embedded devices. The finding led to emergency rekeying by device manufacturers and permanently changed how cryptographic key generation in constrained environments is implemented and audited. In 2026, the IACR named her a Fellow — its highest individual honor.
The Workshop on Attacks in Cryptography WAC8, running today at UCSB, is a conference she founded specifically to give cryptographic attacks on deployed systems — work often published in security engineering venues rather than theory conferences — a home at CRYPTO.
How This Conference Compares to Prior Years
CRYPTO 2025 accepted 156 papers from 643 submissions across eight Springer LNCS volumes. CRYPTO 2026 accepted 189 papers from 781 submissions across ten volumes — a 21% increase in submissions, a 21% increase in accepted papers, and a 25% increase in volume count. The ten-volume format is a record in the conference's 46-year history.
The growth is not merely arithmetic. The combination of post-quantum standardization creating urgent stress-test demand, zero-knowledge proof systems achieving industrial deployment, and the formal opening of neural network cryptanalysis as a recognized sub-field has produced what is, by any editorial measure, the most substantively significant CRYPTO agenda in recent memory. The largest prior volume counts were eight (2025 and certain prior years); reaching ten simultaneously with the neural network track debut is an editorial marker that the field's scope is genuinely expanding, not just the same work growing in volume.
Practical Notes for Attendees
On-site registration is available at the Corwin Pavilion Lobby for in-person attendees who missed the online registration window. On-campus housing at Manzanita Village can be arranged at the De Anza Resource Center Building's 24-hour front desk. Long-time attendees should note that the dining location has changed this year to Carrillo Dining Commons. Hotels are not within walking distance of campus; per the official UCSB campus travel page, the university no longer provides airport shuttle service.
The Rump Session — CRYPTO's informal tradition of short, often humorous talks on preliminary results and community news — is scheduled for Monday evening, August 17, with a submission deadline of 22:00 PDT that same night. Talks will be recorded and posted to the IACR YouTube channel following the conference.
Virtual attendance is available for those unable to attend in person; virtual attendees should contact General Chair Mayank Varia directly via the conference contact page.
Currency conversions in this article are approximate and reflect the EUR/USD mid-market rate of approximately $1.157 as of August 15, 2026.
Frequently Asked Questions
Is CRYPTO 2026 related to cryptocurrency?
No. CRYPTO is the 46th Annual International Cryptology Conference, organized by the International Association for Cryptologic Research — the academic body for mathematical cryptography research. It has run since 1981 and predates modern blockchain technology by decades. The papers at CRYPTO 2026 cover lattice mathematics, zero-knowledge proofs, fully homomorphic encryption, quantum cryptography, and protocol analysis. Some of those techniques — particularly zero-knowledge proofs — are now used in blockchain systems, but the conference itself is an academic mathematics and computer science gathering with no financial industry affiliation.
What does it mean that post-quantum standards are being "stress-tested" at this conference?
NIST published three post-quantum cryptographic standards in August 2024 based on the hardness of mathematical problems in lattices — particularly the Module Learning with Errors (MLWE) problem, which underlies CRYSTALS-Kyber and CRYSTALS-Dilithium. The papers in Volume III of this year's proceedings include new quantum algorithms for lattice sieving and new analyses of the security gap between MLWE and standard LWE. If any of these results dramatically reduce the effective security level of the NIST-standardized schemes, it would require adjusting key sizes or, in a worst case, emergency rekeying of infrastructure already deployed. The papers being presented are the cryptographic community's routine but consequential check on whether those standards were set at the right security levels, as documented in the Springer proceedings for CRYPTO 2026.
What is a zero-knowledge proof and why are so many papers at this conference about them?
A zero-knowledge proof, first described in a 1985 paper, allows one party to mathematically convince another party that a statement is true without revealing any information beyond that truth. For example, a user can prove to a system that they know a password without revealing the password — or prove that a transaction is valid without revealing the transaction details. Zero-knowledge proofs first appeared in a 1985 theoretical paper; by 2016, efficient constructions (zkSNARKs using the Groth16 algorithm) made them practical for blockchain applications. They now underpin layer-2 scaling systems on Ethereum that handle significant transaction volume. Because these systems handle financial value in production, mathematical soundness bugs found by CRYPTO researchers are immediately consequential. Volume IX's 20 papers represent the community's continuing effort to ensure those production proof systems are as sound as their proofs claim.
What is the significance of neural network cryptanalysis appearing as a named track?
For most of CRYPTO's history, neural networks were either tangential or treated as tools to aid classical attacks. This year's dedicated track on neural network cryptanalysis treats trained AI models as the subject of formal mathematical analysis — applying the same algebraic and computational hardness frameworks that cryptographers use against ciphers to neural network architectures. Papers include techniques for algebraically attacking convolutional neural networks and for extracting model weights through carefully chosen queries, without any access to the model's internal parameters. The appearance of this as a named track — visible in the CRYPTO 2026 conference program — signals that the cryptographic research community officially recognizes AI systems as both tools for and targets of rigorous mathematical attack — with direct implications for how AI intellectual property, model provenance, and AI security should be evaluated.
