Sedat Akleylek
sedat.akleylek at ut dot ee
The projects are suitable for all degrees (BSc, MSc, PhD).
A Comparison of Post-Quantum Symmetric-based Signature Schemes
The task is to understand the symmetric-based signature schemes submitted to the NIST Post-Quantum Cryptography Standardization Project. The signature schemes are Picnic, AIMer, Ascon-Sign, FAEST, SPHINCS, SPHINCS-Alpha [1,2,3]. At least 3 signature schemes are selected for both theoretical and practical comparison. The comparison includes performance analysis (running time, etc.) and the structural similarities/differences.
[2] https://csrc.nist.gov/Projects/pqc-dig-sig/round-2-additional-signatures
[3] https://kpqc.or.kr/competition_02.html
A Report on the Host-Based Intrusion Detection-Prevention Systems
A host-based intrusion detection system (HIDS) monitors and analyzes the internal activities of a computer system, including network traffic on its interfaces, similar to a network-based intrusion detection system (NIDS). Unlike NIDS, which focuses on overall network traffic, HIDS specializes in detecting internal threats by tracking host activities. The task is to classify the machine learning and deep learning methods used in HIDS, provide details on the datasets, define their advantages/disadvantages, and compare them based on success rates.
A Survey on Lattice Sieving and Enumeration Algorithms
Lattice-based cryptography has been used to obtain efficient quantum-secure cryptographic primitives. The hardness of the underlying lattice problems, such as the shortest vector problem (SVP) and the closest vector problem (CVP), is evaluated using enumeration and sieving algorithms. In this project, the aim is to present a survey of the state of the art in lattice sieving and enumeration algorithms, with emphasis on time and area complexity. Then, a tool will be implemented for each hard problem to check the security claim.
A Report on the Formal Analysis of CDOC2
This topic will define the threat model, trust assumptions, and security requirements for the selected CDOC2 configuration, covering client applications, recipients, and key-management services. Core protocol flows, including key derivation, recipient key protection, and authenticated retrieval of key material, will be formally modeled using Tamarin/ProVerif/Maude. The analysis will assess data and key confidentiality, container integrity, and recipient authorization within the defined symbolic model. Replay, impersonation, message substitution, and selected key or server compromise scenarios will be investigated to identify potential weaknesses and the conditions under which security properties hold. The activity will deliver reproducible formal models, verification results and any unresolved properties, validated attack traces where identified, and mitigation recommendations assessed through subsequent model revisions.
Maiara Bollauf
maiara.bollauf at ut dot ee
Learning with Errors: Which Error? (Taken!)
Learning with errors (LWE) is a fundamental problem in lattice-based cryptography. It involves recovering a secret from a system of linear equations to which small errors have been added. These errors are sampled from a specific probability distribution. The choice of distribution affects security reductions, resistance to attacks, implementation cost, and decryption reliability. This project studies error distributions such as the discrete Gaussian, centered binomial, and uniform distributions. The student will learn the mathematical foundations of LWE, implement toy LWE instances, and experimentally compare selected attacks under specific parameters. The objective is to identify and explain how the choice of error distribution affects the difficulty of solving LWE instances.
Level: Suitable for master's students interested in lattice-based cryptography. Mathematical background in linear algebra or abstract algebra, and programming skills are welcome!
Toomas Krips
toomas.krips at ut dot ee
The projects are suitable for Masters or PhD level.
Phases of MPC
In some constructions used for MPC (secure multiparty computation), there are techniques where one computes a moderate-size (think in the order of magnitude of a million nodes) tree where at each node one computes t children of the node by computing some pseudorandom function. Often t=2. GGM trees and function secret sharing are two common examples. These protocols have two phases, and often people look at just the second phase, which is called the evaluation phase. However, to do the first phase, the setup phase, separately from the second phase, one would either need a trusted third party or to compute it over MPC. However, evaluating common PRGs such as AES is very expensive over MPC. We are wondering whether there might be sense in trying a PRG that is defined as $PRG(x)=g^x$ for a fixed g over some ring. In that case one can precompute a lot of values $g^{2^i}$ that might be helpful in the evaluation and plausibly, be faster than computing AES over MPC.
The task of the student would be understanding the problem, doing an implementation of the setups and comparing the different phases. Alternatively, for a more theoretical side, the student could try to understand more deeply whether this approach would be valid security-wise. For a larger project, the student could do both.
Failure Modes of a Shuffle
Some time ago me along with Abdolmaleki, Fauzi and Siim published the paper "Shuffle Arguments Based on Subset-Checking". (https://eprint.iacr.org/2024/1056) In this paper we proposed a method of proofs-of-shuffling (A proof of a shuffle is the following problem. Suppose that there is a public list of (randomized) ciphertexts. A potentially malicious Prover will take these ciphertexts and rerandomize them and change their order and output this new vector of new ciphertexts. Now she will have to prove to a potentially malicious Verifier that she did everything correctly without the Verifier learning anything except whether the prover cheated or not). We proposed two versions of the same shuffle: the lite version, which makes certain somewhat unrealistic assumptions about the inputs, but is very efficient. The full version is secure under very realistic assumptions, but it is several times slower.
The task would be to study what happens to the lite version of the algorithm when its unrealistic assumptions are somewhat broken and how badly will this effect the security of the whole algorithm. It is possible to model the unrealistic assumption as a small number of parties misbehaving - would then the problems be contained to the outputs of the misbehaving parties? This project could be also be a first step in a Masters thesis.
Using Pairings with Homomorphic Secret Sharing
Homomorphic secret sharing allows us to evaluate circuits where you can add values in memory slots and you can multiply an input value with a memory value to get a new memory value. Pairings often can give us one multiplication more, could we use pairings to slightly expand the class of circuits that are evaluatable with HSS?
The students task would be to understand the underlying constructions of homomorphic secret sharing, primarily the one with a non-negligible error probability. They then would need to understand pairings as a black-box primitive and see whether one can evaluate wider classes of primitives by using pairings.
Peeter Laud
peeter.laud at cyber dot ee
Trilithium
We have the (2+1)-party implementation of ML-DSA called "Trilithium", based on MPC techniques, which in turn are based on additive secret sharing. The implementation has recently been updated, where hardness assumptions were replaced in the evaluation of the challenge generation operation (i.e. execution of SHAKE on the to-be-signed message and the commitment message) with privacy-preserving evaluation, this time using garbled circuits. Trilithium is implemented in Rust, the garbled circuits come from https://github.com/GaloisInc/swanky/tree/dev/edge/schmivitz .
There is one more thing where Trilithium differs from the actual FIPS-204 specification of ML-DSA. Trilithium generates the ephemeral secret randomly, while FIPS-204 states that it must be generated pseudorandomly, by applying SHAKE to a short random seed. The goal of this seminar project would be to make this change to Trilithium: let it create the ephemeral secret invoking SHAKE with garbled circuits again. A part of the project is to figure out what kind of checks have to be added in order to preserve the security properties of Trilithium. The implementation has to be benchmarked and the performance degradation documented. A write-up with updated proofs (only the changed part) should also be created.
Arnis Paršovs
arnis.parsovs at ut dot ee
Applied Cyber Security Topics
Applied cyber security group offers research seminar supervision on various cyber security-related topics for students who are interested in more applied research that may involve hands-on activities as well. Various hardware can be provided to students for experiments. Students who are doing applied research must still describe the research they have performed in a seminar report and convince the supervisor that the work done is worth 3 ECTS (~78 hours of work).
Students are welcome to contact Arnis Paršovs (arnis.parsovs@ut.ee) with their seminar topic ideas.
Recommended prerequisites: Applied Cryptography (MTAT.07.017) / Web Security (LTAT.04.018)
Level:BSc, MSc or PhD
Pille Pullonen-Raudvere
pille.pullonen-raudvere at cyber dot ee
Distributed zero-knowledge for secure multi-party computation
Recently, distributed zero-knowledge proofs (D-ZK) have been proposed as a competitive alternative to the SPDZ protocol in actively secure multiparty computation. This approach replaces the authenticated triples of SPDZ with triples and D-ZK proofs. The goal of this seminar topic is to document the steps of the protocol using D-ZK to capture the overall idea and the complexity of the protocol.
This topic is based on:
- https://link.springer.com/chapter/10.1007/978-3-032-35418-1_16
- https://eprint.iacr.org/2025/787
- https://eprint.iacr.org/2022/261
Elette Boyle's talk in TPMPC'26 can be used as a good starting point to get the bigger picture: https://au.cloud.panopto.eu/Panopto/Pages/Viewer.aspx?id=8beeb170-b006-4eda-b33d-b4500097b052
Level: MSc or PhD students
Distributed Point Functions and Function Secret Sharing
This topic is based on a recent overview paper https://arxiv.org/pdf/2607.27696 The goal of the student is to present the core of this paper in a manner that is easy to follow for fellow students. It serves as a good starting point for getting to know function secret sharing landscape.
Level: Suitable for all levels
Kübra Seyhan
kubra.seyhan at bil dot omu dot edu dot tr
A Report on Threshold Post-Quantum Signatures
Threshold signatures distribute a signing key among multiple parties, allowing a signature to be generated only when a specified number of them cooperate. This topic studies approaches to construct threshold post-quantum signatures, including dedicated designs and secure multi-party computation. The student will learn the foundations of threshold signing and compare selected constructions in terms of security assumptions, computational cost, and communication requirements. The objective is to provide a report explaining the main approaches, their tradeoffs, and the challenges of adapting post-quantum signature standards to threshold settings.
Level: Suitable for all levels
Janno Siim
janno.siim at ut dot ee
Understanding a modern SNARK: Spartan
SNARK (Succinct Non-interactive ARgument of Knowledge) is a proof system that lets one generate a short proof that a potentially large computation was executed correctly. SNARKs are used, for example, in cryptocurrencies to prove that a large number of transactions are valid. In this project, we study Spartan SNARK: https://eprint.iacr.org/2019/550. The goal is to understand the high-level structure of Spartan and some of its components in more detail. The project can have either a theoretical or an implementation focus. In either case, you should understand the main components of Spartan and write about them in a report.
In a theory project, I expect the report to include small examples of how specific components work. For instance, how a specific circuit is transformed into an R1CS system, and then compiled into a multilinear polynomial. In an implementation project, the student will instead implement some of the components of Spartan. Full implementation is not expected.
Level: Master's, PhD
Exploring ZKVMs
ZKVM (zero-knowledge virtual machine) is a compiler that takes as input a code P (say, Rust code), a public input x, and a private input w, and then generates a proof p that P (x, w) = y. The proof can be verified much faster than running P, and furthermore, only P, x, and y are needed for verification. The secret w does not have to be revealed.
There are now many ZKVM libraries available, each with different trade-offs and usability features. Tasks:
1. Write an overview of currently available ZKVMs.
2. Pick one or two libraries and figure out how to run them with some simple input code P.
3. More ambitious goal: anonymous credentials through ZKVM. Consider that the government has provided you with a digitally signed ID with a lot of information. Can we use ZKVM to prove (for instance) that you are at least 18 years old without leaking other information? Are ZKVMs efficient enough for this to be practical?
Level: Any
Watermarking in LLMs
Anthropic has recently introduced text watermarking in their newest models. Namely, they bias the text output in a clever way so that it can later be detected as coming from Claude. The watermark remains even if the text has been ``lightly’’ edited. Their watermarking is closely based on SynthID-Text developed by DeepMind and described here: https://www.nature.com/articles/s41586-024-08025-4
Our goal with this work is to understand the limitations of SynthID-Text and how much editing is precisely needed to break it. Tasks:
1. Understand the basic SynthID-Text algorithm and find out everything publicly available about the way Anthropic implements it.
2. Implement a simple simulation of SynthID-Text.
3. Play around with it and figure out how many edits are needed to break it.
4. Present the main method of SynthID-Text and your findings in the report.
Level: Any
Dominique Unruh
unruh at ut dot ee
Autoformalizing Crypto Proofs
LLMs have made great strides in proving mathematical results. In this seminar topic, the task will be to explore how well current AI can formalize (computer verify) state-of-the-art cryptographic results without (or without much) help. The goal would be to make a complete formalization of some (to be chosen) crypto paper, investigate the results, study the constructed formalism, and investigate how much / how little human interaction is needed.
Prerequisites: Some theoretical crypto course (to understand crypto proofs and definitions)
The Quantum Random Oracle
Random oracles are a proof technique in cryptography that idealizes hash functions. Basically, instead of dealing with the messy details of how a specific hash function works, we simply assume that it is a completely random function. This technique makes a lot of cryptographic proofs a lot simpler. (But it is a heuristic.) When it comes to quantum security, things get more complex. Now the adversary can do a query the oracle in a superposition between many values which messes up classical proof techniques.
The task of the seminar is to give an overview how to random oracle works in the quantum setting, and how one can do security proofs in it after all.
Prerequisites: Some crypto course and some quantum course.
Quantum Security Proofs with qRHL
Security proofs using the computer ("mechanized security proofs") show the security of a crypto protocol using the computer, to make sure there are no mistakes in the proof. One tool for this is qrhl-tool, which specifically targets security against quantum attackers, based on a logic called "quantum relational Hoare logic" (both by Unruh). In this seminar topic, you would present the logic and the tool. A bonus task (for extra credits) might include showing the security of some quantum cryptographic construction (e.g., quantum commitment schemes).
References:
https://dl.acm.org/doi/10.1145/3290346
https://dominique-unruh.github.io/qrhl-tool/
Requirements:
Some background in crypto and in quantum.
Quantum Cryptography Below One-way Functions
In classical cryptography, one-way functions are usually considered to be the weakest possible cryptographic assumption. (A one-way function is, roughly speaking, a function that one cannot invert. It is "obviously" a lot weaker than assuming something powerful such as, e.g., public key encryption.) However, if we consider quantum cryptography, this suddenly doesn't hold anymore. There are a multitude of new assumptions that are weaker (i.e., less powerful but still useful) than one-way functions. The task of this seminar is to explain this phenomenon (and to some extend also identify the relevant papers).
Requirements:
Some background in crypto and in quantum.