Research Papers

We propose a hybrid formal verification approach that combines high-level deductive reasoning and circuit-based reasoning and apply it to highly optimized cryptographic assembly code.

Continuous Group Key Agreement (CGKA) is the primitive underlying secure group messaging. It allows a large group of N users to maintain a shared secret key that is frequently rotated by the group members in order to achieve forward secrecy and post compromise security.

In this work, we propose TRaccoon-IA, a TRaccoon with an efficient identifiable abort protocol, allowing to identify malicious signers when the signing protocol fails.

We analyze Signal's classically secure X3DH and harvest-now-decrypt-later-secure PQXDH, and show the settings for which PQXDH is (un)deniable against harvest-now--later attacks..and more.

In this work, we focus on the authenticity of the application messages exchanged in MLS.

In this work, which was accepted at USENIX Security 2025, we propose a new way of modeling Signal handshake protocols.

More Efficient Protocols for Post-Quantum Secure Messaging is a talk presented by Thomas Prest at RWC 2024. This was the third talk in a session on post-quantum messaging, chaired by Dan Boneh.

We present the first comprehensive study on thresholdizing practical OV-based signature schemes, specifically focusing on MAYO and UOV.

In this article we present a non-uniform reduction from rank-2 module-LIP over Complex Multiplication fields, to a variant of the Principal Ideal Problem, in some fitting quaternion algebra.

In this work, we generalize the attack of Mureau et al. against rank-2module-LIP to the family of all number fields with at least one real embedding, which contains the NTRU Prime fields.

Due to the imminent threat of a "Harvest Now, Decrypt Later" attack, secure messaging providers must react know in order to make their protocols : at least as secure as before, but now also post-quantum (PQ) secure.

We propose a novel very efficient threshold signature scheme, with a signature size close to that of a single Dilithium signature for any threshold T of at most 8 users.