LCD 2025

Cong Ling, Liz Quaglia and Christian Weinert are organising the next London Crypto Day 2025, which will be on Friday 21st November 2025.

Registration for LCD25 is now closed.

The event will be held at Imperial College London (Room 611, Department of EEE).

We are excited to announce the agenda for LCD25:

10:00 - 10:25 Arrival and welcome coffee

10:25 - 10:30 Opening remarks

10:30 - 11:15 Yiannis Tselekounis (Royal Holloway, University of London): Guarding the Signal: Secure Messaging with Reverse Firewalls

11:15 - 12:00 Daniel Gardham (University of Surrey): Best of Both: Symbolic and Computational Analysis of Privacy Pass

12:00 - 12:15 Coffee break

12:15 - 13:00 Ela Lee (Angoka): Identity, Privacy, and Barriers to Privacy Technology

13:00 - 14:00 Lunch

14:00 - 14:45 Naomi Farley (Thales): What are the challenges of migrating to PQC?

14:45 - 15:30 Kris Kwiatkowski (PQShield): Post-Quantum Cryptography in Practice: Migration Strategies for Constrained and Embedded Systems

15:30 - 16:00 Coffee Break

16:00 - 16:45 Sujoy Sinha Roy (Graz University of Technology): From FHE to ZKPs: Custom Hardware for Next-Generation Cryptography

Below you can read the abstracts of the talks.

• Yiannis Tselekounis (Royal Holloway, University of London)

Guarding the Signal: Secure Messaging with Reverse Firewalls

Secure messaging protocols allow users to communicate asynchronously over untrusted channels with strong guarantees of privacy, authenticity, forward secrecy, and post-compromise security. However, traditional security analyses of these protocols assume complete trust in the hardware and software of honest participants, overlooking a significant class of real-world threats known as subversion attacks. These attacks alter cryptographic algorithms to compromise security, by exfiltrating secrets or creating vulnerabilities that are often undetected. The notion of reverse firewalls (EC'15), aims at protecting against subversion attacks by introducing a third party, called a "reverse firewall" (RF), which sits between a party and the outside world and modifies its outgoing and incoming messages in a way such that, even if the party's machine has been corrupted (in a way that maintains functionality), security is still preserved. Importantly, the firewall shares no private information with the parties, and parties put no more trust in the firewall than they do in the communication channel. In this work, we address the existing gap in secure messaging and subversion attacks by presenting several key contributions:  1) We design the first subversion-resilient secure messaging protocol based on the model of RF. Our protocol is based on the Signal protocol---the current state-of-the-art in two-party secure messaging, though it lacks subversion resilience---and achieves subversion resilience with only constant overhead over Signal. 2) We develop a subversion-resilient version of the X3DH protocol in the RF model. X3DH is a core component that facilitates secure initial key agreement in Signal's protocol. 3) We introduce and formalize the notion of Continuous Key Agreement with Tamper Detection, an essential concept for subversion-resilient secure messaging. Our notion enables parties to continuously agree on keys, even in the presence of active adversaries capable of partially tampering with the key exchange transcript. We present a construction of our notion and prove its subversion resilience in the model of RF.

• Daniel Gardham (University of Surrey) 

Best of Both: Symbolic and Computational Analysis of Privacy Pass

CAPTCHA is a ubiquitous challenge-response system for preventing spam (typically bots) on the internet. Requiring users to solve visual challenges, its design is inherently cumbersome and can unfairly punish those using low reputation IP addresses, such as anonymous services e.g. TOR. To minimise the frequency in which a user must solve CAPTCHAs, Privacy Pass (Davidson et al, PETS 2018) allows users to collect and spend anonymous tokens instead of solving challenges. Despite 400,000 reported monthly users and standardisation efforts by the IETF, it has not been subject of formal verification, which has been proven to be a valuable tool in security analysis.

In this talk we present the first analysis of Privacy Pass using formal verification tools, and verify standard security properties hold in the symbolic model. Motivated by concerns of Davidson et al. and the IETF contributors, we also explore a stronger attack model, where additional key leakage uncovers a potential token forgery. We present a new protocol, Privacy Pass Plus, in which we show the attack fails in the symbolic model and give new cryptographic reductions to show our scheme maintains the security properties. 

Moreover, we highlight the complementary nature of analysing protocols in both symbolic and computational models and focus on how to capture meaningful formal definitions based on cryptographic games. 

• Ela Lee (Angoka)

Identity, privacy, and barriers to privacy technology

In this talk I will be exploring digital identity, age-verification checks and privacy.  I’ll explain how zero-knowledge proofs can be utilised so other identifiable information from a digital ID is not revealed to third parties.  I’ll also explain the fuller context of verifying not only data on a credential but the actual user, and the architecture and trust relationships this requires.

I’ll then discuss the issue that these technologies are not currently set to become the standard approach for age-verification.  I will draw on my own experiences moving from academia into industry on the difficulty of making unintuitive technologies marketable.  I’ll also look at examples of how cryptography is presented to the public, and the role this plays in the lack of public awareness of privacy technology.

• Naomi Farley (Thales UK)

What are the challenges of migrating to PQC?

Though Post Quantum Cryptography (PQC) algorithms are being standardised by NIST, migrating to these is far from trivial, particularly in constrained, embedded platforms. This talk thus describes several of the challenges when trying to migrate systems to PQC, informed by ongoing PQC migration efforts within Thales.

• Kris Kwiatkowski (PQShield)

Post-Quantum Cryptography in Practice: Migration Strategies for Constrained and Embedded Systems
This talk examines the practical aspects of migrating cryptographic modules to post-quantum cryptography (PQC), focusing on the adoption of PQC algorithms standardized by NIST. It discusses key challenges in achieving interoperability across internet protocols and highlights how migration efforts must balance implementation complexity, efficiency, and infrastructure costs. Particular focus is given to constrained environments such as IoT and edge devices, where limited compute, memory, and energy resources demand tailored design strategies. The talk also outlines common pitfalls in PQC adoption and provides guidance on addressing the specific needs of embedded environments. Attendees will gain practical insights into integrating PQC into cryptographic modules while managing real-world constraints and deployment considerations.

• Sujoy Sinha Roy (Graz University of Technology)

From FHE to ZKPs: Custom Hardware for Next-Generation Cryptography                                                                              

Fully Homomorphic Encryption (FHE) and Zero-Knowledge Proofs (ZKPs) promise transformative security and privacy capabilities, but their computational demands have hindered practical adoption. This talk explores how custom hardware can unlock orders-of-magnitude performance gains for these advanced cryptographic primitives. We present recent results in accelerating FHE and ZKP protocols through hardware–algorithm co-design, enabling efficiencies far beyond those achievable with multicore CPUs or GPUs.