LCD 2026

LCD2026 will be on the beautiful Egham campus of Royal Holloway, University of London, on 6th November 2026.

The event will be held in the Moore Auditorium and will run between 10am and 6pm approximately.

The detailed programme will be out soon.

We are looking forward to seeing many of you there!

Registration is now open! Register here for LCD26. This is a free event but registration is required.

We are excited to announce the speakers for LCD26:

• Antoine Delignat-Lavaud (Microsoft Research Cambridge)

Scaling Verification of Cryptographic Software with Rust and Lean

Verifying cryptographic implementations has been a slow, painful and labour-intensive tasks so far. Recently, frontier AI labs have started competing in mathematic research, and thus have trained their models in Lean to great success, as shown by the full formalization of Fermat’s Last Theorem the Navier-Stokes Millenium problem. This is causing a revival of interest in program verification – can AI be as successful at proving the correctness of programs in Lean? For this, we rely on a new translation from Rust to Lean that uses the linearity properties of the borrow system in Rust to translate Rust to pure, faithful Lean models. Then we can use auto-formalization of crypto standards from NIST and IETF and ask agents to prove the correctness of Rust implementations, but also to prove the mathematical correctness of cryprographic algorithms (using Lean’s Mathlib).

        We apply our methodology to SymCrypt, Microsoft's cryptographic provider. We verify implementations of algorithms such as SHA3, ML-KEM, and FrodoKEM that were ported from C to Rust, uncovering minor implementation flaws. We also extend SymCrypt with additional optimizations and algorithms, such as ML-DSA and HPKE, to explore the scalability of writing, adapting, and verifying cryptographic code. Our 200 KLOC Lean development establishes safety, panic-freedom, and functional correctness of 14 KLOC of Rust code, which suffices to fully support post-quantum cipher suites for X86-64 and ARM platforms.

• Behzad Abdolmaleki (University of Sheffield)

• Gennaro Avitabile (University of Surrey)

Can Cryptography Outsmart Big Brother?

Anamorphic cryptography explores how private communication can survive in hostile environments where authorities may compel citizens to surrender their cryptographic secrets. More specifically, it asks how to embed covert messages within apparently ordinary ciphertexts, even when Big Brother knows the secret keys required to operate the cryptosystem.

In this talk, we will discuss recent progress toward understanding the structural limits of Anamorphic Encryption. Can every encryption scheme be transformed into a high-bandwidth covert channel, or can Big Brother construct encryption schemes that provably preclude or limit covert communication? Finally, we will look at Anamorphic Signatures, examining the limitations of existing constructions and presenting new ones overcoming some of these issues.

• Graham Cormode (University of Oxford)

Privacy and Trust tradeoffs in modern AI workflows

      Contemporary AI workflows have multiple stages: data understanding, model training, and deployment.  Each of these poses privacy questions: what information is secret, and what can be revealed?  Where does computation take place, and who is trusted to do it?  What are the resulting tradeoffs between privacy, trust and scalability?  This talk will illustrate three different systems that make different choices in this design space: PAPAYA, a federated architecture to gather population-level parameters from billions of clients; PROVEFL, a framework private, robust and verifiable federated learning in the presence of possibly malicious clients and servers; and SPRINT, a system for private vector search in RAG systems. Together, they demonstrate how different requirements and threat models lead to different decisions about where to place trust and which cryptographic tools to enforce it.

• Jonas von der Heyden (University of Wuppertal)

Rerandomizable Garbling Schemes from LWE

    Rerandomizable garbling schemes (RGS) are a fundamental primitive enabling advanced  cryptographic constructions such as multi-hop homomorphic encryption (Gentry, Halevi, Vaikuntanathan, CRYPTO 2010), iO-combiners (Ananth,Jain, Naor, Sahai, Yogev, CRYPTO 2016), and YOSO-style MPC (Acharya, Hazay, Kolesnikov, Prabhakaran, TCC 2022 and CRYPTO 2024). All known RGS instantiations rely on discrete-logarithm-type assumptions, concretely via the BHHO scheme (Boneh, Halevi, Hamburg, Ostrovsky, CRYPTO 2008) and its recent pairing-basedvariant (Heitjohann, von der Heyden, Jager, CRYPTO 2025). This reliance stems from the use of key-and-message homomorphic encryption (KMHE) that supports rerandomization and strong  “key-privacy under leakage”, which hides the applied homomorphic transformations and is currently only achievable using BHHO-style bitwise encryption in combination with permutation-based homomorphisms.

Our first main contribution is a new garbling technique that shifts the burden of hiding homomorphic transformations from the encryption scheme to the garbling itself. This allows us to construct RGS from KMHE schemes with substantially weaker properties, avoiding the need for bitwise encryption and permutation-based homomorphisms, and enabling the construction of RGS from KMHE with other homomorphisms, such as additively-homomorphic ones. As a second contribution, we give a concrete lattice-based instantiation of the required KMHE primitive, based on LWE. This construction is a variant of the GSW FHE scheme (Gentry, Sahai, Waters, CRYPTO 2013), which uses new techniques for rerandomization and is tailored to the requirements of our new garbling scheme by supporting a “homomorphic”/“lossy” mode. This yields the first RGS construction that does not rely on discrete-logarithm assumptions and may provide post-quantum security.

• Tabitha Ogilvie (King's College London)

Concrete Hardness Gaps Between MLWE and LWE

Almost all practical lattice-based cryptography is built on the Module Learning with Errors problem (MLWE) and its special case Ring-LWE: from the standardised post-quantum schemes ML-KEM and ML-DSA, to fully homomorphic encryption schemes such as BFV, BGV and CKKS. These problems add algebraic structure to plain LWE, which makes the resulting schemes far more efficient. When it comes to choosing parameters, however, standard practice is to ignore this structure entirely, and to estimate security as if the problem were plain LWE. This rests on a widely held belief that, in the power-of-two cyclotomic rings used in practice, the extra structure gives an attacker nothing useful.

In this talk, I will show that this belief does not always hold. I will start with an introduction to how the concrete security of LWE is estimated, assuming no prior knowledge, and explain hybrid attacks, which guess part of the secret and use lattice reduction to recover the rest. I will then show how the ring structure lets an attacker rotate the secret, so that a single expensive lattice reduction can be reused to test their best guess against many different parts of the secret.

For sparse secrets, which are increasingly common in homomorphic encryption, this gives a much stronger attack: structured instances can be up to 14 bits easier than the LWE estimates used to choose their parameters, and sparse parameter sets in widely used libraries fall below their claimed 128-bit security. For ML-KEM, the same idea applies, but the gap is around 1 bit, so the standardised parameters are not meaningfully affected. I will close with what this means for choosing parameters for structured lattice problems.

Based on "On the Concrete Hardness Gap Between MLWE and LWE", which appeared at CRYPTO 2026 merged with work by Jianhua Hou and Haodong Jiang as "Careful with the Ring! Concrete Hardness Gaps Between LWE and MLWE".