Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
WPEC 2026 (October 26–28) is a virtual workshop, organized by the Privacy-Enhancing Cryptography (PEC) program.
Featured topics: Fully-Homomorphic Encryption (FHE); Private-Set Intersection (PSI); Zero-Knowledge Proofs (ZKP), Anonymous credentials.
| Selected Presentations | |
|---|---|
| October 26, 2026 | Type |
10:00 AM WPEC 2026 Welcome and Introduction Abstract. WPEC 2026, the NIST Workshop on Privacy-Enhancing Cryptography 2026, brings together multiple perspectives of Privacy-Enhancing Cryptography (PEC) from diverse stakeholders. The 3-day virtual workshop is organized for sharing insights about PEC capabilities, use-cases, real-world deployment, initiatives, challenges and opportunities, and the related context of privacy & auditability. The workshop features the topics of Fully-Homomorphic Encryption (FHE), Private-Set Intersection (PSI), Zero-Knowledge Proofs (ZKP) and Privacy-Preserving Digital Credentials. This talk descrcibes the context of the NIST-PEC program, sets expectations for the workshop, and presents the schedule and other logistics. The workshop details and updates are posted at https://csrc.nist.gov/events/2026/wpec2026 | Presentation |
10:15 AM Fully-Homomorphic Encryption Benchmarking and Beyond Abstract. Fully homomorphic encryption (FHE) has reached the point where real applications can be deployed, yet choosing among implementations, libraries, compilers and hardware platforms remains difficult without comparable end-to-end performance data. This talk presents the FHE Benchmarking Suite, a community effort developed under HomomorphicEncryption.org and launched in March 2026 at fhe-benchmarking.org. In this talk, we describe the design choices behind the suite: a common harness drives a seven-stage, two-party non-interactive protocol and measures time, bandwidth, storage, precision and cost at each stage, and is agnostic to how a submission is built or where it runs. We then review the six published workloads, ranging from encrypted vector search and exact integer arithmetic to transciphering and machine-learning inference, and the lessons from the first submissions. We close with trends observed across the open FHE ecosystem, open problems for standardization, and a call for contributions. Join work: Andreea Alexandru, Flavio Bergamaschi, Shruthi Gorantala, Shai Halevi Suggested readings:
| Presentation |
11:10 AM Encrypted Neural Networks Without Overflows Abstract: In this talk, we will discuss a typically underestimated issue in most fully-homomorphic encryption (FHE)-based machine learning applications. In particular, the Cheon-Kim-Kim-Song (CKKS) scheme enables private inference by evaluating neural networks on encrypted real data, but it only supports addition, multiplication, and rotation operations. On the other hand, neural networks are heavily based on activation functions, which are intrinsically nonlinear. Turning a neural network into a CKKS circuit thus requires approximating all activation functions by polynomials within a certain interval: traditionally, these intervals are sampled (and heuristically widened) activation ranges over a dataset. During the presentation, we will show that CKKS circuits built this way are still vulnerable to overflow events, where legitimate inputs exceed the tolerances of the circuit and cause corrupted outputs. In particular, we propose an efficient algorithm to find such inputs in the (visual) vicinity of benign inputs and demonstrate that it can, e.g., lead to corrupted outputs for 47% of CIFAR-10 images processed by a CKKS circuit. We will show that such overflows can also happen without any malicious intervention: by simply changing the test dataset of a MNIST network to USPS (a dataset that targets the same digit recognition task), we observed overflows in more than 5% of cases. To completely eliminate overflows, we propose a formal verification technique that computes certified bounds on the ranges of all neurons in the network. Our overflow-free solution is compatible with most CKKS-based frameworks, as it allows us to simply substitute heuristically constructed polynomials with rigorously designed ones. Joint work: Philipp Kern, Alberto Leporati, Edoardo Manino, Lorenzo Rovida, Carsten Sinz, Samuel Teuber. Suggested readings | Presentation |
11:35 AM Towards Practical Differentially Private Machine Learning under FHE Abstract: As machine learning is increasingly deployed in sensitive domains such as finance and healthcare, privacy risks can arise from multiple directions, for example, (1) end users who have access to the final trained model, and (2) semi-honest servers that train models on behalf of clients who outsource their training. To address these challenges, we combine two powerful cryptographic tools: Fully Homomorphic Encryption (FHE) and Differential Privacy (DP), providing end-to-end privacy protection. FHE protects sensitive data during training on the server, while DP limits the information that can be inferred from the final trained model. However, because the computational complexity of FHE is highly dependent on circuit depth, directly applying standard DP training can be prohibitively expensive. We therefore modify the training objective to enable scalable DP training under FHE, achieving a 5× reduction in computational cost, formal privacy guarantees, and comparable model utility. Together, these techniques advance the feasibility of efficient, private, and secure machine learning on sensitive data. Joint work: Ivan Brugere, Dana Dachman-Soled, Danial Dervovic, Yue Guo, Mingyu Liang, Antigoni Polychroniadou, Min Wu, Yvonne Zhou. Suggested readings
| Presentation |
1:00 PM Mímir: A Stateless Private Search Engine Abstract: Private search engines allow a user to retrieve documents from a public database that are similar to a text query, while the server learns nothing about what the user is searching for. Our cryptographic protocol Mímir uses homomorphic encryption, i.e., computation on encrypted data, to realize the first stateless semantic private search engine for highly dynamic databases. Unlike other state-of-the-art private search engines, Mímir has no database-dependent preprocessing step that needs to be redone every time the database gets updated: it requires no offline communication, and it trades higher but highly parallelizable server computation for low per-query communication. The security of Mímir relies on the (Ring) Learning with Errors problem. Mímir achieves 59% of the non-private search quality with 8.13 MiB of per-query communication and 0.77 s of latency on a single machine. This outperforms the state-of-the-art private search engine Tiptoe in quality, communication and latency simultaneously, and matches the latency of PACMANN with 7.6× less communication. The talk focuses on semantic search, how to achieve it via homomorphic encryption, and how Mímir achieves statelessness. Joint work: Gökberk Erdogan, Kamil Kluczniak, Emma Munisamy. Suggested readings:
| Presentation |
1:25 PM Privacy-Enhancing Cryptology in the Swedish Public Administration Abstract: Public administrations face a fundamental tension: the urgent need for data-driven decision-making and AI training versus the strict constraints of data protection laws (such as GDPR in the EU) and national security acts. Traditional methods of anonymization often fail to balance data utility with privacy, creating “data silos” that hinder socio-economic growth. This presentation explores the implementation of a national infrastructure in Sweden designed to bridge this gap through the deployment of advanced cryptographic PETs. We examine the transition from traditional data exchange to a model of “insight sharing,” where results are computed without the underlying raw data ever being exposed. Central to this framework is the prioritization of Secure Multi-Party Computation as a government-wide service, enabling cross-agency matching and statistical aggregation without a trusted third party. The talk will detail the technical applications of Homomorphic Encryption — including Fully Homomorphic Encryption for quantum resistant processing — and Zero-Knowledge Proofs for secure identity and attribute verification. Drawing on the findings of the Inquiry on Privacy-Enhancing Technologies in Public Administration (En stärkt förmåga till modern datadelning — integritetsfrämjande teknik i offentlig förvaltning, SOU 2026:44), we discuss the challenges of scaling these technologies from academic concepts to operational government services. We will highlight specific use cases, including cross-border medical research, automated fraud detection in social security, and the creation of synthetic datasets. The session concludes with a vision for a “Cryptographic Computing” ecosystem where encrypted data flows are the standard, ensuring that the public sector can maximize the utility of its data while providing mathematically provable privacy guarantees. Joint work: Alexander Engström, Gabriella Jansson, Erik Janzon, Fredrik Qvist, Ann Sofie Silversved. Suggested readings:
| Presentation |
| October 27, 2026 | Type |
10:05 AM Post-Quantum Private Set Intersection for Small Sets Abstract: Are private set intersection (PSI) protocols ready for the post-quantum future? The leading PSI protocol for small sets (Rosulek & Trieu 2021) relies heavily on Diffie-Hellman techniques and is therefore vulnerable to quantum attacks. In this talk, we describe how to modify the protocol to make it compatible with post-quantum KEMs like ML-KEM. Interestingly, in the post-quantum setting, the symmetric-key primitives become the performance bottleneck. Along the way, we also introduce new abstractions for oblivious key-value stores that make the analysis of these kinds of PSI protocols more modular. We achieve PSI from standardized post-quantum primitives with latency as low as 0.25 ms/item and communication as low as 1.67 KiB/item. Joint work: Junxin Liu, Mike Rosulek, Ni Trieu. Suggested readings
| Presentation |
10:30 AM Private Set Intersection on Noisy Identifiers Abstract. We report on preliminary work on Private Set Intersection on lists of identifiers containing names and birthdate. The distribution of names is assumed to be close to what the US Census Bureau makes publicly available. The identifiers are allowed to contain commonly encountered errors. We use only basic techniques. Our aim is to establish a baseline with which other proposed solutions, particularly in the case of medical records, can be compared with. Initial results achieve about ninety percent detection rates, no false positives. Current code runs on a laptop and takes a few minutes. Joint work: Angela Robinson, René Peralta | Presentation |
10:55 AM Fuzzy Private Set Intersection for Real-World Datasets Abstract: Fuzzy Private Set Intersection (Fuzzy PSI) is an "approximate" variant of PSI that allows a receiver to learn points of the sender that are "close" to its points. Recently, there has been a lot of work in Fuzzy PSI that allows realizing important applications such as biometrics matching, privacy-preserving ride-sharing, contact tracing, etc. where points (e.g., faces, location co-ordinates) are only an approximate match instead of an exact one. However, such protocols make strong assumptions about the underlying input to attain better efficiency. In this talk, I will present a discussion on the applicability of such Fuzzy PSI protocols to real-world inputs. Joint work: Yanxue Jia, Aniket Kate, Satvinder Singh. Suggested readings
| Presentation |
11:30 AM Approximate Private Set Intersection Abstract: Private Set Intersection (PSI) is a protocol where two parties, each holding a confidential set, wish to jointly learn (or secret-share) the intersection of their sets without revealing any additional information. By relaxing the strict requirement of exact match, the realm of Fuzzy PSI deals with matching under certain conditions (or "metrics") of closeness. In this talk, we focus on a family of variants of fuzzy PSI that we collectively call Approximate PSI. We present an improved protocol for when the metric is the Hamming distance, significantly improving overall efficiency compared to existing solutions. Operating under lightweight and flexible assumptions, each protocol can be adapted to output a secret-shared result, enabling further secure computation. Lastly, we show how this extends into Euclidean distance or cosine similarity, which applies to high-dimensional vector private approximate intersection or approximate membership. Joint work: Wutichai Chongchitmate, Steve Lu, Rafail Ostrovsky Suggested readings:
| Presentation |
12:00 PM Outsourced Private Set Intersection: Primitives, Properties, and Future Directions Abstract. Outsourced private set intersection (PSI), also known as delegated, server-aided, or cloud-assisted PSI, refers to the setting where parties delegate the required computation, and sometimes storage, to an untrusted (cloud) server. In this talk, we provide an overview of the outsourced PSI landscape, categorizing the different cryptographic primitives and introducing our framework for understanding the key properties that distinguish these protocols, including cardinality leakage, repeatability, authorization, verifiability, updatability, and collusion assumptions. Using this framework, we will further discuss the factors that influence protocol selection in practice, and present our interactive tool designed to help developers identify schemes that best match their requirements. Finally, we highlight gaps between recent advances in traditional PSI and the current state of outsourced PSI as promising future research directions. Joint work: Sophie Hawkes, Christian Weinert. Suggested readings
| Presentation |
1:30 PM Actively Secure Dishonest Majority Table Join in The JOCONDE Project Abstract. The Eurostat JOCONDE project developed a specification and prototype of a shared multi-party computation system for official statistics. The purpose of the system is to enable national statistics offices to collaborate among each other and with industry partners on statistical analysis of confidential microdata. The system uses secure multi-party computation (MPC) and trusted execution environments (TEE) in tandem to provide strict data protection guerentees. In the strictest security configuration, the underlying MPC protocols must provide active security against two out of three computing parties. In this talk, I will present the MPC protocols used for actively secure aggregation of tabular data in the JOCONDE prototype. We generalized the pseudorandom permutation based join protocol of Laur, Talviste, and Willemson (2013) to the active security dishonest majority setting. For the pseudorandom permutation, we developed a secure protocol based on the Poseidon2 hash function. The resulting protocols are used to join two tables with 1 million rows each in 4 hours and 10 minutes. Joint work: Hendrik Eerikson, Sona Kravtšenko, Pille Pullonen-Raudvere Suggested readings
| Presentation |
1:55 PM Practical Two-Party Secret-Shared Joins for SQL Analytics Abstract. In this presentation, we describe practical protocols for secure SQL-style joins on secret-shared databases in the semi-honest two-party setting. Our goal is to let two parties compute joins without revealing raw records, while keeping both inputs and outputs secret-shared so results can be reused in later privacy-preserving queries. We present two protocols: a one-to-one join for unique keys with linear time and constant rounds, and a one-to-many join that supports duplicate keys with near-linear scaling. Our key technical ideas are an efficient secret-shared permutation primitive and a strong pseudorandom function protocol adapted to the semi-honest two-party setting. We explain how these components improve practical performance for two-party secure computation. We also summarize implementation and benchmark results, including million-row experiments and support for chained operations such as filtering and grouped aggregation. Joint work: Srinivasan Raghuraman, Peter Rindal, Harshal Shah Suggested readings
| Presentation |
2:35 PM Communication-Efficient Private Join and Compute over Distributed Input Sets Abstract: In this presentation, we focus on the inner-product variant of private join and compute (PJC), which computes the inner product over matching records from two private datasets. Instead of assuming each party holds the entire dataset, we focus on the scenario where relevant datasets are distributed across multiple data owners. In many applications such as privacy-preserving ad conversion measurement, having each party hold the entire dataset is often unrealistic in practice. No existing PJC protocols directly support distributed input sets across multiple clients, while straightforward generic approaches introduce substantial overhead. To achieve this goal, we propose an efficient approximate PJC protocol for distributed input sets while keeping the communication sublinear in the input size. We work in the semi-honest setting and use two non-colluding servers that learn nothing beyond the final approximation. We propose a novel adaptation of the Gödel Prize-winning AMS sketch redesigned for efficient evaluation under somewhat homomorphic encryption. Concretely, we show a new form of structured randomness that can be homomorphically generated from short seeds using just 3 levels of multiplication while maintaining the best plaintext accuracy bound. Based on our optimized implementation, clients can insert each input element into an encrypted sketch in 30 ms, which has a size of 250 KB, independent of input size. The servers can recover the final output within seconds, orders of magnitude faster than the generic method. Joint work: Xinran Cai, Wei Dong, Hanlin Liu, Yunqing Sun, Xiao Wang. Suggested readings
| Presentation |
3:00 PM Privacy-preserving Proximity Testing from Geometric Fuzzy Matching Abstract: Geometric Fuzzy Matching (GFM) is a two-party primitive in which the receiver specifies an arbitrary bounded region of n-dimensional space and learns only whether the sender's point lies inside it, with nothing else revealed to either party. It generalises fuzzy matching, a variant of private set intersection (PSI) in which the only question that can be asked is whether two points lie within a fixed distance of each other. Restricting proximity to a fixed radius is limiting in practice. In privacy-preserving proximity testing (PPPT), where two parties want to learn whether they are near each other and nothing more, the question is rarely whether they are within, e.g., 500 meters of each other, and far more often whether one of them is inside this building, on that floor, or in the park across the road. In this talk I will present the two ingredients of GFM. First, an improved fuzzy matching protocol for the infinity norm in low dimensions that encodes intervals as binary prefixes, reducing receiver encoding cost from linear to near-logarithmic in the distance threshold. Second, partitioning algorithms that decompose any bounded region into axis-aligned hyper-rectangles plus leftover points, each handled by an instance of the first protocol and aggregated into one bit. I will close with concrete PPPT applications and an experimental evaluation, including region-based settings that no prior construction supports. Joint work: Ioannis Katis, Katerina Mitrokotsa, Florias Papadopoulos. Suggested readings
| Presentation |
| October 28, 2026 | Type |
10:05 AM Recent Advances in Zero-Knowledge Proofs and SNARKs: Faster Provers, Shorter Proofs, and Post-Quantum Security Abstract: Zero-knowledge proofs let a prover convince a verifier that a statement is true without revealing anything else. SNARKs (succinct non-interactive arguments of knowledge) add succinctness: proofs are short and fast to verify, even for very large computations. A major obstacle to deploying them has long been prover cost. In this talk, I will give a gentle introduction to SNARK design and survey recent advances in prover speed and proof size. These advances build on the use of the sum-check protocol, optimizations tailored to binary fields, and new polynomial commitment schemes based on both hash functions and lattices, which are plausibly secure against quantum computers. I will also discuss applications these advances make possible, from privacy-preserving digital credentials to aggregating many post-quantum signatures into a single short proof. Joint work: Mohammadtaghi Badakhshan, Alberto Centelles, Quang Dao, Justin Thaler. Suggested readings
| Presentation |
11:10 AM Threshold Lattice-Based Zero-Knowledge Proofs Abstract: Lattice-based zero-knowledge proofs are now efficient enough for practical use, and they are enabling several post-quantum privacy-enhancing primitives such as anonymous credentials. However, most current instantiations are tailored to a single prover, i.e., one trusted party holds the witness and generates the proof, which represents a single point of failure. In the threshold setting, where the witness is distributed among n>t provers such that no fewer than t of them are required to recover it, threshold lattice-based zero-knowledge proofs are well understood for Σ-protocols (protocols that require three rounds between a prover and a verifier where the prover speaks first and last) that certify shortness only approximately. However, proving shortness exactly, which is required by applications such as anonymous credentials, requires protocols of more than three rounds and the application of rejection sampling, both of which are problematic in the threshold setting. In this talk, I will explain how we thresholdize the exact lattice-based zero-knowledge proofs of Attema, Lyubashevsky, and Seiler (CRYPTO 2020) and Esgin, Nguyen, and Seiler (ASIACRYPT 2020). We make them rejection-free using the work of Kim, Lee, Seo, and Song (CRYPTO 2023), and non-interactive using the work of Aardal, Aranha, Boudgoust, Kolby, and Takahashi (CRYPTO 2024), and also split the witness using the homomorphic encryption framework of Gur, Katz, and Silde (PQCrypto 2024). Joint work: Scott Griffy, Victor Youdom Kemmoe, Ngoc Khanh Nguyen, Tjerand Silde. Suggested readings
| Presentation |
11:35 AM Doxxing-Proof Authentic Digital Media Abstract. We can't trust the images and videos we see online anymore. Recent generative AI improvements support the creation and modification of convincing digital media in quasi real time. We live in an era where these fakes are routinely shared online for fun, profit, or other nefarious goals. Fortunately, technologies exist to embed cryptographic signatures and watermarks in these digital assets, proving their origin. The Coalition for Content Provenance and Authenticity (C2PA) specification has been adopted by many technology providers (e.g., Microsoft, Google, Adobe, Meta, and OpenAI), camera manufacturers (e.g., Sony, Canon, Leica), and news media organizations (e.g., BBC, CBC/Radio-Canada, AFP). Major deployments have started in 2025 and are accelerating in 2026. In high-risk contexts (conflict zones, protests, corruption reporting) creators might be reluctant to share certified images and videos for fear of retribution. Is there a way to reconcile the need for authenticated assets and the privacy of their creators? The answer is yes! In this talk, we'll explore cryptographic options to provide privacy to those who capture and share digital assets, enabling anonymous yet verifiable content. We'll present an open-source prototype that augments the C2PA specification by using blind signatures and zero-knowledge proofs to hide the signer's identity. These technologies offer the best of both worlds: enabling the public, reporters, and whistleblowers to share sensitive authentic digital media with strong privacy protections. Suggested readings | Presentation |
1:00 PM Private Sealed-bid Auctions at Scale Abstract: The growing use of auctions in blockchain and decentralized systems raises a central challenge: how can auction outcomes be computed efficiently and verified publicly without exposing bids or trusting an auctioneer? This talk explores recent results and cryptographic techniques for private sealed-bid auctions, highlighting the trade-offs between privacy, scalability, and trust assumptions, particularly when losing bids must remain confidential after an auction concludes. Joint work: Kobi Gurkan, Philipp Jovanovic, Alireza Kavousi, Andrija Novakovic, István András Seres. Suggested readings
| Presentation |
1:25 PM Private Delegation of (Non-)Membership Proof Updates in Cryptographic Accumulators: Applications to Revocable Anonymous Credentials Abstract: Anonymous credentials are poised for large-scale deployment worldwide. In the United States, verifiable digital credentials and mobile driver's licenses are increasingly being developed for privacy-preserving digital identity applications, while the European Union is moving toward the deployment of European Digital Identity Wallets at a scale of approximately 450 million potential users. A crucial challenge for these deployments is credential revocation. The main proposed privacy-preserving revocation systems use cryptographic accumulators. In the envisioned system, whenever a typically resource-constrained client presents their credential, they additionally prove in zero knowledge that their credential has not been revoked by issuing a non-membership proof with respect to the latest accumulator digest of revoked credentials. However, each revocation changes the accumulator state and can render existing non-membership witnesses stale. Thus, intermittently connected clients may need to process numerous missed updates before they can present their anonymous credentials. Computing and updating these non-membership proofs can be computationally intensive. Naively outsourcing these updates to a server, however, would forfeit the privacy guarantees of the anonymous credential system by revealing information about the credential being updated. In this presentation, we introduce new privacy-preserving delegation techniques for cryptographic accumulator (non-)membership proofs, enabling scalable and privacy-preserving anonymous credential deployments. In particular, we construct private proof-delegation protocols for RSA and bilinear accumulators in which the online client cost is constant in the number of missed accumulator updates. Joint work: Botond Glasz, Alireza Kavousi, Istvan A. Seres, Bence Soóki-Tóth. Suggested readings
| Presentation |
2:05 PM Lattice-Based Rate-Limited Tokens (Anonymous Credentials) in the Random Oracle Model Abstract: An anonymous credential allows a user to prove that she is authorized to access a resource in a privacy-preserving way. A rate-limited token is an anonymous credential that can only be used a limited number of times in any particular context; this means that even though we do not know which users are gaining access to a resource, there is a limit to how many resources one user may consume. Such tokens are becoming an increasingly attractive way to balance privacy with authorized access. Camenisch, Lysyanskaya, and Hohenberger (Eurocrypt 2005) proposed a communication-optimal framework for instantiating rate-limited tokens, relying on digital signatures, pseudorandom functions (PRFs), and non-interactive zero-knowledge proofs (NIZKs). However, obtaining an efficient post-quantum secure instantiation has been an open problem. One of the major issues leading to this failure has been the lack of efficient post-quantum PRFs that can be efficiently composed with a NIZK. In this talk, I will revisit the Camenisch, Lysyanskaya, and Hohenberger framework and show how, in the random oracle model, a weak PRF, where adversaries are limited to evaluating the PRF on random inputs, suffices. Then I will show how, using a candidate weak PRF based on the Learning With Errors assumption, we can obtain a post-quantum secure instantiation of rate-limited credentials that offers promising token sizes (899 KB for a rate limit of 256 vs 3 MB for prior constructions). Joint work: Victor Youdom Kemmoe, Anna Lysyanskaya, Ngoc Khanh Nguyen. Suggested readings
| Presentation |
2:30 PM Private Sealed-bid Auctions at Scale Abstract: The growing use of auctions in blockchain and decentralized systems raises a central challenge: how can auction outcomes be computed efficiently and verified publicly without exposing bids or trusting an auctioneer? This talk explores recent results and cryptographic techniques for private sealed-bid auctions, highlighting the trade-offs between privacy, scalability, and trust assumptions, particularly when losing bids must remain confidential after an auction concludes. Joint work: Kobi Gurkan, Philipp Jovanovic, Alireza Kavousi, Andrija Novakovic, István András Seres. Suggested readings
| Presentation |