WAC8 is an affiliated event at Crypto 2026 on Sunday, August 16, 2026 at University of California, Santa Barbara.
workshop description
Cryptography is often thought of as the bright spot of practical security, a mathematical paradise where security can be rigorously proven and issues like buffer overflows are in someone else’s department. However, there is a growing community of researchers who regularly find serious flaws in widely deployed cryptographic implementations and protocols. This type of research is often published in systems security conferences. WAC will bring together researchers who work on cryptographic attacks and provide a showcase of their work for the Crypto community. This is the eighth edition of the WAC workshop, which was established by Nadia Heninger.
program
| Sunday August 16, 2026 | |
|---|---|
| 09:00—09:05 (PDT) |
Authors:
|
| 09:05—09:45 (PDT) |
Abstract Nation State Agencies go to great lengths to obtain signal intelligence, including backdooring cryptographic standards and equipment. Although the existence of these backdoor efforts is common knowledge, only few of known backdoored systems have been publicly analysed. In this talk, based on our paper [1], we present the first detailed forensic cryptanalysis of the backdoored UA-8295 message terminal and we try to answer questions how the UA-8295's backdoor was designed and for which attack. Towards a better understanding of real-world backdoor design, we posit a Backdoor Conjecture that provides handles to reason about the design of backdoors and the attacks they are designed for. Authors:
|
| 09:45—10:30 (PDT) |
Abstract Mesh is a new addition to the family of Bluetooth protocols. In contrast to a regular Bluetooth star topology, Mesh enables many-to-many, group-key-encrypted communication between devices. Unfortunately, several attacks have already been shown against Mesh. In this talk, we will give an overview of these attacks and present new ones we discovered during the analysis of the specification. We reported our findings to Bluetooth SIG, who did not acknowledge them as a threat, despite the attacker being able to learn the shared group keys. Authors:
|
| 10:30—11:00 (PDT) | morning break |
| 11:00—11:45 (PDT) |
Abstract Trusted execution environments (TEEs) aim to offer strong privacy and integrity guarantees even in the presence of root level attackers capable of arbitrarily modifying the system's software. Recently however, there has been a pivotal shift in TEE deployment, moving TEEs from enclaves running on PC-oriented hardware to confidential virtual machines executing on server-grade CPUs. Under the hood, this change has also resulted in significant modifications to the underlying memory encryption engine, removing integrity guarantees as well as protections against replay attacks. While Intel's and AMD's change in TEE implementation is clearly significant and substantial, most TEE deployments appear to fail to acknowledge the difference in security guarantees, assuming a stronger security model than truly afforded by the implementation. Thus, in this talk we discuss the true protection offered by Intel's and AMD's newest TEE offerings against entry-level physical side-channel attacks. We show that, contrary to popular belief, bus interposition attacks on DDR server memory can be constructed cheaply by hobbyists, using parts easily obtained on e-commerce websites. Next, combining our ability to monitor DDR bus transactions with deterministic memory encryption used by Intel's SGX and TDX as well as AMD's SEV-SNP, we are able to extract secret key material (such as attestation keys in some cases) from machines in fully trusted status. Finally, we demonstrate the implications of our attacks on multiple real world TEE deployments. [1] TEE.fail website Authors:
|
| 11:45—12:30 (PDT) |
Abstract We present two attacks against the integrity of conversations in Signal: we show that a malicious server can inject messages into a conversation between two honest users without them being aware of it. These attacks do not require any key compromises and the second one is completely undetectable. These vulnerabilities raise a number of questions. How were they introduced? How can they still be present after the extensive security analysis to which Signal's protocols have been subjected? What wider lessons can be drawn in order to prevent similar issues arising in the future? We answer these questions in our talk. The full paper for this work is on eprint [1]. Authors:
|
| 12:30—14:00 (PDT) | lunch |
| 14:00—14:50 (PDT) |
Abstract The Ethereum Foundation recently announced the Proximity Prize which aims to resolve some open questions that play an important role in the design of succinct code-based proof systems. In this talk we will define the core questions that the Proximity Prize aims to resolve. We will survey what is currently known, and why these questions are important to the design of proof systems. This is joint work with Gal Arnon and Giacomo Fenzi available at [1]. For this talk, we join the Conference on Information-Theoretic Cryptography (ITC) [2], another affiliated event at Crypto 2026. [2] Conference on Information-Theoretic Cryptography (ITC) Authors:
|
| 14:50—15:00 (PDT) | track switching back to WAC8 room |
| 15:00—15:45 (PDT) |
Abstract Witness encryption is a powerful cryptographic primitive that allows encrypting a message so that only someone holding a valid witness for a specific circuit can decrypt it. While prior schemes are infeasible in practice due to very large ciphertexts, our recent AADP scheme offers a much more efficient alternative based on heuristic security. In this talk, we focus on recent attacks on AADPs (submitted to the publicly posted challenges [1]) and the newest cryptanalysis results. We also propose fixes that can mitigate these attack vectors. [1] Cryptographic Challenges for AADP. 2026. Authors:
|
| 15:45—16:15 (PDT) | afternoon break |
| 16:15—17:00 (PDT) |
Abstract We show in [1] that the runtime complexity of the attack described in "Cryptanalysis of HAWK: a Guessing Game" [2] is much higher than originally claimed by its authors, and the attack is unlikely to pose a threat to HAWK's security in its present form. The attack algorithm had not been implemented before this work; the polynomial-time running-time claim was based on four "plausible heuristics". Our experiments and implementation data point to a super-polynomial class-number obstruction, consistent with exponential-scale growth. The experiments also helped to identify faulty "Heuristic 4" as the source of the observed computational wall when scaling dimension n. The authors of Guessing Game have acknowledged our findings. To make the argument more universal, we also offer a machine-checked conditional reduction from explicit assumptions that shows the complexity to be at least super-polynomial. In terms of methodology, our work demonstrates the role of powerful AI tools in contemporary cryptanalysis — the sudden feasibility of rapid exploration and trial implementation of advanced attack techniques. Our public research artifact [3] contains all source code and datasets to reproduce our results. [1] Markku-Juhani O. Saarinen. HAWK "Guessing Game" is not Polynomial-Time. 2026. preprint. [3] Markku-Juhani O. Saarinen. Guessing-Game Artifacts. 2026. Author:
|
| 17:00—17:45 (PDT) |
Abstract We provide a new way of performing an algebraic attack on the McEliece cryptosystem based on binary Goppa codes. It also applies in general to the case where the field over which the Goppa code is defined is of even characteristic. It is based on a new algebraic modeling for finding as in [CMT23,M25,BLT26] matrices of rank in the code of quadratic relations related to the Goppa code that is attacked. Such matrices are then used to recover the secret algebraic structure of the code, from which an equivalent secret key can be efficiently derived, leading to a full key-recovery attack. A byproduct of our approach is a new distinguisher for Goppa codes in even characteristic which is as the syzygy distinguisher of [R25] subexponential in the security parameter of the scheme. We demonstrate the effectiveness of our attack on McEliece TII challenges, some of which having been studied in [BLT26], and aimed at having 83, 89, 119, 166, 210 and even 248 bit security respectively and CFS keys with parameters r=9 and m=16, corresponding to a security of 74.9 bits according to [LS12]. This CFS key was not attacked in practice in [BLT26] and took us 14 hours of computation and 24GB of RAM. We make the conjecture that this attack has a complexity which is of the same nature as the distinguisher, namely subexponential in the security parameter. Authors:
|
date and location
Date: Sunday, August 16, 2026
Location: UCen Harbor at University of California, Santa Barbara
registration
Select WAC8 under “affiliated events” when registering for Crypto 2026.
organizers
Contact us by email to wac@cryptanalysis.fun.
University of California, San Diego
Trail of Bits
