Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Advances in Mathematics of Communications

A commutative group action-based framework for asymmetric anamorphic encryption

Pratima Jana, Surbhi Shaw

Published Oct 9, 2026• 0 citations
Publisher

Abstract

Anamorphic encryption is a cryptographic paradigm that allows covert messages to be hidden inside ordinary ciphertexts of a public-key encryption scheme. The covert channel is enabled by a secret double-key shared between the sender and an authorized receiver. Even if an adversary coerces the receiver into revealing the secret-key, the hidden communication remains undetectable without the double-key. Existing formulations of asymmetric anamorphic encryption suffer from two limitations. First, key pairs of a public-key encryption scheme and double-keys are tightly coupled: once a public-key is deployed, it is no longer possible to associate fresh double-keys with it. Second, existing constructions of asymmetric anamorphic encryption either rely on additional cryptographic primitives or on stronger structural assumptions, or they are scheme-specific.In this work, we refine the syntax of asymmetric anamorphic encryption so that double-key generation is separated from key deployment, allowing multiple double-keys to be registered with the same public-key after setup. We then construct an asymmetric anamorphic encryption scheme from the group-action-based public-key encryption scheme $ \mathsf{gaPKE} $, which is built from a regular effective group action over a commutative group. The resulting scheme is secure in the standard model. Our construction combines a hybrid encryption scheme, built under the $ \textsf{GA-DDH}$ assumption and entropy smoothing of hash functions, with a second independent group-action instance that carries the covert message. The resulting scheme satisfies anamorphic security, sender indistinguishability under chosen-plaintext attack security and colluder indistinguishability under chosen-plaintext attack security. We instantiate our framework in both post-quantum and classical settings. Using $ \textsf{CSIDH}$ group actions, we obtain the first isogeny-based asymmetric anamorphic encryption scheme. Using $ \textsf{DDH}$-hard groups, we obtain a classical anamorphic encryption scheme based on hashed ElGamal.

DOI
10.3934/amc.2026.101091

Related papers

Anamorphic Encryption with CCA Security: A Standard Model Construction

Shujun Wang, Jianting Ning, Qinyi Li +1 more

Anamorphic encryption serves as a vital tool for covert communication, maintaining secrecy even during post-compromise scenarios. Particularly in the receiver-anamorphic setting, a user can shield hidden messages even when coerced into surrendering their secret keys. However, a major bottleneck in existing research is the reliance on CPA-security, leaving the construction of a generic, CCA-secure anamorphic scheme in the standard model as a persistent open challenge. To bridge this gap, we formalize the Anamorphic Key Encapsulation Mechanism (AKEM), encompassing both Public-Key (PKAKEM) and Symmetric-Key (SKAKEM) variants. We propose generic constructions for these primitives, which can be instantiated using any KEM that facilitates randomness recovery. Notably, our framework achieves strong IND-CCA (sIND-CCA) security for the covert channel. We provide a rigorous formal proof in the standard model, demonstrating resilience against a "dictator" who controls the decapsulation key. The security of our approach is anchored in the injective property of the base KEM, which ensures a unique mapping between ciphertexts and randomness. By integrating anamorphism into the KEM-DEM paradigm, our work significantly enhances the practical utility of covert channels within modern cryptographic infrastructures.

arXiv:2604.07771•Apr 9, 2026•0 citations

Computational Quantum Anamorphic Encryption and Quantum Anamorphic Secret-Sharing

Sayantan Ganguly, Shion Samadder Chaudhury

The concept of anamorphic encryption, first formally introduced by Persiano et al. in their influential 2022 paper titled ``Anamorphic Encryption: Private Communication Against a Dictator,'' enables embedding covert messages within ciphertexts. One of the key distinctions between a ciphertext embedding a covert message and an original ciphertext, compared to an anamorphic ciphertext, lies in the indistinguishability between the original ciphertext and the anamorphic ciphertext. This encryption procedure has been defined based on a public-key cryptosystem. Initially, we present a quantum analogue of the classical anamorphic encryption definition that is based on public-key encryption. Additionally, we introduce a definition of quantum anamorphic encryption that relies on symmetric key encryption. Furthermore, we provide a detailed generalized construction of quantum anamorphic symmetric key encryption within a general framework, which involves taking any two quantum density matrices of any different dimensions and constructing a single quantum density matrix, which is the quantum anamorphic ciphertext containing ciphertexts of both of them. Subsequently, we introduce a definition of computational anamorphic secret-sharing and extend the work of Çakan et al. on computational quantum secret-sharing to computational quantum anamorphic secret-sharing, specifically addressing scenarios with multiple messages, multiple keys, and a single share function. This proposed secret-sharing scheme demonstrates impeccable security measures against quantum adversaries.

quant-pharXiv:2511.17924•Nov 25, 2025•0 citations

When Threshold Meets Anamorphic Signatures: What is Possible and What is Not!

Hien Chu, Khue Do, Lucjan Hanzlik +1 more

Anamorphic signatures allow covert communication through signatures in environments where encryption is restricted. They enable trusted recipients with a double-key to extract hidden messages while the signature remains indistinguishable from a regular one. However, the traditional notion of anamorphic signatures suffers from vulnerabilities, particularly when a single recipient or sender is compromised, exposing all hidden messages and providing undeniable proof that citizens are part of the anamorphic exchange. To address these limitations, we explore a threshold-based approach to distribute trust among multiple recipients, preventing adversaries from decrypting anamorphic messages even if some recipients are compromised. Our first contribution is the formalization of the notion of threshold-recipient anamorphic signatures, where decryption is possible only through collaboration among a subset of recipients. We then explore a stronger model in which the dictator controls the key-generation process through which it learns all secret keys, as well as how citizens store cryptographic keys. A particular example of this model in the real world is a dictator providing citizens with electronic identity documents (eIDs) and blocking all other usage of cryptography. We demonstrate that anamorphic communication is still possible even in such a scenario. Our construction is secure against quantum adversaries and does not rely on any computational assumptions beyond the random-oracle model. Finally, we present an impossibility result for encoding anamorphic messages with a threshold-sender model when using many existing threshold signature schemes, even when the adversary is part of the signing group. Our work outlines both the possibilities and limitations of extending anamorphic signatures with threshold cryptography, offering new insights into improving the security and privacy of individuals under authoritarian regimes.

Proceedings on Privacy Enhancing Technologies•Jul 14, 2026•0 citations

Adaptively UC-Secure Oblivious Transfer from Group Actions

Olivier Blazy, Céline Chevalier, Saqib A. Kakvi +1 more

Oblivious Transfer (OT) is a fundamental building block for secure computation, in which a sender holds two messages and a receiver learns exactly one of them, without revealing which one was chosen and without learning the other. While generic constructions for Universally Composable (UC) OT exist, instantiating them from post-quantum assumptions remains challenging, particularly under adaptive corruption. In this work, we present the first adaptively UC-secure OT protocol based on Group Actions, specifically assuming weakly pseudorandom Effective Group Actions (EGA) like CSIDH. We adhere to the framework of [BC15], which derives an adaptively UC-secure OT protocol from SPHF-friendly extractable and equivocable ( ⋿ 2 ) commitment schemes. The central challenge in instantiating this construction from group actions is the lack of SPHF-friendly IND-CCA encryption. Classical CCA transformations such as Fujisaki-Okamoto destroy the algebraic structure required for building SPHFs over ciphertexts, while known group action-based schemes offer no native mechanism to prove ciphertext validity. To overcome this obstacle, we construct from group actions an IND-CCA encryption scheme with enough algebraic structure to efficiently recognize valid ciphertexts. Our contributions are threefold: (1) a verifiable chameleon hash function with perfect soundness in the standard model, (2) an SPHF-friendly, publicly verifiable IND-CCA encryption scheme in the random oracle model, and (3) we combine these to build an SPHF-friendly ⋿ 2 commitment scheme and derive a fully adaptively secure OT protocol in the UC framework. This is the first construction of its kind under group action assumptions, enabling post-quantum secure OT with adaptive security guarantees. These building blocks may also be of independent interest e.g., to obtain digital signatures, non-malleable commitment schemes, or verifiable encryption.

IACR Communications in Cryptology•Oct 26, 2026•0 citations

Adaptively-Secure, Non-Interactive Public-Key Encryption.

Ran Canetti, Shai Halevi, Jonathan I. Katz

Abstract. Adaptively-secure encryption schemes ensure secrecy even in the presence of an adversary who can corrupt parties in an adaptive manner based on public keys, ciphertexts, and secret data of alreadycorrupted parties. Ideally, an adaptively-secure encryption scheme should, like standard public-key encryption, allow arbitrarily-many parties to use a single encryption key to securely encrypt arbitrarily-many messages to a given receiver who maintains only a single short decryption key. However, it is known that these requirements are impossible to achieve: no non-interactive encryption scheme that supports encryption of an unbounded number of messages and uses a single, unchanging decryption key can be adaptively secure. Impossibility holds even if secure data erasure is possible. We show that this limitation can be overcome by updating the decryption key over time and making some mild assumptions about the frequency of communication between parties. Using this approach, we construct adaptively-secure, completely non-interactive encryption schemes supporting secure encryption of arbitrarily-many messages from arbitrarilymany senders. Our schemes additionally provide forward security and security against chosen-ciphertext attacks. 1

•Jan 1, 2004•1 citation

Hybrid deniable and short-key encryption protocols based on the authentication procedure

Tan Sy Ho, Alexander Andreevich Moldovyan, Moldovyan Nikolay Andreevich +5 more

To ensure resistance to attacks with coercion to disclose a secret key by an active adversary, the protocol of deniable encryption includes a procedure for mutual authentication of the sender and receiver of a message with their long-term public keys, which is combined with a hidden exchange of single-use public keys used to generate a single-use shared key, on which the secret message is encrypted. Longterm public keys are used to generate a shared secret key, on which a fake message is encrypted. The produced intermediate ciphertexts are converted into a single ciphertext, which is computationally indistinguishable from the ciphertext obtained by probabilistic encryption of a fake message. This approach allows us to build an encryption protocol that is resistant to bi-sided attacks with coercion, since the disclosure of users' private keys gives access only to the fake message and cannot be used to prove the possibility of alternative decryption of the ciphertext transmitted over a public communication channel. The authentication of the single-use public keys is also used to implement protocols for secure encryption using short shared keys.

International Conference on Advanced Computing and Applications (ACOMP)•Nov 1, 2020•1 citation
Anamorphic encryption is a cryptographic paradigm that allows covert messages to be hidden inside ordinary ciphertexts of a public-key encryption scheme. The covert channel is enabled by a secret double-key shared between the sender and an authorized receiver. Even if an adversary coerces the receiver into revealing the secret-key, the hidden communication remains undetectable without the double-key. Existing formulations of asymmetric anamorphic encryption suffer from two limitations. First, key pairs of a public-key encryption scheme and double-keys are tightly coupled: once a public-key is deployed, it is no longer possible to associate fresh double-keys with it. Second, existing constructions of asymmetric anamorphic encryption either rely on additional cryptographic primitives or on stronger structural assumptions, or they are scheme-specific.In this work, we refine the syntax of asymmetric anamorphic encryption so that double-key generation is separated from key deployment, allowing multiple double-keys to be registered with the same public-key after setup. We then construct an asymmetric anamorphic encryption scheme from the group-action-based public-key encryption scheme gaPKE\mathsf{gaPKE}gaPKE, which is built from a regular effective group action over a commutative group. The resulting scheme is secure in the standard model. Our construction combines a hybrid encryption scheme, built under the GA-DDH \textsf{GA-DDH}GA-DDH assumption and entropy smoothing of hash functions, with a second independent group-action instance that carries the covert message. The resulting scheme satisfies anamorphic security, sender indistinguishability under chosen-plaintext attack security and colluder indistinguishability under chosen-plaintext attack security. We instantiate our framework in both post-quantum and classical settings. Using CSIDH \textsf{CSIDH}CSIDH group actions, we obtain the first isogeny-based asymmetric anamorphic encryption scheme. Using DDH \textsf{DDH}DDH-hard groups, we obtain a classical anamorphic encryption scheme based on hashed ElGamal.
Anamorphic encryption serves as a vital tool for covert communication, maintaining secrecy even during post-compromise scenarios. Particularly in the receiver-anamorphic setting, a user can shield hidden messages even when coerced into surrendering their secret keys. However, a major bottleneck in existing research is the reliance on CPA-security, leaving the construction of a generic, CCA-secure anamorphic scheme in the standard model as a persistent open challenge. To bridge this gap, we formalize the Anamorphic Key Encapsulation Mechanism (AKEM), encompassing both Public-Key (PKAKEM) and Symmetric-Key (SKAKEM) variants. We propose generic constructions for these primitives, which can be instantiated using any KEM that facilitates randomness recovery. Notably, our framework achieves strong IND-CCA (sIND-CCA) security for the covert channel. We provide a rigorous formal proof in the standard model, demonstrating resilience against a "dictator" who controls the decapsulation key. The security of our approach is anchored in the injective property of the base KEM, which ensures a unique mapping between ciphertexts and randomness. By integrating anamorphism into the KEM-DEM paradigm, our work significantly enhances the practical utility of covert channels within modern cryptographic infrastructures.
The concept of anamorphic encryption, first formally introduced by Persiano et al. in their influential 2022 paper titled ``Anamorphic Encryption: Private Communication Against a Dictator,'' enables embedding covert messages within ciphertexts. One of the key distinctions between a ciphertext embedding a covert message and an original ciphertext, compared to an anamorphic ciphertext, lies in the indistinguishability between the original ciphertext and the anamorphic ciphertext. This encryption procedure has been defined based on a public-key cryptosystem. Initially, we present a quantum analogue of the classical anamorphic encryption definition that is based on public-key encryption. Additionally, we introduce a definition of quantum anamorphic encryption that relies on symmetric key encryption. Furthermore, we provide a detailed generalized construction of quantum anamorphic symmetric key encryption within a general framework, which involves taking any two quantum density matrices of any different dimensions and constructing a single quantum density matrix, which is the quantum anamorphic ciphertext containing ciphertexts of both of them. Subsequently, we introduce a definition of computational anamorphic secret-sharing and extend the work of Çakan et al. on computational quantum secret-sharing to computational quantum anamorphic secret-sharing, specifically addressing scenarios with multiple messages, multiple keys, and a single share function. This proposed secret-sharing scheme demonstrates impeccable security measures against quantum adversaries.
Anamorphic signatures allow covert communication through signatures in environments where encryption is restricted. They enable trusted recipients with a double-key to extract hidden messages while the signature remains indistinguishable from a regular one. However, the traditional notion of anamorphic signatures suffers from vulnerabilities, particularly when a single recipient or sender is compromised, exposing all hidden messages and providing undeniable proof that citizens are part of the anamorphic exchange. To address these limitations, we explore a threshold-based approach to distribute trust among multiple recipients, preventing adversaries from decrypting anamorphic messages even if some recipients are compromised. Our first contribution is the formalization of the notion of threshold-recipient anamorphic signatures, where decryption is possible only through collaboration among a subset of recipients. We then explore a stronger model in which the dictator controls the key-generation process through which it learns all secret keys, as well as how citizens store cryptographic keys. A particular example of this model in the real world is a dictator providing citizens with electronic identity documents (eIDs) and blocking all other usage of cryptography. We demonstrate that anamorphic communication is still possible even in such a scenario. Our construction is secure against quantum adversaries and does not rely on any computational assumptions beyond the random-oracle model. Finally, we present an impossibility result for encoding anamorphic messages with a threshold-sender model when using many existing threshold signature schemes, even when the adversary is part of the signing group. Our work outlines both the possibilities and limitations of extending anamorphic signatures with threshold cryptography, offering new insights into improving the security and privacy of individuals under authoritarian regimes.
Oblivious Transfer (OT) is a fundamental building block for secure computation, in which a sender holds two messages and a receiver learns exactly one of them, without revealing which one was chosen and without learning the other. While generic constructions for Universally Composable (UC) OT exist, instantiating them from post-quantum assumptions remains challenging, particularly under adaptive corruption. In this work, we present the first adaptively UC-secure OT protocol based on Group Actions, specifically assuming weakly pseudorandom Effective Group Actions (EGA) like CSIDH. We adhere to the framework of [BC15], which derives an adaptively UC-secure OT protocol from SPHF-friendly extractable and equivocable ( ⋿ 2 ) commitment schemes. The central challenge in instantiating this construction from group actions is the lack of SPHF-friendly IND-CCA encryption. Classical CCA transformations such as Fujisaki-Okamoto destroy the algebraic structure required for building SPHFs over ciphertexts, while known group action-based schemes offer no native mechanism to prove ciphertext validity. To overcome this obstacle, we construct from group actions an IND-CCA encryption scheme with enough algebraic structure to efficiently recognize valid ciphertexts. Our contributions are threefold: (1) a verifiable chameleon hash function with perfect soundness in the standard model, (2) an SPHF-friendly, publicly verifiable IND-CCA encryption scheme in the random oracle model, and (3) we combine these to build an SPHF-friendly ⋿ 2 commitment scheme and derive a fully adaptively secure OT protocol in the UC framework. This is the first construction of its kind under group action assumptions, enabling post-quantum secure OT with adaptive security guarantees. These building blocks may also be of independent interest e.g., to obtain digital signatures, non-malleable commitment schemes, or verifiable encryption.
Abstract. Adaptively-secure encryption schemes ensure secrecy even in the presence of an adversary who can corrupt parties in an adaptive manner based on public keys, ciphertexts, and secret data of alreadycorrupted parties. Ideally, an adaptively-secure encryption scheme should, like standard public-key encryption, allow arbitrarily-many parties to use a single encryption key to securely encrypt arbitrarily-many messages to a given receiver who maintains only a single short decryption key. However, it is known that these requirements are impossible to achieve: no non-interactive encryption scheme that supports encryption of an unbounded number of messages and uses a single, unchanging decryption key can be adaptively secure. Impossibility holds even if secure data erasure is possible. We show that this limitation can be overcome by updating the decryption key over time and making some mild assumptions about the frequency of communication between parties. Using this approach, we construct adaptively-secure, completely non-interactive encryption schemes supporting secure encryption of arbitrarily-many messages from arbitrarilymany senders. Our schemes additionally provide forward security and security against chosen-ciphertext attacks. 1
To ensure resistance to attacks with coercion to disclose a secret key by an active adversary, the protocol of deniable encryption includes a procedure for mutual authentication of the sender and receiver of a message with their long-term public keys, which is combined with a hidden exchange of single-use public keys used to generate a single-use shared key, on which the secret message is encrypted. Longterm public keys are used to generate a shared secret key, on which a fake message is encrypted. The produced intermediate ciphertexts are converted into a single ciphertext, which is computationally indistinguishable from the ciphertext obtained by probabilistic encryption of a fake message. This approach allows us to build an encryption protocol that is resistant to bi-sided attacks with coercion, since the disclosure of users' private keys gives access only to the fake message and cannot be used to prove the possibility of alternative decryption of the ciphertext transmitted over a public communication channel. The authentication of the single-use public keys is also used to implement protocols for secure encryption using short shared keys.