WAC8 is an affiliated event at Crypto 2026 on Sunday, August 16, 2026 at University of California, Santa Barbara.
workshop description
Cryptography is often thought of as the bright spot of practical security, a mathematical paradise where security can be rigorously proven and issues like buffer overflows are in someone else’s department. However, there is a growing community of researchers who regularly find serious flaws in widely deployed cryptographic implementations and protocols. This type of research is often published in systems security conferences. WAC will bring together researchers who work on cryptographic attacks and provide a showcase of their work for the Crypto community. This is the eighth edition of the WAC workshop, which was established by Nadia Heninger.
program
This is a preliminary program and we are still adding more talks. The talks are listed in no particular order and times will be fixed shortly.
| Sunday August 16, 2026 | |
|---|---|
| TBD |
Abstract We show in [1] that the runtime complexity of the attack described in "Cryptanalysis of HAWK: a Guessing Game" [2] is much higher than originally claimed by its authors, and the attack is unlikely to pose a threat to HAWK's security in its present form. The attack algorithm had not been implemented before this work; the polynomial-time running-time claim was based on four "plausible heuristics". Our experiments and implementation data point to a super-polynomial class-number obstruction, consistent with exponential-scale growth. The experiments also helped to identify faulty "Heuristic 4" as the source of the observed computational wall when scaling dimension n. The authors of Guessing Game have acknowledged our findings. To make the argument more universal, we also offer a machine-checked conditional reduction from explicit assumptions that shows the complexity to be at least super-polynomial. In terms of methodology, our work demonstrates the role of powerful AI tools in contemporary cryptanalysis — the sudden feasibility of rapid exploration and trial implementation of advanced attack techniques. Our public research artifact [3] contains all source code and datasets to reproduce our results. [1] Markku-Juhani O. Saarinen. HAWK "Guessing Game" is not Polynomial-Time. 2026. preprint. [3] Markku-Juhani O. Saarinen. Guessing-Game Artifacts. 2026. Author:
|
| TBD |
Abstract We provide a new way of performing an algebraic attack on the McEliece cryptosystem based on binary Goppa codes. It also applies in general to the case where the field over which the Goppa code is defined is of even characteristic. It is based on a new algebraic modeling for finding as in [CMT23,M25,BLT26] matrices of rank in the code of quadratic relations related to the Goppa code that is attacked. Such matrices are then used to recover the secret algebraic structure of the code, from which an equivalent secret key can be efficiently derived, leading to a full key-recovery attack. A byproduct of our approach is a new distinguisher for Goppa codes in even characteristic which is as the syzygy distinguisher of [R25] subexponential in the security parameter of the scheme. We demonstrate the effectiveness of our attack on McEliece TII challenges, some of which having been studied in [BLT26], and aimed at having 83, 89, 119, 166, 210 and even 248 bit security respectively and CFS keys with parameters r=9 and m=16, corresponding to a security of 74.9 bits according to [LS12]. This CFS key was not attacked in practice in [BLT26] and took us 14 hours of computation and 24GB of RAM. We make the conjecture that this attack has a complexity which is of the same nature as the distinguisher, namely subexponential in the security parameter. Authors:
|
| TBD |
Abstract The Ethereum Foundation recently announced the Proximity Prize which aims to resolve some open questions that play an important role in the design of succinct code-based proof systems. In this talk we will define the core questions that the Proximity Prize aims to resolve. We will survey what is currently known, and why these questions are important to the design of proof systems. This is joint work with Gal Arnon and Giacomo Fenzi available at [1]. For this talk, we join the Conference on Information-Theoretic Cryptography (ITC) [2], another affiliated event at Crypto 2026. [2] Conference on Information-Theoretic Cryptography (ITC) Authors:
|
| TBD |
Abstract Witness encryption is a powerful cryptographic primitive that allows encrypting a message so that only someone holding a valid witness for a specific circuit can decrypt it. While prior schemes are infeasible in practice due to very large ciphertexts, our recent AADP scheme offers a much more efficient alternative based on heuristic security. In this talk, we focus on recent attacks on AADPs (submitted to the publicly posted challenges [1]) and the newest cryptanalysis results. We also propose fixes that can mitigate these attack vectors. [1] Cryptographic Challenges for AADP. 2026. Authors:
|
| TBD |
Abstract Mesh is a new addition to the family of Bluetooth protocols. In contrast to a regular Bluetooth star topology, Mesh enables many-to-many, group-key-encrypted communication between devices. Unfortunately, several attacks have already been shown against Mesh. In this talk, we will give an overview of these attacks and present new ones we discovered during the analysis of the specification. We reported our findings to Bluetooth SIG, who did not acknowledge them as a threat, despite the attacker being able to learn the shared group keys. Authors:
|
| TBD |
Abstract Nation State Agencies go to great lengths to obtain signal intelligence, including backdooring cryptographic standards and equipment. Although the existence of these backdoor efforts is common knowledge, only few of known backdoored systems have been publicly analysed. In this talk, based on our paper [1], we present the first detailed forensic cryptanalysis of the backdoored UA-8295 message terminal and we try to answer questions how the UA-8295's backdoor was designed and for which attack. Towards a better understanding of real-world backdoor design, we posit a Backdoor Conjecture that provides handles to reason about the design of backdoors and the attacks they are designed for. Authors:
|
| TBD |
Abstract We present two attacks against the integrity of conversations in Signal: we show that a malicious server can inject messages into a conversation between two honest users without them being aware of it. These attacks do not require any key compromises and the second one is completely undetectable. These vulnerabilities raise a number of questions. How were they introduced? How can they still be present after the extensive security analysis to which Signal's protocols have been subjected? What wider lessons can be drawn in order to prevent similar issues arising in the future? We answer these questions in our talk. The full paper for this work is on eprint [1]. Authors:
|
date and location
Date: Sunday, August 16, 2026
Location:
- Interactive Learning Pavilion (ILP) building. Room 1302.
- University of California, Santa Barbara
registration
Select WAC8 under “affiliated events” when registering for Crypto 2026.
timeline
- June 10, 2026: open call for talks
- July 3, 2026 AoE: deadline for contributed talk submissions
- July 6, 2026: notice of talk proposal acceptance/rejection
July 6July 10, 2026: publish preliminary program (we are still confirming talks and will finalize the program within the next week)- August 16, 2026: workshop
organizers
Contact us by email to wac@cryptanalysis.fun.
University of California, San Diego
Trail of Bits