Workshop on
Zero-Knowledge, Succinct Proofs and Symmetric Cryptography
February 9‒11, 2026, Vienna, Austria

In order to work, Zero-Knowledge (ZK) protocols rely on the evaluation of hash functions. As the details of such hash functions have a big impact on the performances of the considered applications, several dedicated ZK-friendly symmetric primitives (defined especially over prime fields) have recently appeared in the literature. Among all, the Poseidon hash function has gained widespread adoption in verifiable computation protocols. Introduced in 2021, Poseidon uses only basic algebraic operations over a prime field, it is currently the fastest-to-prove hash functions, and among the fastest ones to compute natively.
In this presentation, we will analyze the Poseidon/Poseidon2/Poseidon(2)b family in detail, retracing the history of its design rationale, starting with the HadesMiMC cipher. Next, we will discuss more efficient variants of Poseidon/HadesMiMC, namely Neptune and Pluto.

Succinct arguments are fundamental cryptographic primitives with wide-ranging applications. A common approach to build succinct arguments is from probabilistic proofs, dating back to Kilian’s protocol that combines a PCP and a Merkle tree.
In this talk, I will present the tightest bound on the regular security of Kilian's protocol and show how to obtain similar bounds for more general argument systems, such as those based on polynomial commitment schemes. I'll conclude with results that achieve post-quantum security and Fiat-Shamir security for general classes of arguments.

We study a new Fiat-Shamir transformation based on an ideal permutation that minimizes permutation calls and aligns more closely with deployed systems. We show concrete bounds for soundness, knowledge soundness, and zero knowledge, revealing that indifferentiability — the standard notion used in this context for 20 years — falls short for providing security of Fiat-Shamir-based proofs. We fill this gap by introducing a stronger indifferentiability notion that captures the security requirements of modern proof systems.
Joint work with Alessandro Chiesa.
↗ ePrint

In the past, POlynomial System SOlving (POSSo) was seen as being of little relevance in symmetric cryptography: despite its simple low degree description, the AES itself was barely scratched by such techniques. This dramatically changed with the introduction of symmetric primitives intended for more advanced protocols, starting with LowMC more than 10 years ago. Since then, cryptanalysis techniques based on the resolution of a system of non-linear polynomial equations have proven devastating, in a surprising variety of ways.
In this talk, I will give an overview and a taxonomy of the techniques that fall under the (perhaps too broad) umbrella of "algebraic attacks", and try to sketch security arguments for the various cases considered.

While the algorithmic description of circuit-friendly hash functions is often straightforward, the underlying architecture allows for many different ways of implementing them. This talk will go over various implementation characteristics in certain scenarios, and how these change when using them in modern proof systems.