Current students

Speaker: Ian George
Affiliation: University of Waterloo
Location: MC 5417

Abstract: Causal Set Theory (CST) is a theory of quantum gravity where spacetime is taken to be a locally finite poset, called a causal set.  A central problem in CST is to determine physically relevant properties from the purely combinatorial information of the causal set.  In 2014 Glaser and Surya demonstrated that the distribution of interval sizes of a causal set sprinkled into a region of Minkowski space contains information about the dimension of the underlying spacetime.  In 2026 Surya showed that this distribution can be used to define a “closeness” function on causal sets that distinguishes by dimension and global topology.  In this talk we present work motivated by these results which investigates the more general notion of convex sets, instead of intervals, of a poset.  First, we will introduce a generating polynomial for convex sets in a finite poset and explore some of its properties.  We will then show that this polynomial is a complete invariant for the family of series-parallel posets.  Lastly, we discuss early results on the utility of this polynomial in CST.  The pre-seminar will introduce relevant background on CST.

There will be a pre-seminar presenting relevant background at the beginning graduate level starting at 1:30pm.

Monday, March 23, 2026 11:30 am - 12:30 pm EDT (GMT -04:00)

Algebraic Graph Theory-Zhaochen Ding-A construction of multicovers of a cycle

Speaker: Zhaochen Ding
Affiliation:

University of Primorska

Location: Please contact Sabrina Lato for Zoom link.

Abstract: Praeger-Xu graphs are a family of multicovers of cycles, known for some of their surprising properties. A fundamental observation is that these graphs can be constructed from De Bruijn graphs. In this presentation, we will generalize the definition of De Bruijn graphs to create a broader family of multicovers. Finally, we will compute the automorphism group and show some applications of our constructions. This is a joint work with Ci Xuan Wu.

Speaker:

Noah Weninger
Affiliation: University of Waterloo
Location: MC 6029

Abstract:In the knapsack interdiction problem, there are two players and $n$ items, each with some profit, removal cost, and packing weight. First, the interdictor selects items to remove; the total removal cost must fit within the interdiction budget. Then, the follower solves a knapsack problem on the remaining items. The objective is to select an interdiction set which minimizes the follower's maximum profit. This problem is $\Sigma_2^p$-complete.


We present a $(2+\epsilon)$-approximation with running time polynomial in $n$ and $1/\epsilon$. We start by showing that after LP-relaxing the follower's knapsack, the problem becomes solvable with dynamic programming in pseudopolynomial time, and yields a 2-approximation for the original problem. We then show that this dynamic program can be rounded to get an FPTAS for the 2-approximate problem. Although there is already a PTAS known for knapsack interdiction (Chen et al, 2022), our algorithm is considerably simpler and faster: to achieve a 3-approximation, the PTAS needs running time $\Omega(n^{100})$, whereas ours is only $\tilde O(n^3)$.
Friday, March 20, 2026 10:30 am - 11:30 am EDT (GMT -04:00)

Crypto Reading Group - Pranshu Kumar-Generic Transformations for Updatable PKEs

Speaker:

Pranshu Kumar
Affiliation: University of Waterloo
Location: MC 6029

Abstract:Updatable Public-Key Encryption (UPKE) augments the security of PKE with Forward Secrecy properties. It was originally proposed by Jost et al. (EUROCRYPT 2019) to provide security guarantees in secure messaging applications efficiently. Later, Alwen et al. (CRYPTO 2020) showed that TreeKEM, when used for Continuous Group Key Agreement (CGKA) in Message Layer Security (MLS), failed to achieve adequate security and proposed using UPKEs to modify TreeKEM. Since then, UPKEs have become a part of the Message Layer Security specification, and their security properties have been extensively studied. Alwen, Fuchsbauer, and Mularczyk (AFM, Eurocrypt’24) presented the strongest security notion to date, adding many additional properties that strengthen its security in CGKA and MLS.

Friday, March 20, 2026 3:30 pm - 4:30 pm EDT (GMT -04:00)

Tutte Colloquium -Bruno Sterner-Large smooth twins from short lattice vectors

Speaker: Bruno Sterner
Affiliation: University of Waterloo
Location: MC 5501

Abstract: We discuss the challenging problem of finding pairs of consecutive smooth integers, which we refer to as a smooth twin. In other words the largest prime factor in the twin is relatively small. This computational number theoretic problem has appeared in the context of isogeny-based cryptography whereby a select number of cryptosystems use such twins as part of their parameter setup. The challenging part to the problem is finding smooth twins whose largest prime factor is as small as possible. Prior to this work, twins of this nature have at most 74-bits which is much too small for cryptographic relevance. We bridge this gap by presenting a new method that finds significantly larger smooth twins with as small as possible smoothness bound. The idea of our algorithm is based on the well known and studied problem of finding short vectors in a well constructed lattice. We report a 196-bit smooth twin which falls in this regime as well as a few larger twins that have small (but not the smallest) smoothness bounds.

Friday, March 13, 2026 10:30 am - 11:30 am EDT (GMT -04:00)

Crypto Reading Group - Huanhuan Chen-Updatable Encryption

Speaker:

Huanhuan Chen
Affiliation: University of Waterloo
Location: MC 6029

Abstract:Updatable encryption (UE) enables a cloud server to update ciphertexts using client-generated tokens. There are two types of UE: ciphertext-independent (c-i) and ciphertext-dependent (c-d). In terms of construction and efficiency, c-i UE utilizes a single token to update all ciphertexts. The update mechanism relies mainly on the homomorphic properties of exponentiation, which limits the efficiency of encryption and updating. Although c-d UE may seem inconvenient as it requires downloading parts of the ciphertexts during token generation, it allows for easy implementation of the Dec-then-Enc structure. This methodology significantly simplifies the construction of the update mechanism. Notably, the c-d UE scheme proposed by Boneh et al. (ASIACRYPT’20) has been reported to be 200 times faster than prior UE schemes based on DDH hardness, which is the case for most existing c-i UE schemes. Furthermore, c-d UE ensures a high level of security as the token does not reveal any information about the key, which is difficult for c-i UE to achieve. However, previous security studies on c-d UE only addressed selective security; the studies for adaptive security remain an open problem.

In this study, we make three significant contributions to ciphertext-dependent updatable encryption (c-d UE). Firstly, we provide stronger security notions compared to previous work, which capture adaptive security and also consider the adversary’s decryption capabilities under the adaptive corruption setting. Secondly, we propose a new c-d UE scheme that achieves the proposed security notions. The token generation technique significantly differs from the previous Dec-then-Enc structure, while still preventing key leakages. At last, we introduce a packing technique that enables the simultaneous encryption and updating of multiple messages within a single ciphertext. This technique helps alleviate the cost of c-d UE by reducing the need to download partial ciphertexts during token generation.
Speaker: Stephan Pfannerer
Affiliation: University of Waterloo
Location: MC 5417

Abstract: 

In 1995, Kuperberg introduced a remarkable collection of trivalent web bases which encode tensor invariants of U_q(sl_3). Extending these bases to general sl_r has been an open problem ever since. We present a solution to the r=4 case by introducing hourglass plabic graphs, a new generalization of Postnikov's plabic graphs. Joint work with Christian Gaetz, Oliver Pechenik, Jessica Striker and Joshua Swanson.
There will be a pre-seminar presenting relevant background at the beginning graduate level starting at 1:30pm in MC 5417.

There will be a pre-seminar presenting relevant background at the beginning graduate level starting at 1:30pm in MC 5417.

Speaker: Seunghoon Lee
Affiliation: University of Waterloo
Location: MC 5501

Abstract: The (parallel) pebbling game is a useful abstraction for analyzing the resources (e.g., space, space-time, amortized space-time) needed to evaluate a function f with a static data-dependency graph G on a (parallel) computer. The underlying question is purely combinatorial: what tradeoffs does a directed acyclic graph (DAG) force between storing intermediate values and recomputing them? This viewpoint has been particularly influential in cryptography, where many “Memory-Hard Function” (MHF) constructions can be modeled by evaluating a fixed DAG.

Classical pebbling, however, does not capture an essential constraint in quantum/reversible computation: intermediate information cannot be discarded freely, so cleanup must respect the dependency structure. While sequential reversible pebbling has been used to study space-time tradeoffs in sequential settings, it does not reflect the space-time tradeoffs for parallel quantum/reversible algorithms. To model this, we introduce the parallel reversible pebbling game and use it to analyze reversible space-time and amortized costs for important graph families, including line graphs and structured DAGs arising in MHF constructions (e.g., Argon2i and DRSample).
The talk highlights two core results: First, we give a lower bound on the reversible amortized space-time cost for a line graph, which yields a separation between classical and reversible pebbling costs, showing a super-constant (yet sub-polynomial) gap. Second, this overhead is nevertheless controlled: we show that any classical parallel pebbling can be transformed into a reversible one with only a sub-polynomial loss. This generic transformation serves as a central tool for analyzing broader graph families.
The talk will focus on the combinatorial aspects of cryptographic applications; no background in cryptography is assumed. Based on joint work with Jeremiah Blocki and Blake Holman: The Parallel Reversible Pebbling Game: Analyzing the Post-Quantum Security of iMHFs (TCC 2022), and The Impact of Reversibility on Parallel Pebbling (EUROCRYPT 2025).
Monday, March 9, 2026 2:45 pm - 3:45 pm EDT (GMT -04:00)

Graphs and Matroids - Taite LaGrange-Classes of graphs with sub-linear twin-width

Speaker: Taite LaGrange
Affiliation: University of Waterloo
Room: MC 5479

Abstract:Twin-width is a graph and matrix parameter introduced in 2021 by Bonnet, Kim, Thomassé, and Watrigant as essentially a measure of the 'error' between vertex neighbourhoods over a series of vertex contractions. This talk covers some graph classes with unbounded twin-width. We present a tool for obtaining twin-width bounds in general by contracting a graph based on a partition by distinct neighbourhoods. For a graph G on n vertices, we show that if such a partition exists, then the twin-width of G is at worst sub-linear with respect to n. We use this to obtain an upper bound on the twin-width of interval graphs and of graphs with bounded VC dimension. The latter implies that hereditary classes have sub-linear twin-width if and only if they have bounded VC dimension.

Speaker:

Leonardo Colò
Affiliation: University of Waterloo
Location: MC 6029

Abstract: Isogeny-basedcryptographyisoneofthecandidatesforpost- quantum cryptography. One of the benefits of using isogeny-based cryptography is its compactness. In particular, a key exchange scheme SIDH allowed us to use a 4λ-bit prime for the security parameter λ. Unfortunately, SIDH was broken in 2022 by some studies. After that, some isogeny-based key exchange and public key encryption schemes have been proposed; however, most of these schemes use primes whose sizes are not guaranteed as linearly related to the security parameter λ. As far as we know, the remaining schemes have not been implemented due to the computation of isogenies of high dimensional abelian varieties, or they need to use a “weak” curve (i.e., a curve whose endomorphism ring is known) as the starting curve.

In this study, we propose a novel compact isogeny-based key encapsula- tion mechanism named IS-CUBE via Kani’s theorem and a 3-dimensional SIDH diagram. A prime used in IS-CUBE is of the size of about 8λ bits, and we can use a random supersingular elliptic curve for the starting curve. The public key of IS-CUBE is about 3 times larger than that of SIKE, and the ciphertext of IS-CUBE is about 4 times larger than that of SIKE from theoretical estimation. In practice, compared to FESTA, the public key of IS-CUBE is slightly larger and its ciphertext is slightly smaller.
The core idea of IS-CUBE comes from the hardness of some already known computational problems and a novel computational problem (the Long Isogeny with Torsion (LIT) problem), which is the problem to compute a hidden isogeny from two given supersingular elliptic curves and information of torsion points of relatively small order.