Unconditional

Status	Statement	Tags
	192-Round AES Pairwise Independence Theorem 7 proves the bound for 192-round censored AES – real AES S-boxes and mixing layer, but a subset of the mixing layers removed. The source conjectures the same round count suffices for AES itself, and calls proving it an outstanding open problem. The best proved bound for actual AES is Liu, Tessaro and Vaikuntanathan’s, which needs more than 9000 rounds. 4 open	Block Ciphers Limited Independence Pseudorandom Permutations T Wise Independencetight-bound
	Balanced Root-n Preprocessing PIR The client-space-times-bandwidth product is settled up to n^{o(1)} by the source’s own matching bounds. What is open is whether client space, bandwidth and per-query server computation can all sit at O~(n^{1/2}) simultaneously; the best known point has client space and server computation O~(n^{2/3}). 4 open	Private Information Retrieval Time Space Tradeoffstight-bound
	Planted-Subgraph Character Sum The source derives the formula governing low-degree detection of a planted subgraph, observes the character sum in it should be small for most graphs, and says it leaves the rigorous study of the question to future work. No bound is proved and none is stated as a target. 5 open	Average Case Hardness Planted Subgraph Problemslower-boundadaptation (ai)
	Constant-round Luby–Rackoff, quantum Resolved for r=7. Carolan (Compressed Permutation Oracles, ePrint 2025/1734, STOC 2026) proves seven-round Luby-Rackoff with truly random round functions is indistinguishable from a random invertible permutation against Omega(N^{1/12}) bidirectional quantum queries (his Theorem 6.5), exactly this page’s conjecture with r=7 – and states, without full proof here, that the result lifts to pseudorandom round functions (the strong qPRP form) by a standard hybrid argument. The paper’s own abstract calls this ‘resolving an open question of (Zhandry, 2012).’	Feistel Networks Pseudorandom Permutations Quantum Query Complexityotherequivalenceresearch-solved
	Best-first search trees Open, with no bound of any kind proved for the best-first algorithm on any class of query distributions. Exact optimality is already refuted by the paper’s own exhaustive search, so only the approximation ratio remains, and a workload on which greedy is off by an unbounded factor would settle it. 5 open	Search Treestight-bound
	dv-SNARG, One Group Element Numbered Conjecture 1.3 of the source. Its own theorems achieve one group element plus O(tau) bits, and (with a random oracle) one group element, one hash output and about 2 tau bits; the conjecture halves the additive term to tau + o(tau) and asks for no random oracle. 4 open	Generic Group Model Proof Size Lower Bounds Snarksggmcharacterization
	Four-party NIKE, quadratic, Maurer’s model Open. Achieved in Shoup’s generic group model by the source paper (Construction 9, Theorem 10); in Maurer’s model the paper’s own O(n^2) attack sets a ceiling that a construction would meet exactly, and nothing is known about reaching it. 5 open	Generic Group Model Non Interactive Key Exchangeggmseparation
	Perfectly Correct Statistical ARE Statistical security with statistical correctness is settled by the source for every finite function. Perfect correctness is known in the computational setting and, in the statistical setting, only in a relaxed Las Vegas form where the evaluator may declare failure. 4 open	Additive Randomized Encodings Shuffle Modelcharacterizationadaptation (ai)
	Quadratic attack on 3-NIKE, Shoup’s model Open in Shoup’s model. Settled by the source paper in Maurer’s model for every K at least 3, including imperfect correctness; its own three-party Shoup construction achieves only an n^1.5 gap, so the truth for three parties lies somewhere between n^1.5 and n^2. 5 open	Generic Group Model Non Interactive Key Exchangeggmlower-bound
	Two-block sponge attack, quadratic advice Open: whether the multi-instance two-block sponge attack of advantage (S^2T4/C²⁾S lifts to an auxiliary-input attack of advantage S^2T4/C^2, matching the best proved security bound. Settled in the multi-instance model; no partial result in the auxiliary-input model. 7 open	Collision Finding Collision Resistant Hashing Time Space Tradeoffspromlower-boundadaptation (ai)
	Sources vs Randomness Blowup Conjecture 13 of the source. Its companion question – how many parties must be able to toss coins – is settled exactly by the same paper: t sources for deterministic functionalities, t+1 for randomized ones, even though the adversary may corrupt all of them. What the count costs is not settled. Both halves of the Theta are open. 5 open	Random Sources Randomness Complexitytight-bound
	Quantum two-block MD collisions Open, in both directions and with no partial result: whether the best known quantum preprocessing attack, of advantage ST^2/N + T^3/N, is optimal for two-block Merkle-Damgård collisions. The source reports that no matching quantum bounds are known at any block length. 7 open	Collision Finding Collision Resistant Hashing Quantum Query Complexity Quantum Random Oracle Model Time Space Tradeoffsqromtight-bound
	AVPs Are Lengthy Posed as Hypothesis 1.2 and offered both as a working hypothesis and as an ambitious target. Theorem 1.3 proves it implies super-polynomial lower bounds on sd-PIR, general secret sharing and fully-decomposable randomized encodings – for none of which a super-linear lower bound is currently known. The source adapts counting-based arguments to the model but does not reach the best-known bound for any primitive. 4 open	Garbled Circuits Private Information Retrieval Proof Size Lower Bounds Randomized Encodingslower-boundbarrier (ai)
	Efficient Parity-Tolerance Simulation Feasibility is settled: every circuit can be compiled into a t-parity-tolerant one. What is open is the simulator’s running time, which in the source’s construction is exponential in t; the source gives partial evidence, under LPN, that inefficient simulation may be inherent for a related relaxed notion. 4 open	Leakage Resilient Circuits Learning Parity With Noisecharacterization
	Optimal 2D LPHS Open, and asserted rather than asked: the source prints the algorithm, conjectures the error rate, reports experiments consistent with it, states it could not analyse it, and leaves settling it to future work. The matching lower bound is the source’s own theorem, so a proof would close the two-dimensional case exactly. 7 open	Distributed Discrete Logarithm Generic Group Model Locality Preserving Hashingtight-boundadaptation (ai)
	Optimal martingale gap finders Open for small mu. Settled when mu is bounded away from zero, where the Cleve-Impagliazzo gap finder already gives the conjectured product; for general mu the known bound is a factor mu short and the paper states it does not know the answer. 5 open	Coin Tossinglower-bound
	SZK Batch Verification Named by the source as the most pressing open question its work leaves. Its Theorem 1.1 gives the NISZK analogue: communication and CRS length poly(n, log k) for k up to 2⁽ⁿ0.01). A poly(n) dependence is unavoidable even at k = 1 under a sub-exponential hardness assumption, so log k is the aggressive part of the bound. The source also offers a weaker fallback target: any sub-linear dependence on k. 5 open	Batch Verification Direct Product Theorems Limited Independence Randomness Extractioncharacterization
	Fully quantum time-lock puzzles Open in the fully quantum case. Settled by the source paper when the generator is classical and the solver quantum, and when the generator is quantum and the solver classical under perfect completeness; a classical-query attack on the remaining cell would prove a simulation conjecture. 5 open	Quantum Query Complexity Quantum Random Oracle Model Time Lock Puzzlesqromimpossibility
	CSAT with Small Space and Preprocessing Conjecture 1.2 of the source, a parameterized family rather than a single claim. Corollary 1.3 turns each parameter setting into a limitation on succinct IOPs. The source attaches decreasing confidence as the class T grows, calling the largest setting only (arguably) unlikely to be false rather than confidently believed. 4 open	Interactive Oracle Proofs Proof Size Lower Bounds Space Bounded Computation Time Space Tradeoffslower-boundbarrier (ai)
	CAQB key agreement, imperfect completeness Open. Settled for perfect completeness by the source paper’s Theorem 3.1; the argument’s final step uses perfect completeness in a way that no known weakening survives, and the paper’s Simulation-Conjecture barrier does not cover this party structure. 5 open	Quantum Key Agreement Quantum Query Complexity Quantum Random Oracle Modelqromimpossibility
	One Haar State Looks Like Many Stated in the source’s Open Problems section as a conjecture it believes true, with the note that it could neither prove it nor find it proved or even formalised anywhere. The source proves a strictly weaker pointwise domination bound, its Lemma 2, sufficient for its own applications and silent about total variation distance. 5 open	Pseudorandom Quantum States Quantum Cryptography Quantum Informationothertight-boundadaptation (ai)
	Classical presampling, quantum queries Open, and provably hard to prove: the source’s Theorem 4 shows it implies a central open problem in quantum computing. No refutation has been attempted either, and the source takes no position on which way it goes – it states the conjecture in order to show that the classical technique cannot simply be transplanted. 6 open	Presampling Quantum Query Complexity Quantum Random Oracle Model Random Oracle Modelqromlower-boundbarrier (ai)
	Almost k-Wise Locality Gap Settled up to a log n factor at word size 1 and at word size Omega(log^2 n) and above; the source gives no matching construction at all for intermediate word sizes, so the gap is recorded only where both a bound and a construction exist to compare. 4 open	Limited Independence Locally Computable Hashingtight-boundadaptation (ai)
	SBP Collision Resistance Posed as a displayed Open Question and called a central open challenge. The source gives an efficient online collision finder for small kappa and an overlap-gap-based online lower bound for a different, randomized activation – introduced precisely because the SBP’s own collision space resists a first-moment analysis. For very large kappa collisions become trivial. The middle window is reached by neither technique. 4 open	Average Case Hardness Collision Resistant Hashing Overlap Gap Property Planted Constraint Satisfactionseparation
	Conflict Checkable Codes Beyond Half-Singleton Theorem 1.8 proves k <= (n-d+2)/2 for codes that are both comparison-based and local-to-global consistent. Theorem 1.3 gives an almost-MDS conflict checkable code at k >= n-d+1-epsilon which bypasses that bound, but it is neither comparison-based nor known to be local-to-global consistent. The conjecture names comparison-basedness as the culprit. It already holds at d = n-1. 4 open	Code Based Cryptography Locally Testable Codes Threshold Secret Sharingseparationadaptation (ai)
	Partial-PKI consensus up to one-half resilience Open: whether consensus is achievable at every resilience gamma < 1/2 in the paper’s permissionless common-random-string setting, by some protocol using any means of bootstrapping party identities. The source proves resilience up to 1/4(1-3*epsilon) via a specific protocol and proves 1/4 is tight only for the restricted class of protocols that sign everything they send and verify everything they receive; the gap to the classical 1/2 ceiling is open for arbitrary protocols. 5 open	Byzantine Agreementtight-boundIOG
	Constant-Overhead AMD Circuits Polylogarithmic overhead in \|C\| and lambda is achieved by Genkin, Ishai and Weiss; constant overhead is open. The source’s Theorem 43 shows that achieving it would – together with the source’s own constant-overhead OT protocol – settle the main open question on constant-overhead secure computation for general Boolean circuits. 4 open	Fault Tolerant Circuits Oblivious Transfercharacterization
	Split-source decomposition Open for a query budget of two or more: whether a random oracle decomposes into bit-fixing mixtures when the advice is produced by two sources that never communicate. Proved and tight at q = 0, and proved at q = 1 under an extra hypothesis. 4 open	Multi Source Extractors Random Oracle Model Randomness Extractionromtight-bound
	Degree-2 Statistical RE Question 1.6 of the harvested paper, attributed there to Ishai-Kushilevitz and Applebaum-Ishai-Kushilevitz and described as open for almost 20 years. Degree-3 statistical encodings exist for every finite function; negative results are known for perfectly private degree 2. The harvested paper adds a new consequence, its Proposition 1.7. 4 open	Arithmetic Cryptography Non Interactive Secure Computation Randomized Encodingscharacterizationbarrier (ai)
	r-round DLOG tradeoff Open for every intermediate r: the r = 1 endpoint is the source’s own theorem and r = T is Corrigan-Gibbs–Kogan, with nothing proved in between. The source conjectures the interpolating formula and says a matching attack exists at every r, so the missing half is the lower bound. 6 open	Adaptivity Discrete Logarithm Generic Group Model Time Space Tradeoffsggmtight-bound
	Distance from Lines Modulo a Prime Numbered Conjecture 5.37 of the source, described there as a natural but apparently new number-theoretic conjecture whose study may be of independent interest. Nothing is proved about it; the source notes a deterministic variant might be easier to prove and is still useful. 5 open	Oblivious Linear Evaluation Oblivious Transferlower-bound
	Composability implies circular security Open with no partial result in either direction. The converse – circular security plus limited homomorphism gives full composability – is the source paper’s Theorem 6; this direction, which would make the two properties essentially equivalent, is conjectured there and nothing has been published towards it. 7 open	Circular Security Fully Homomorphic Encryptionequivalence
	Seeded Extractors Are Multi-Instance Posed by the source with both answers live. It proves the property for two code-based extractors via a hinting property it isolates; concurrent independent work of Dinur, Stemmer, Woodruff and Zhou proves it for universal hash functions by a different argument. No extractor is known to fail it and no general proof is known. 4 open	Incompressible Encryption Randomness Extractioncharacterization
	6-round Feistel indifferentiability Whether 6-round Feistel is fully indifferentiable from a random permutation is open, bridging the proven r=5 attack and the proven r>=8 construction. 2 open	Feistel Networks Indifferentiability Pseudorandom Permutationsothertight-bound
	Generalized mirror theory The fully generalized Mirror Theory bound for arbitrary cycle-consistent multi-graphs up to the information-theoretic limit is open; current techniques only reach component size O(N^{1/4}). 2 open	Block Ciphers Mirror Theory Pseudorandom Permutationslower-bound
	Double-sided zero search Resolved, unconditionally. Carolan (Compressed Permutation Oracles, ePrint 2025/1734, STOC 2026) proves this exact statement – his Problem 3, p. 72, naming it ‘the double-sided zero search problem, due to Unruh’ – as a corollary (Corollary 7.6) of a general predicate-search lower bound (Theorem 7.5) proved directly from his own compressed permutation oracle’s soundness (Theorem 5.19). Unlike Unruh’s own derivation, this proof does not route through Unruh’s CPO-soundness conjecture (c/0036) at all, so it holds regardless of that conjecture’s status.	Compressed Oracle Quantum Query Complexityotherlower-boundresearch-solved
	DPP Field Size The small-field regime is settled: soundness Theta(1/sqrt q) is achieved and proved optimal. In the large-field regime the source achieves soundness eps for every prime p at least Omega~(S^9/eps6) and states in as many words that it believes the S-dependence is not tight. 4 open	Linear Pcps Snarkstight-boundadaptation (ai)
	LHL extraction, public seed Proven, and the statement is now formalized in Lean with an AI match check: the public-seed bound holds with a concrete constant, but the proof itself is still only informal (PDF), unreviewed, and unformalized. 6 open	Leftover Hash Lemma Random Oracle Model Randomness Extractionromtight-boundresearch-solvedadaptation (ai)
	Level-optimal beyond disjunctions Open beyond disjunctive queries, and the authors state it as a conjecture without naming the broader class – identifying one is part of the problem. Proved for every distribution supported on disjunctions, where the log n factor is also shown necessary. Wide open for conjunctive queries, where the paper’s proof technique demonstrably fails. 5 open	Search Treestight-bound
	RBE needs Ω(log n) updates Refuted. Mahmoody and Qi, Online Mergers and Applications to Registration-Based Encryption and Accumulators (ITC 2023), construct an RBE scheme with O(log n / log log n) decryption updates and poly(kappa, log n) public parameters – strictly below the Omega(log n) this statement conjectured – via a fully online merger structure, matching the known lower bound exactly. The paper states this explicitly resolves the open question. 4 open	Registration Based Encryptionlower-boundresearch-solvedadaptation (ai)
	EA-Code Distance over Rings Theorem 3.10 of the source proves the distance bound over F_2 only. Over a ring of size q its proof technique forces the rate to satisfy R much less than 1/ln q, which the source states it believes is an artefact of the argument, supported by small-parameter weight-distribution experiments over F_17 and Z_16. 5 open	Code Based Cryptography Dual Distance Learning Parity With Noise Pseudorandom Correlation Functionslower-boundadaptation (ai)
	SK-DEPIR from One-Way Functions Stated by the source as its own conjecture and proved for two-round passive-server schemes. Its main theorem – that any crypto oracle can be stripped out of a SK-DEPIR and replaced by a one-way function – is stated conditionally on this, so the conjecture is the single remaining hypothesis between that compiler and a clean statement that no idealized generic primitive helps. 4 open	Black Box Separations One Way Functions Private Information Retrievalimpossibility
	No key agreement from GC-OWF Open for round complexity growing with the security parameter. Proved in full for two messages, which is public-key encryption; the constant-round extension is sketched in the paper’s appendix without a theorem, its security half deferred to the PKE proof. 5 open	Black Box Separations Garbled Circuits Key Agreementotherseparationadaptation (ai)
	No Self-Reduction for LSN Conjecture 5.20 of the source. It proves no random self-reduction exists from an arbitrary worst-case QNCP instance into LSN, naming exchange symmetry between code and error as the obstruction, and proves the tableau-randomizing barrier conditionally on the scrambling gap being polynomially related to eps. It is explicit that this is not an impossibility for random self-reductions in general. 4 open	Average Case Hardness Learning Parity With Noise Quantum Information Stabilizer Codesimpossibilityadaptation (ai)
	No 2-element split NILPs A submitted construction gives a two-element split NILP for Boolean circuit satisfiability in the plain generic Type-III bilinear-group model; proof review and formalization remain open. 2 open	Generic Group Model Proof Size Lower Bounds Snarksimpossibilityresearch-solved
	iO Overhead, Single-Output The first of the source’s named main open problems. Its main theorem gives an Omega(s/log s) additive overhead lower bound for iO on multi-output circuits under NP not in BPP – an assumption that is minimal, since a zero-overhead scheme exists if NP is in BPP. The single-output case is not covered, and the source says why: its route runs through NP-hardness of Multi-MCSP. 4 open	Black Box Separations Minimum Circuit Size Problem One Way Functionslower-boundbarrier (ai)
	OWFs are black-box useless for key agreement Open in the general case, which the paper names as the central open problem left by its work. Settled for three restricted protocol classes: constant-query perfect, constant-round constant-query imperfect, and Merkle-type. 5 open	Black Box Separations Key Agreement One Way Functionsotherimpossibility
	OWFs are black-box helpful for CRHFs Open in both directions. Two relaxations — distributional and class-reduction helpfulness — are proved conditional on the Simon-oracle amplification conjecture; neither yields the universal auxiliary primitive the full statement needs. 4 open	Black Box Separations Collision Resistant Hashing One Way Functionsotherseparation
	Arithmetic Two-Server PIR Optimality O(n^{1/3}) is achieved by arithmetizing the classical two-server schemes. The source states that whether it can be improved – let alone brought to sub-polynomial – is unknown, and supplies a linear-algebraic characterization of exactly what an improvement would require. 5 open	Arithmetic Cryptography Private Information Retrievaltight-bound
	Perfect FASS at 3-out-of-5 Statistical and computational FASS are settled by the source and prior work. The perfect version is stated by the source to be open for every reconstruction threshold 3 <= t <= n-2, and open even for the weaker multi-dealer notion, with 3-out-of-5 the smallest open case. Con has settled the perfect case for gap threshold structures. 5 open	Anonymity Threshold Secret Sharingcharacterizationadaptation (ai)
	Polylog Shuffle PIR, Negligible Error Settled in three neighbouring corners: O(n^gamma) communication with inverse-polynomial error and polynomially many queries; polylogarithmic communication with n^{O(log n)} queries; and negligible error with O(n/log n) communication. The polylogarithmic-and-negligible corner with polynomially many queries is open, and is ruled out for inner-outer constructions with an additive inner layer by the source’s own Theorem 6.5. 5 open	Private Information Retrieval Shuffle Modelcharacterizationadaptation (ai)
	OWF minimality, non-black-box reductions Open when the classical security implication is not witnessed by a black-box reduction between the two games. Settled affirmatively whenever it is, for uniform and non-uniform quantum adversaries alike, with the implementation reduction left arbitrary. 5 open	Black Box Separations One Way Functions Quantum Cryptographyequivalence
	Simon-oracle amplification, strong version Open. The version without the collision finder is known only when the one-way function is itself a random oracle; with an arbitrary one-way function, with or without the collision finder, nothing is established. 5 open	Black Box Separations Collision Resistant Hashing One Way Functionsotherlower-bound
	RS Proximity Gaps to Capacity Proved up to the Johnson/Guruswami-Sudan bound delta < 1 - sqrt(rho); conjectured up to capacity delta <= 1 - rho - eta. The source records that nothing known contradicts c1 = c2 = 2, and that in characteristic greater than the degree nothing known contradicts c1 = c2 = 1 – while those smaller exponents are provably ruled out in characteristic two. 5 open	Proximity Testing Reed Solomon Codes Snarkstight-boundbarrier (ai)
	Quasi-Abelian GV, Growing Group Named as a conjecture by the source, which says the development is out of reach of the article. It is what makes the choice of group free in the QA-SD line: resistance to every linear test, for any abelian G, reduces to it. Partially advanced in 2026 by concrete non-asymptotic bounds for particular groups, which restate the general question as open. 5 open	Code Based Cryptography Dual Distance Pseudorandom Correlation Functions Syndrome Decodinglower-boundadaptation (ai)
	Ring-LWE error parity Open: whether recovering the Ring-LWE error modulo two is as hard as recovering the error itself. The easy direction is trivial; the source states it has no formal reduction for this one and relies on two heuristics instead, one of which changes the error distribution. 6 open	Learning With Errorsequivalence
	RM Gap to Capacity for BEC Conjecture 14 of the source. That Reed-Muller codes achieve capacity for the BEC is a theorem of Kudekar et al.; the gap to capacity – a polynomial rate of convergence – is open. The source needs it to strengthen its refutation of the expansion-implies-hardness conjecture for noisy k-XOR from quasi-polynomially many constraints to polynomially many, and notes the question was raised explicitly in three prior works. 4 open	Average Case Hardness Code Based Cryptography Expander Graphs Reed Solomon Codestight-bound
	No round-optimal pairing-free blind signature Open for a polynomial query budget. The impossibility is proved when User_2 and Verify together make O(log lambda) random-oracle queries, including when oracle outputs contain group elements; the superpolynomial message space hypothesis is retained. 5 open	Black Box Separations Blind Signatures Generic Group Model Signature Schemesggmimpossibilityadaptation (ai)
	RBR Soundness Amplification Known in the special case of r-round protocols whose standard and round-by-round soundness errors are maximally separated, eps_RBR about eps^{1/r}; open in general, including the eps^{2/r} regime the source’s own protocol occupies. 4 open	Fiat Shamir Parallel Repetitionlower-bound
	Computationally unique VDFs in the ROM Resolved. Guan, Riazanov and Yuan, Breaking Verifiable Delay Functions in the Random Oracle Model (ePrint 2024/766, CRYPTO 2025), prove that no VDF in the parallel ROM can have completeness and computational uniqueness and be sigma-sequential for sigma a fixed polynomial in the security parameter and the Setup/Verify query counts – their Theorem 5.1, which in fact covers general (not just perfect) completeness error, strictly more than this conjecture asked for. The proof is human-authored and published; it has not yet been independently re-derived by this site or formalized in Lean. 3 open	Black Box Separations Random Oracle Model Verifiable Delay Functionsromimpossibilityresearch-solved
	Salt Length vs. Call Count Fully open in both directions: no construction with \(O(\lambda)\)-length, message-independent salts and \(O(1)\) Merkle-Damgård calls is known, and no proof that none can exist, nor any trade-off between the two, has been given either. 4 open	Indifferentiability Random Oracle Modelromcharacterization
	Short-Salt MD Combiner Security Open in both directions: the source’s Theorem 3.1 proves security only when salts exceed the message by at least the security parameter, and reports neither an attack nor a security proof once the salts shrink to a constant number of blocks. 4 open	Indifferentiability Random Oracle Modelromcharacterizationadaptation (ai)
	3-way collision, oblivious sequential curve Open: closing the factor-root-S gap between the proved oblivious lower bound and a matching table-and-hunt algorithm for finding a 3-way collision with an oblivious sequential branching program. 2 open	Collision Finding Random Oracle Model Time Space Tradeoffsromtight-boundadaptation (ai)
	Compressed permutation oracle soundness Still open as formalized, but the underlying research question – can the compressed-oracle technique be extended to permutations at all – is now resolved in the affirmative by a different construction. Carolan (Compressed Permutation Oracles, ePrint 2025/1734, STOC 2026) proves his own compressed permutation oracle unconditionally sound. That oracle is, in his own words, ‘similar to that of Unruh [Unr23], though we explicitly and unitarily maintain injectivity of the database’ – a change that goes beyond resolving Unruh’s own left-open choice of how the flipping operator acts on non-injective inputs. Whether Unruh’s original construction (for an arbitrary such choice) is itself sound remains, on the reading defended here, unestablished.	Compressed Oracle Pseudorandom Permutations Quantum Query Complexityotherequivalence
	Hold-Out Soundness, Dirty Coordinates The source’s distinguishing attack is unconditional and proved. Its decryption attack is heuristic, and this is the unproved step: completeness on clean coordinates is its Claim 6.2, while soundness on dirty ones is supported only by a heuristic dimension count and small-parameter experiments. 5 open	Code Based Cryptography Private Information Retrievalcharacterization
	Statistical Robust ARE The source asks whether all functions admit a statistically secure ARE, robust or non-robust, and strongly conjectures the answer is negative. The non-robust half was refuted: Bitansky, Erabelli, Garg and Ishai construct statistical AREs for all finite functions. The robust half is open, and is re-posed by that later work. 4 open	Additive Randomized Encodings Randomized Encodingscharacterization
	Censoring can only hurt Open. The censored side is proved at essentially optimal round count with matching lower bounds; what is missing is the transfer of any such bound to uncensored AES at the same round count. 5 open	Block Ciphers Pseudorandom Permutationslower-bound
	Randomness Complexity of XOR The source proves an Omega(t^2) lower bound, matching Kushilevitz and Mansour’s non-explicit O(t^2 log(n/t)) upper bound up to a logarithmic factor, and up to a constant factor when t = Omega(n). It also gives an explicit protocol at O(t^2 log^2 n). It states it leaves the remaining polylogarithmic gaps open. 4 open	Limited Independence Randomness Complexitytight-bound
	MDSD Linear-Test Bias The source proves a non-tight reduction from standard decisional syndrome decoding and separately conjectures that the DOOM algorithm is the best attack; the linear-test bias is the one quantity it states it cannot bound. 5 open	Learning Parity With Noise Shuffle Model Syndrome Decodinglower-bound
	CHV Online Threshold Conjecture 1 of the source, its online threshold conjecture. The source gives an online algorithm achieving kappa = O(sqrt(alpha)/B) and an overlap-gap argument against stable algorithms; the conjecture pins the constant sqrt(pi/8) as the exact place where online algorithms stop. Separately it proves, under worst-case lattice hardness, that no polynomial-time algorithm solves CHV for kappa = O(1/(B n^(1/2+eps))). 4 open	Average Case Hardness Collision Resistant Hashing Locality Preserving Hashing Overlap Gap Propertytight-bound
	Non-adaptive DDH bound Open, and asserted rather than asked: the source proves 1/2 + O~(T^2/N + sqrt(ST/N)), states twice that it conjectures this is not tight for DDH, and names 1/2 + O~(T^2/N + ST/N) as the right answer. The same theorem’s square-DDH bound is sharp, with a matching attack, which is what makes the DDH case a question rather than a suspicion. 6 open	Adaptivity Discrete Logarithm Generic Group Model Time Space Tradeoffsggmtight-boundadaptation (ai)
	STB conjecture (Merkle-Damgård) Open for non-constant B in the regime ST^2 > 2^n, where the best published security bound and the best published attack are a factor of up to S apart; settled at B=1, B=2, every constant B, B~T, and every 2<B<T with ST^2 <= 2^n. 6 open	Collision Finding Collision Resistant Hashing Random Oracle Model Time Space Tradeoffsromtight-boundbarrier (ai)
	STB conjecture (sponge) Open for every B >= 2 except B ~ T: at B=2 in the regime ST^3 > C, and at B >= 3 with a gap of about T/B. The source asks for a proof or a refutation and takes no position. 7 open	Collision Finding Collision Resistant Hashing Time Space Tradeoffspromtight-boundbarrier (ai)
	Tight \(k\)-collision time-space tradeoff The exact tight time-space tradeoff for k>=3 collisions under preprocessing is open; only the k=2 case has a matching upper and lower bound. 2 open	Collision Finding Random Oracle Model Time Space Tradeoffsromtight-bound
	RBE update bound, key-dependent schedules Resolved. Wei Qi, Tight Lower Bound on Witness Update Frequency in Additive Positive Accumulators (IACR Communications in Cryptology, 2026), generalizes the Mahmoody-Qi-Rahimi lower-bound framework to schedules that may depend on the sampled public keys themselves, via a new combinatorial structure (the falling-step sequence), and proves the same asymptotic bound holds. The paper states this explicitly resolves the open problem left in the source paper. 5 open	Registration Based Encryptionlower-boundresearch-solvedadaptation (ai)
	WP Threshold Share Size The 2-out-of-n case is settled: Beimel and Franklin give 1/n-weakly-private schemes with share size 2, against Theta(log n) for perfect privacy. The source states large thresholds are open and asks specifically about (n-1)-out-of-n at share size o(log n). 5 open	Threshold Secret Sharingcharacterizationadaptation (ai)
	AES t-Wise Independence, t > 2 Named by the source as the first of the two outstanding open problems that come of its work. It proves almost pairwise independence (t = 2) for multi-round AES with independent round keys, and an existential t-wise result for key-alternating ciphers with most permutations, but nothing for concrete AES beyond t = 2. Its Appendix B attacks 4-wise independence in the width-1 case with the same S-box. 4 open	Block Ciphers Limited Independence Pseudorandom Permutations T Wise Independencecharacterizationbarrier (ai)