Can conjugating a block cipher really cut multiplications? This paper says yes, with SKINNY getting leaner.

Can AEGIS be bitsliced without becoming a crime scene? This paper says yes, with CT ARM, RISC-V, wasm, and JS code.

First-order masked ML-KEM for Pavona's ACC fits under 22 KB DMEM and costs 2.6x to 3.4x, because side channels insist.