Update SECURITY.md

Author: MGeorgie

SECURITY.md

@@ -51,7 +51,15 @@ For exact schemes like BFV and BGV, implemented in Lattigo, near-perfect correct
 
 ### Multiparty/Threshold Homomorphic Encryption
 
-Multiparty or Threshold Fully Homomorphic Encryption involves secret-sharing the encryption key among multiple users, requiring their collaboration to decrypt data. The scheme maintains security even if a defined threshold number of users are compromised by an attacker. However, when decrypting, a party has access to the raw decrypted value before rounding, even with exact schemes. Since the receiver(s) (i.e. the decrypting party) may be corrupted, the attacker can mount the same kind of attacks, as described by [Checri et al.](https://eprint.iacr.org/2024/116) Fortunately, proper noise flooding as described by [Mouchet et al.](https://eprint.iacr.org/2020/304) (Section IV.E) thwarts these attacks. However, such methods require exponential noise, which will affect the performance and/or the correctness of the protocol.
+Multiparty or Threshold Fully Homomorphic Encryption involves secret-sharing the encryption key among multiple users, requiring their collaboration to decrypt data. The scheme maintains security even if a defined threshold number of users are compromised by an attacker. However, when decrypting, a party has access to the raw decrypted value before rounding, even with exact schemes. Since the receiver(s) (i.e. the decrypting party) may be corrupted, the attacker can mount the same kind of attacks, as described by [Checri et al.](https://eprint.iacr.org/2024/116) Fortunately, proper noise flooding (as introduced by Asharov et al.) and also described by [Mouchet et al.'20](https://eprint.iacr.org/2020/304) (Section IV.E) thwarts these attacks. However, such methods require exponential noise, which will affect the performance and/or the correctness of the protocol.
+
+
+#### On the insecurity of retries
+
+The current implementation of both the $N$-out-of-$N$ and $T$-out-of-$N$-threshold schemes (from [Mouchet et al.'20](https://eprint.iacr.org/2020/304) and [Mouchet et al.'22](https://eprint.iacr.org/2022/780), respectively) assume that any party participating to a given MHE protocol will not generate and transmit its share more than once (see [Mouchet et al.'24](https://eprint.iacr.org/2024/194)). When a party participates in a protocol (public/evaluation key-generation, key-switching or partial decryption) multiple times, several shares for the same public polynomial and secret-key share are disclosed, and the accumulated information may enable efficient key-recovery attacks. 
+This vulnerability has been identified in several recent works ([Mouchet et al.'24](https://eprint.iacr.org/2024/194), [Okada et al.](https://eprint.iacr.org/2025/409), [Colin de Verdière et al.](https://eprint.iacr.org/2026/031)). In particular, [Okada et al.](https://eprint.iacr.org/2025/409) points out that, by adaptively choosing the active set and repeating the protocol, an adversary can manipulate the coefficients and extract linear relations revealing the lower bits of the secret shares via simple linear algebra. More recently, [Colin de Verdière et al.](https://eprint.iacr.org/2026/031) presented a concrete attack.
+
+**Countermeasures:** Both [Mouchet et al.'24](https://eprint.iacr.org/2024/194) and [Colin de Verdière et al.](https://eprint.iacr.org/2026/031) propose countermeasures enabling retries, but none are currently implemented in Lattigo. Moreover, [Colin de Verdière et al.](https://eprint.iacr.org/2026/031) introduced a formal security model for MHE with synchronized decryptors (covering the case of retries), and show that the countermeasures proposed in [Mouchet et al.'24](https://eprint.iacr.org/2024/194) are insecure (in this model) for the specific case of threshold decryption/key-switching (the countermeasures for the key-generation protocol are unaffected).
 
 
 ### Limitations of the IND-CPA-D model